Last Comment Bug 620468 - "ASSERTION: viewport width must be nonnegative"
: "ASSERTION: viewport width must be nonnegative"
Status: RESOLVED FIXED
: assertion, regression, testcase
Product: Core
Classification: Components
Component: SVG (show other bugs)
: Trunk
: x86 Mac OS X
: -- normal (vote)
: mozilla13
Assigned To: Cameron McCormack (:heycam)
:
:
Mentors:
Depends on:
Blocks: 344905
  Show dependency treegraph
 
Reported: 2010-12-20 12:12 PST by Jesse Ruderman
Modified: 2012-02-20 10:23 PST (History)
3 users (show)
cam: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (99 bytes, image/svg+xml)
2010-12-20 12:12 PST, Jesse Ruderman
no flags Details
stack trace (3.51 KB, text/plain)
2010-12-20 12:12 PST, Jesse Ruderman
no flags Details
Bail out earlier when computing CTM of an <svg> element with negative width/height attributes. (5.71 KB, patch)
2012-02-18 23:48 PST, Cameron McCormack (:heycam)
longsonr: review+
Details | Diff | Splinter Review

Description Jesse Ruderman 2010-12-20 12:12:01 PST
Created attachment 498787 [details]
testcase

###!!! ASSERTION: viewport width must be nonnegative!: 'aViewportWidth >= 0', file layout/svg/base/src/nsSVGUtils.cpp, line 797
Comment 1 Jesse Ruderman 2010-12-20 12:12:15 PST
Created attachment 498788 [details]
stack trace
Comment 2 Daniel Holbert [:dholbert] 2010-12-20 12:38:35 PST
This is a new assertion that I added in bug 272288 yesterday, to tighten up assumptions in nsSVGUtils::GetViewBoxTransform.

Negative widths aren't valid for <image> or <svg>, according to the spec:
 "A negative value is an error (see Error processing)"
 http://www.w3.org/TR/SVG11/struct.html#ImageElementWidthAttribute
 http://www.w3.org/TR/SVG11/struct.html#SVGElementWidthAttribute

Not sure if we currently trigger error-handling-code for this case...  If we don't want to bail out earlier than this, we could always just pass "max(0, width)" instead of "width" into nsSVGUtils::GetViewBoxTransform for cases like this.
Comment 3 Robert Longson 2010-12-20 18:57:59 PST
We don't trigger error handling code as we don't distinguish between different types of length when we parse them. i.e. width (no negatives allowed) and x (negatives OK).

We just want to bail as early as possible in a way that makes mRect in nsSVGPathGeometryFrame the empty rect.
Comment 4 Robert Longson 2010-12-20 19:03:33 PST
i.e. calling  nsSVGUtils::GetViewBoxTransform is pretty pointless if width <= 0 as we're not going to draw anything.
Comment 5 Cameron McCormack (:heycam) 2012-02-18 23:48:34 PST
Created attachment 598633 [details] [diff] [review]
Bail out earlier when computing CTM of an <svg> element with negative width/height attributes.
Comment 6 Cameron McCormack (:heycam) 2012-02-19 03:18:30 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/94423051f0fd
Comment 7 Ed Morley [:emorley] 2012-02-20 10:23:25 PST
https://hg.mozilla.org/mozilla-central/rev/94423051f0fd

Note You need to log in before you can comment on or make changes to this bug.