Jesse Ruderman Reporter
	Description • 17 years ago

###!!! ASSERTION: reflow state made child wrong size: 'reflowState.ComputedWidth() == size.width', file /Users/jruderman/trunk/mozilla/layout/svg/base/src/nsSVGForeignObjectFrame.cpp, line 580

###!!! ASSERTION: unexpected size: 'size.width == desiredSize.width && size.height == desiredSize.height', file /Users/jruderman/trunk/mozilla/layout/svg/base/src/nsSVGForeignObjectFrame.cpp, line 586

(The second assertion also shows up in bug 384499.)

	Jesse Ruderman Reporter
	Comment 1 • 17 years ago

Adding a <script> tag removes the extra assertions.

	Jesse Ruderman Reporter
	Comment 2 • 17 years ago

The first testcase triggers extra assertions:

###!!! ASSERTION: XXX. We shouldn't get here. Viewbox width/height is set to 0. Need to disable display of element as per specs.: 'Error', file /Users/jruderman/trunk/mozilla/content/svg/content/src/nsSVGSVGElement.cpp, line 1266

###!!! ASSERTION: can't mark frame dirty during reflow: '!mIsReflowing', file /Users/jruderman/trunk/mozilla/layout/base/nsPresShell.cpp, line 3073

	Jonathan Watt [:jwatt] Assignee
	Comment 3 • 17 years ago

Since processing of length attributes has been consolidated into a single place (nsSVGElement) it's not so easy to handle rogue values in a robust way. I'm not too keen on scattering checks throughout layout wherever we call GetAnimatedLengthValues. Maybe GetAnimatedLengthValues could be made to know about arbitrary restrictions on length values and clamp the values it returns?

	Jonathan Watt [:jwatt] Assignee
	Comment 4 • 17 years ago

Hmm, in addition to that I guess we need to treat a width or height of less than zero as if it was zero. That is to say, we are required to disable rendering (and might as well disable reflow) for the element (the element will be reflowed if/when the width/height are made > 0).

	Jonathan Watt [:jwatt] Assignee
	Comment 5 • 17 years ago

Jesse: it's also really tedious that I still have to ask to see SVG security bugs. I can see this bug blocks some secret bug, but it would help in deciding how important this bug really is if I could see what it's about.

	Jonathan Watt [:jwatt] Assignee
	Comment 6 • 17 years ago

Here's a patch. It would be nice if GetAnimatedLengthValues knew how to clamp, but for now we can do it at the relevant call sites.

	Jesse Ruderman Reporter
	Comment 7 • 17 years ago

Crashtest checked in.