628358 - "ASSERTION: bad inline size"

Status: NEW

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (hangs Firefox when loaded)

Comment 1

[Jesse Ruderman]

Attachment: hang sample

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Doesn't hang on load anymore, but still asserts.

ASSERTION: bad inline size: 'metrics.ISize(lineWM) >= 0', file /builds/slave/m-cen-l64-d-000000000000000000/build/src/layout/generic/nsLineLayout.cpp, line 1039
ASSERTION: bad block size: 'metrics.BSize(lineWM) >= 0', file /builds/slave/m-cen-l64-d-000000000000000000/build/src/layout/generic/nsLineLayout.cpp, line 1040

Comment 3

[Daniel Holbert [:dholbert]]

Reducing severity -- the assertions in comment 2 aren't especially worrisome, given that the testcase here has padding: 32631964044403mm, which is probably large enough to trigger integer overflow in our 32-bit app-unit coordinate space representation.

These assertions are checking invariants that we expect to be honored, given reasonably-sized content. Absurdly-large content may make us violate these sorts of (nonfatal) assertions, and may produce broken layout, and that's a tradeoff we've accepted (rather than adding clamping & saturating arithmetic all over the place).

There's a bug somewhere on adding a "this document has some absurdly large content" flag, which we might use to disable some of these assertions. (I can't find it right now, but we might conceivably tie this to that bug.)