SVG with display: -moz-box causes crash




13 years ago
7 years ago


(Reporter: Benjamin Smedberg, Unassigned)


({crash, testcase})

crash, testcase
Dependency tree / graph
Bug Flags:
blocking1.8rc1 -
in-testsuite +

Firefox Tracking Flags

(Not tracked)



(2 attachments)



13 years ago
I've been trying to get SVG to participate in XUL box-model layout and any time I set the <svg> element to display: -moz-box I get a crash. Testcase coming up: the initial assertion is in

called from

And after several similar assertions, an assertion

###!!! ASSERTION: A box layout was called by InitBoxMetrics was never called: 'metrics' at nsFrame.cpp, line 5596

And the crash is in nsFrame::GetAscent derefencing "metrics".

Comment 1

13 years ago
Created attachment 201188 [details]
testcase (XUL+XML)

Comment 2

13 years ago
Any website can DoS the browser with this, right?  If so, then I think we need to fix this for FF 1.5.
Flags: blocking1.8rc1?
We have plenty of ways to "DOS" the browser.  Just being a crash is really not qualification for 1.8 at this point, imo.

That said, I'm not sure I follow what's going on here.  If calling InitBoxWrapped is needed for box layout methods, but we never call InitBoxWrapped on boxes, how does any of this work?  bryner, do you recall?
Ah, nevermind.  I was misreading my own debugger output...

So my build crashes because we end up trying to do box layout on an nsSVGRectFrame.  Which is a child of a box.  And which has no box metrics, because SVG doesn't call nsFrame::Init, so bryner's fix there to call InitBoxMetrics didn't make it through to SVG.

Comment 5

13 years ago
Created attachment 201194 [details] [diff] [review]
possible approach we could apply to svg's split init


13 years ago
Flags: blocking1.9a1?
Flags: blocking1.8rc1?
Flags: blocking1.8rc1-


12 years ago
Blocks: 316635

Comment 6

12 years ago
this is now wfm (at least with my debug build) after I checked in the patch for bug 322185. Essentially the patch there blocks xul display types for tag based frame creation. 

Comment 7

12 years ago
tor, is the patch in this bug still desirable?
Severity: normal → critical
Keywords: crash, testcase


11 years ago
Flags: blocking1.9a1?
Marking as WORKSFORME based on comment 6.

Note that Tor got rid of the split init in another patch so the patch in this bug is no longer required.
Last Resolved: 10 years ago
Resolution: --- → WORKSFORME

Comment 10

10 years ago
The test was giving me an XML parsing error; I fixed that by putting the comment after the '<?xml version="1.0"?>'.

Btw, in the future, please put crash-only tests in e.g. mozilla/layout/svg/crashtests/ instead of mozilla/layout/reftests/svg/bugs/.
I'm not prescient though! The crashtests directory was only created on 2007-12-12

We should raise a bug to move everything in mozilla/layout/reftests/svg/bugs into /mozilla/layout/svg/crashtests/ and then delete mozilla/layout/reftests/svg/bugs altogether.
Depends on: 421473
Created bug 421473 for the move
You need to log in before you can comment on or make changes to this bug.