Last Comment Bug 671484 - ASSERTION: root should not have auto-height containing block: 'aCBSize.height != NS_AUTOHEIGHT'
: ASSERTION: root should not have auto-height containing block: 'aCBSize.height...
Status: NEW
: assertion, testcase
Product: Core
Classification: Components
Component: SVG (show other bugs)
: Trunk
: x86 All
: -- critical with 1 vote (vote)
: ---
Assigned To: Nobody; OK to take it and work on it
:
Mentors:
Depends on:
Blocks: crossfuzz
  Show dependency treegraph
 
Reported: 2011-07-13 21:12 PDT by Bob Clary [:bc:]
Modified: 2011-11-08 10:34 PST (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
target.svg (700 bytes, image/svg+xml)
2011-07-13 21:12 PDT, Bob Clary [:bc:]
no flags Details
testcase (161 bytes, text/html)
2011-07-13 21:14 PDT, Bob Clary [:bc:]
no flags Details
wallpaper: assert instead of abort (1.37 KB, patch)
2011-10-10 08:38 PDT, Mats Palmgren (:mats)
roc: review+
Details | Diff | Review
stack (5.31 KB, text/plain)
2011-10-21 12:35 PDT, Mats Palmgren (:mats)
no flags Details

Description Bob Clary [:bc:] 2011-07-13 21:12:48 PDT
Created attachment 545822 [details]
target.svg

1. Load testcase

Uses window.open to load the target.svg then calls sizeToContent() on it.

ABORT: root should not have auto-height containing block: 'aCBSize.height != NS_AUTOHEIGHT', file /work/mozilla/builds/nightly/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp, line 342

#4  0x05be93d5 in nsSVGOuterSVGFrame::ComputeSize (this=0xd00158, aRenderingContext=0x25402270, aCBSize={<mozilla::gfx::BaseSize<int,nsSize>> = {width = 0, height = 1073741824}, <No data fields>}, aAvailableWidth=0, aMargin={<mozilla::gfx::BaseSize<int,nsSize>> = {width = 0, height = 0}, <No data fields>}, aBorder={<mozilla::gfx::BaseSize<int,nsSize>> = {width = 0, height = 0}, <No data fields>}, aPadding={<mozilla::gfx::BaseSize<int,nsSize>> = {width = 0, height = 0}, <No data fields>}, aShrinkWrap=0) at /work/mozilla/builds/nightly/mozilla/layout/svg/base/src/nsSVGOuterSVGFrame.cpp:341
#5  0x051af24e in nsHTMLReflowState::InitConstraints (this=0xbfffa7d4, aPresContext=0xce3e00, aContainingBlockWidth=0, aContainingBlockHeight=1073741824, aBorder=0x0, aPadding=0x0) at /work/mozilla/builds/nightly/mozilla/layout/generic/nsHTMLReflowState.cpp:1863
#6  0x051af540 in nsHTMLReflowState::Init (this=0xbfffa7d4, aPresContext=0xce3e00, aContainingBlockWidth=-1, aContainingBlockHeight=-1, aBorder=0x0, aPadding=0x0) at /work/mozilla/builds/nightly/mozilla/layout/generic/nsHTMLReflowState.cpp:282
#7  0x051afa08 in nsHTMLReflowState::nsHTMLReflowState (this=0xbfffa7d4, aPresContext=0xce3e00, aParentReflowState=@0xbfffaad8, aFrame=0xd00158, aAvailableSpace=@0xbfffa91c, aContainingBlockWidth=-1, aContainingBlockHeight=-1, aInit=1) at /work/mozilla/builds/nightly/mozilla/layout/generic/nsHTMLReflowState.cpp:175
#8  0x051a9361 in nsCanvasFrame::Reflow (this=0xcf9fb0, aPresContext=0xce3e00, aDesiredSize=@0xbfffac24, aReflowState=@0xbfffaad8, aStatus=@0xbfffab90) at /work/mozilla/builds/nightly/mozilla/layout/generic/nsCanvasFrame.cpp:473
#
Comment 1 Bob Clary [:bc:] 2011-07-13 21:14:24 PDT
Created attachment 545823 [details]
testcase
Comment 2 Bob Clary [:bc:] 2011-07-13 21:18:01 PDT
also on winxp.
Comment 3 Martijn Wargers [:mwargers] (not working for Mozilla) 2011-08-31 13:41:54 PDT
Is the testcase supposed to crash? It doesn't crash in current trunk build at least.
Comment 4 Bob Clary [:bc:] 2011-08-31 13:53:15 PDT
Martijn, are you using a debug build?
Comment 5 Martijn Wargers [:mwargers] (not working for Mozilla) 2011-08-31 15:00:16 PDT
No, is it only crashing in debug builds?
Comment 6 Bob Clary [:bc:] 2011-08-31 18:01:21 PDT
Yes, the ABORT is a debug only fatal assertion.  I think you need browser.link.open_newwindow 0 to see the abort. I just reproduced on Mac and Windows beta, aurora, nightly.
Comment 7 Mats Palmgren (:mats) 2011-10-10 08:37:25 PDT
The unconstrained height seems intentional, it comes from here:
http://mxr.mozilla.org/mozilla-central/source/layout/base/nsDocumentViewer.cpp#3281
I'm hitting this a lot when fuzz testing with cross_fuzz, so let's make it
into an assertion for now...
Comment 8 Mats Palmgren (:mats) 2011-10-10 08:38:30 PDT
Created attachment 565945 [details] [diff] [review]
wallpaper: assert instead of abort
Comment 9 Robert Longson 2011-10-10 09:08:19 PDT
Comment on attachment 565945 [details] [diff] [review]
wallpaper: assert instead of abort

