1605223 - Assertion failure: false (unknown func type?), at src/layout/svg/nsFilterInstance.cpp:113

Status: RESOLVED FIXED

(Core :: Web Painting, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20191218211221
SourceStamp=f870bccd07eeedcde5f5e0ee290d6b2158934105

This seems to only reproducible with gfx.webrender.all=true

Assertion failure: false (unknown func type?), at src/layout/svg/nsFilterInstance.cpp:113

#0 FuncTypeToWr(unsigned char) src/layout/svg/nsFilterInstance.cpp:113:7
#1 nsFilterInstance::BuildWebRenderFilters(nsIFrame*, mozilla::Span<mozilla::StyleGenericFilter<mozilla::StyleAngle, float, float, mozilla::StyleCSSPixelLength, mozilla::StyleGenericSimpleShadow<mozilla::StyleGenericColor<mozilla::StyleRGBA>, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength>, mozilla::StyleComputedUrl> const, 18446744073709551615ul>, WrFiltersHolder&, mozilla::Maybe<nsRect>&) src/layout/svg/nsFilterInstance.cpp:307:31
#2 nsDisplayFilters::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, nsDisplayListBuilder*) src/layout/painting/nsDisplayList.cpp:10469:8
#3 mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(nsDisplayList*, nsDisplayItem*, nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1751:38
#4 mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, nsDisplayList*, nsDisplayListBuilder*, mozilla::wr::RenderRootArray<mozilla::layers::WebRenderScrollData>&, WrFiltersHolder&&) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1598:5
#5 mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(nsDisplayList*, nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*) src/gfx/layers/wr/WebRenderLayerManager.cpp:326:30
#6 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) src/layout/painting/nsDisplayList.cpp:3171:18
#7 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:4133:13
#8 mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) src/layout/base/PresShell.cpp:6036:5
#9 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:461:18
#10 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:396:22
#11 nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:1019:5
#12 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2177:11
#13 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:351:7
#14 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:368:5
#15 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:740:16
#16 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:635:9
#17 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#18 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
#19 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:5876:32
#20 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2212:25
#21 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2134:9
#22 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1973:3
#23 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:2004:13
#24 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1241:14
#25 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#26 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
#27 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#28 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#29 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#30 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:946:20
#31 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:237:9
#32 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#33 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#34 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:781:34
#35 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#36 main src/browser/app/nsBrowserApp.cpp:303:18

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/rFg_UqAYz_5HCMGKSVsS6g/index.html

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:TYLin, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:mattwoodrow, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Matt Woodrow (:mattwoodrow)]

Looks like <feFuncG type="" /> results in SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN, which we don't handle.

Comment 5

[Timothy Nikkel (:tnikkel)]

Attachment: Bug 1605223. Handle SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN when computing webrender filter information for component transfer filters. r?mstange

In SVGComponentTransferFunctionElement::ComputeAttributes type will be 0 == SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN if a func type is not specified.

SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY is specified as the default value at

https://searchfox.org/mozilla-central/rev/cfd1cc461f1efe0d66c2fdc17c024a203d5a2fd8/dom/svg/SVGFilters.cpp#183

So one would think we would get SVG_FECOMPONENTTRANSFER_TYPE_IDENTITY for unknown func types, but I don't understand that code too well.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a1ff0af83ad2
Handle SVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN when computing webrender filter information for component transfer filters. r=mstange

Comment 7

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/a1ff0af83ad2