1825459 - Assertion failure: !OuterSVGIsCallingReflowSVG(aFrame) (Do not call under ISVGDisplayableFrame::ReflowSVG!) at /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:156

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[2366719611]

Attachment: the html that causes the crash.

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36

Steps to reproduce:

open the attached html file with firefox debug version.

Actual results:

the firefox crashed.
log:
Assertion failure: !OuterSVGIsCallingReflowSVG(aFrame) (Do not call under ISVGDisplayableFrame::ReflowSVG!), at /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:156
#01: ??? mozilla::SVGUtils::ScheduleReflowSVG(nsIFrame*)
#02: ??? mozilla::SVGMarkerObserver::OnRenderingChange()
#03: ??? mozilla::SVGRenderingObserverSet::InvalidateAll()
#04: ??? InvalidateFrameInternal(nsIFrame*, bool, bool)
#05: ??? mozilla::SVGGeometryFrame::ReflowSVG()
#06: ??? mozilla::SVGDisplayContainerFrame::ReflowSVG()
#07: ??? mozilla::SVGOuterSVGFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
#08: ??? nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)
#09: ??? nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)
#10: ??? nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)
#11: ??? nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*)
#12: ??? nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*)
#13: ??? nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&)
#14: ??? nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
#15: ??? nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&)
#16: ??? nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*)
#17: ??? nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*)
#18: ??? nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&)
#19: ??? nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
#20: ??? nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)
#21: ??? nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool)
#22: ??? nsColumnSetFrame::FindBestBalanceBSize(mozilla::ReflowInput const&, nsPresContext*, nsColumnSetFrame::ReflowConfig&, nsColumnSetFrame::ColumnBalanceData, mozilla::ReflowOutput&, bool, nsReflowStatus&)
#23: ??? nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
#24: ??? nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&)
#25: ??? nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*)
#26: ??? nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*)
#27: ??? nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&)
#28: ??? nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
#29: ??? nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)
#30: ??? nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
#31: ??? nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)
#32: ??? nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*)
#33: ??? nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&)
#34: ??? nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
#35: ??? nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)
#36: ??? mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)
#37: ??? mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*)
#38: ??? mozilla::PresShell::ProcessReflowCommands(bool)
#39: ??? mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)
#40: ??? mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush)
#41: ??? nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&)
#42: ??? nsDocLoader::OnStopRequest(nsIRequest*, nsresult)
#43: ??? nsDocShell::OnStopRequest(nsIRequest*, nsresult)
#44: ??? mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult)
#45: ??? mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)
#46: ??? mozilla::dom::Document::DoUnblockOnload()
#47: ??? mozilla::dom::Document::UnblockOnload(bool)
#48: ??? mozilla::dom::Document::DispatchContentLoadedEvents()
#49: ??? mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::)(), true, (mozilla::RunnableKind)0>::Run()
#50: ??? mozilla::SchedulerGroup::Runnable::Run()
#51: ??? mozilla::RunnableTask::Run()
#52: ??? mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
#53: ??? mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
#54: ??? mozilla::TaskController::ProcessPendingMTTask(bool)
#55: ??? mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run()
#56: ??? nsThread::ProcessNextEvent(bool, bool)
#57: ??? NS_ProcessNextEvent(nsIThread*, bool)
#58: ??? mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
#59: ??? MessageLoop::RunInternal()
#60: ??? MessageLoop::Run()
#61: ??? nsBaseAppShell::Run()
#62: ??? XRE_RunAppShell()
#63: ??? mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)
#64: ??? MessageLoop::RunInternal()
#65: ??? MessageLoop::Run()
#66: ??? XRE_InitChildProcess(int, char**, XREChildData const*)
#67: ??? content_process_main(mozilla::Bootstrap*, int, char**)
#68: ??? main
#69: __libc_start_main __libc_start_main
#70: ??? _start
#71: ??? (???:???)

Expected results:

the firefox should not crash.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Layout' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:dshin, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[David Shin[:dshin]]

Attachment: Minimized test case

Looking at the chain of required things - S3 should be ok.

Comment 4

[Robert Longson [:longsonr]]

Doesn't crash any more for me. Presumably fixed by bug 1982914