jwatt is a better reviewer for SVG reflow interaction.
Comment 10 Jonathan Watt [:jwatt] (Away Jun. 27 - Jul. 13) 2011-10-18 03:22:10 PDT
Mats, I'm having trouble getting crossfuzz to hit this abort. Do you have a stack handy? I'd like to see if there isn't an simple cause and easy fix before checking this patch in.
Comment 11 Bob Clary [:bc:] 2011-10-18 06:28:04 PDT
jwatt: see the test case.
Comment 12 Mats Palmgren (:mats) 2011-10-18 07:44:30 PDT
jwatt: the profile you use for cross_fuzz testing needs a few prefs:
"block popup windows" = off
"open new windows in a new tab instead" = off
"allow scripts to" (Content/JavaScript Advanced dialog): turn on all
"slow script warning" = off

The root cause seems to be that DocumentViewerImpl::SizeToContent() does an
intentional unconstrained height reflow:
http://mxr.mozilla.org/mozilla-central/source/layout/base/nsDocumentViewer.cpp#3260
3260   nsresult rv = presShell->ResizeReflow(prefWidth, NS_UNCONSTRAINEDSIZE);
3261   NS_ENSURE_SUCCESS(rv, rv);

Let me know if you can't reproduce it with the attached testcase and I'll
dig up the exact stack.
Comment 13 Mats Palmgren (:mats) 2011-10-21 12:35:08 PDT
Created attachment 568740 [details]
stack

Reproducible in 10-20 seconds in m-c debug build on WinXP using this URL:
file://.../cross_fuzz_randomized_20110105_seed.html#-501598811
Comment 14 Robert O'Callahan (:roc) (Exited; email my personal email if necessary) 2011-10-31 18:03:36 PDT
Comment on attachment 565945 [details] [diff] [review]
wallpaper: assert instead of abort

Review of attachment 565945 [details] [diff] [review]:
-----------------------------------------------------------------

OK, but this shouldn't be too hard to fix for real.
Comment 15 Jonathan Watt [:jwatt] (Away Jun. 27 - Jul. 13) 2011-11-01 03:27:26 PDT
David added the NS_ABORT_IF_FALSE in https://hg.mozilla.org/mozilla-central/rev/58fe3ede72f8

Any thoughts on this David?
Comment 16 Mats Palmgren (:mats) 2011-11-04 11:12:22 PDT
Pushed the wallpaper to inbound:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3cc7e91d6090
To whoever merges that to mozilla-central - please leave the bug open.
Comment 17 Marco Bonardo [::mak] 2011-11-05 02:56:05 PDT
https://hg.mozilla.org/mozilla-central/rev/3cc7e91d6090

Note You need to log in before you can comment on or make changes to this bug.