314244 - SVG with display: -moz-box causes crash

Status: RESOLVED WORKSFORME

(Core :: SVG, defect)

Description

[Benjamin Smedberg]

I've been trying to get SVG to participate in XUL box-model layout and any time I set the <svg> element to display: -moz-box I get a crash. Testcase coming up: the initial assertion is in

nsSVGPathGeometryFrame::GetOuterSVGFrame
called from
nsSVGPathGeometryFrame::InitSVG

And after several similar assertions, an assertion

###!!! ASSERTION: A box layout was called by InitBoxMetrics was never called: 'metrics' at nsFrame.cpp, line 5596

And the crash is in nsFrame::GetAscent derefencing "metrics".

Comment 1

[Benjamin Smedberg]

Attachment: testcase (XUL+XML)

Comment 2

[Darin Fisher]

Any website can DoS the browser with this, right?  If so, then I think we need to fix this for FF 1.5.

Comment 3

[Boris Zbarsky [:bzbarsky]]

We have plenty of ways to "DOS" the browser.  Just being a crash is really not qualification for 1.8 at this point, imo.

That said, I'm not sure I follow what's going on here.  If calling InitBoxWrapped is needed for box layout methods, but we never call InitBoxWrapped on boxes, how does any of this work?  bryner, do you recall?

Comment 4

[Boris Zbarsky [:bzbarsky]]

Ah, nevermind.  I was misreading my own debugger output...

So my build crashes because we end up trying to do box layout on an nsSVGRectFrame.  Which is a child of a box.  And which has no box metrics, because SVG doesn't call nsFrame::Init, so bryner's fix there to call InitBoxMetrics didn't make it through to SVG.

Comment 5

[tor]

Attachment: possible approach we could apply to svg's split init

Comment 6

[Bernd]

this is now wfm (at least with my debug build) after I checked in the patch for bug 322185. Essentially the patch there blocks xul display types for tag based frame creation. 

Comment 7

[Jesse Ruderman]

tor, is the patch in this bug still desirable?

Comment 8

[Robert Longson [:longsonr]]

Marking as WORKSFORME based on comment 6.

Note that Tor got rid of the split init in another patch so the patch in this bug is no longer required.

Comment 9

[Robert Longson [:longsonr]]

http://lxr.mozilla.org/seamonkey/source/layout/reftests/svg/bugs/bug314244.xul

Comment 10

[Jesse Ruderman]

The test was giving me an XML parsing error; I fixed that by putting the comment after the '<?xml version="1.0"?>'.

Btw, in the future, please put crash-only tests in e.g. mozilla/layout/svg/crashtests/ instead of mozilla/layout/reftests/svg/bugs/.

Comment 11

[Robert Longson [:longsonr]]

I'm not prescient though! The crashtests directory was only created on 2007-12-12

We should raise a bug to move everything in mozilla/layout/reftests/svg/bugs into /mozilla/layout/svg/crashtests/ and then delete mozilla/layout/reftests/svg/bugs altogether.

Comment 12

[Robert Longson [:longsonr]]

Created bug 421473 for the move