703550 - ###!!! ASSERTION: bad inline size: 'reflowOutput.ISize(lineWM) >= 0', file layout/generic/nsLineLayout.cpp:950

Status: NEW

(Core :: Layout, defect)

Description

[Christian Holler (:decoder)]

The following SVG causes an assertion on firefox debug builds (tested nightly 11.0a1 built from e7d5dd9efeca):

<svg xmlns="50" width="500" height="500">
<filter id="f1" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse">
  <svg xmlns="http://www.w3.org/2000/svg" style="background: url(#a); direction: rtl; margin: -32944px;"/>
</filter>
</svg>


While this is an SVG test, I don't think it's SVG specific, especially given bug 631922 and others mentioning this assert from non-SVG tests. The test here might be related to bug 631922 but if so, the testcase here seems easier to reproduce.

Comment 1

[Daniel Holbert [:dholbert]]

Attachment: reduced testcase

Here's a more reduced testcase, with SVG inside of HTML.

(I think the markup in comment 0 is treated as SVG inside of HTML, too.  At least, it's not treated as SVG-inside-of-SVG, because the <svg xmlns="50"> prevents that outer element from actually being treated as SVG. (also, if I "fix" that xmlns in comment 0 to use the actual SVG namespace, the bug goes away))

Comment 2

[Daniel Holbert [:dholbert]]

FWIW, we hit this assertion during the mochitest "test_value_computation.html" right now:

e.g. here's a snippet from a mozilla-central Linux Debug mochitests-4 log from today:
> 101190 INFO TEST-PASS | /tests/layout/style/test/test_value_computation.html | should not get initial value for '-moz-margin-start:-moz-calc(2px)' on elementf. - 2px should not equal 0px
> ###!!! ASSERTION: bad width: 'metrics.width>=0', file ../../../layout/generic/nsLineLayout.cpp, line 907
[...]
> 101191 INFO TEST-PASS | /tests/layout/style/test/test_value_computation.html | should not get empty value for '-moz-margin-start:-moz-calc(-2px)' - -2px should not equal

https://tbpl.mozilla.org/php/getParsedLog.php?id=12798098&tree=Firefox

Comment 3

[Daniel Holbert [:dholbert]]

We still get this issue with the attached testcase, though the assertion's text has changed a little. Now it looks like this:

###!!! ASSERTION: bad inline size: 'reflowOutput.ISize(lineWM) >= 0', file layout/generic/nsLineLayout.cpp:950