Closed Bug 671484 Opened 9 years ago Closed 2 years ago

ASSERTION: root should not have auto-height containing block: 'aCBSize.height != NS_AUTOHEIGHT'


(Core :: SVG, defect, critical)

Not set





(Reporter: bc, Unassigned)


(Blocks 1 open bug)


(Keywords: assertion, testcase)


(4 files)

Attached image target.svg
1. Load testcase

Uses to load the target.svg then calls sizeToContent() on it.

ABORT: root should not have auto-height containing block: 'aCBSize.height != NS_AUTOHEIGHT', file /work/mozilla/builds/nightly/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp, line 342

#4  0x05be93d5 in nsSVGOuterSVGFrame::ComputeSize (this=0xd00158, aRenderingContext=0x25402270, aCBSize={<mozilla::gfx::BaseSize<int,nsSize>> = {width = 0, height = 1073741824}, <No data fields>}, aAvailableWidth=0, aMargin={<mozilla::gfx::BaseSize<int,nsSize>> = {width = 0, height = 0}, <No data fields>}, aBorder={<mozilla::gfx::BaseSize<int,nsSize>> = {width = 0, height = 0}, <No data fields>}, aPadding={<mozilla::gfx::BaseSize<int,nsSize>> = {width = 0, height = 0}, <No data fields>}, aShrinkWrap=0) at /work/mozilla/builds/nightly/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp:341
#5  0x051af24e in nsHTMLReflowState::InitConstraints (this=0xbfffa7d4, aPresContext=0xce3e00, aContainingBlockWidth=0, aContainingBlockHeight=1073741824, aBorder=0x0, aPadding=0x0) at /work/mozilla/builds/nightly/mozilla/layout/generic/nsHTMLReflowState.cpp:1863
#6  0x051af540 in nsHTMLReflowState::Init (this=0xbfffa7d4, aPresContext=0xce3e00, aContainingBlockWidth=-1, aContainingBlockHeight=-1, aBorder=0x0, aPadding=0x0) at /work/mozilla/builds/nightly/mozilla/layout/generic/nsHTMLReflowState.cpp:282
#7  0x051afa08 in nsHTMLReflowState::nsHTMLReflowState (this=0xbfffa7d4, aPresContext=0xce3e00, aParentReflowState=@0xbfffaad8, aFrame=0xd00158, aAvailableSpace=@0xbfffa91c, aContainingBlockWidth=-1, aContainingBlockHeight=-1, aInit=1) at /work/mozilla/builds/nightly/mozilla/layout/generic/nsHTMLReflowState.cpp:175
#8  0x051a9361 in nsCanvasFrame::Reflow (this=0xcf9fb0, aPresContext=0xce3e00, aDesiredSize=@0xbfffac24, aReflowState=@0xbfffaad8, aStatus=@0xbfffab90) at /work/mozilla/builds/nightly/mozilla/layout/generic/nsCanvasFrame.cpp:473
Attached file testcase
also on winxp.
Severity: normal → critical
OS: Mac OS X → All
Is the testcase supposed to crash? It doesn't crash in current trunk build at least.
Martijn, are you using a debug build?
No, is it only crashing in debug builds?
Yes, the ABORT is a debug only fatal assertion.  I think you need 0 to see the abort. I just reproduced on Mac and Windows beta, aurora, nightly.
The unconstrained height seems intentional, it comes from here:
I'm hitting this a lot when fuzz testing with cross_fuzz, so let's make it
into an assertion for now...
Comment on attachment 565945 [details] [diff] [review]
wallpaper: assert instead of abort

jwatt is a better reviewer for SVG reflow interaction.
Attachment #565945 - Flags: review?(longsonr) → review?(jwatt)
Mats, I'm having trouble getting crossfuzz to hit this abort. Do you have a stack handy? I'd like to see if there isn't an simple cause and easy fix before checking this patch in.
jwatt: see the test case.
jwatt: the profile you use for cross_fuzz testing needs a few prefs:
"block popup windows" = off
"open new windows in a new tab instead" = off
"allow scripts to" (Content/JavaScript Advanced dialog): turn on all
"slow script warning" = off

The root cause seems to be that DocumentViewerImpl::SizeToContent() does an
intentional unconstrained height reflow:
3260   nsresult rv = presShell->ResizeReflow(prefWidth, NS_UNCONSTRAINEDSIZE);
3261   NS_ENSURE_SUCCESS(rv, rv);

Let me know if you can't reproduce it with the attached testcase and I'll
dig up the exact stack.
Attached file stack
Reproducible in 10-20 seconds in m-c debug build on WinXP using this URL:
Attachment #565945 - Flags: review?(jwatt) → review?(roc)
Comment on attachment 565945 [details] [diff] [review]
wallpaper: assert instead of abort

Review of attachment 565945 [details] [diff] [review]:

OK, but this shouldn't be too hard to fix for real.
Attachment #565945 - Flags: review?(roc) → review+
David added the NS_ABORT_IF_FALSE in

Any thoughts on this David?
Pushed the wallpaper to inbound:
To whoever merges that to mozilla-central - please leave the bug open.
Target Milestone: mozilla10 → ---
Summary: ABORT: root should not have auto-height containing block: 'aCBSize.height != NS_AUTOHEIGHT' → ASSERTION: root should not have auto-height containing block: 'aCBSize.height != NS_AUTOHEIGHT'
Nothing shows in the console when loading this testcase with a debug build nowadays.
Closed: 2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.