Jesse Ruderman Reporter
	Description • 12 years ago

###!!! ASSERTION: Must not call under nsISVGChildFrame::UpdateBounds!: '!OuterSVGIsCallingUpdateBounds(aFrame)', file layout/svg/base/src/nsSVGUtils.cpp, line 820

###!!! ASSERTION: aDuringUpdate lies!: 'aDuringUpdate == OuterSVGIsCallingUpdateBounds(aFrame)', file layout/svg/base/src/nsSVGUtils.cpp, line 671

###!!! ASSERTION: Must not InvalidateRenderingObservers() under nsISVGChildFrame::UpdateBounds!: '!OuterSVGIsCallingUpdateBounds(aFrame)', file layout/svg/base/src/nsSVGUtils.cpp, line 683

###!!! ASSERTION: Do not call under nsISVGChildFrame::UpdateBounds!: '!OuterSVGIsCallingUpdateBounds(aFrame)', file layout/svg/base/src/nsSVGUtils.cpp, line 749

	Jonathan Watt [:jwatt]
	Comment 2 • 12 years ago

Hmm, the stack traces in the attachment are a bit busted. A more accurate stack is:

nsSVGUtils::InvalidateBounds        <- second and third assertions
nsSVGUtils::InvalidateAndScheduleBoundsUpdate   <- first assertion
nsSVGTextFrame::NotifyGlyphMetricsChange
nsSVGTextContainerFrame::NotifyGlyphMetricsChange
nsSVGTextPathProperty::DoUpdate
nsSVGRenderingObserver::InvalidateViaReferencedElement
nsSVGRenderingObserverList::InvalidateAll
nsSVGEffects::InvalidateDirectRenderingObservers
nsSVGEffects::InvalidateDirectRenderingObservers
nsIFrame::InvalidateInternal
nsIFrame::InvalidateWithFlags
nsIFrame::Invalidate
nsSVGUtils::InvalidateBounds
nsSVGGlyphFrame::UpdateBounds
nsSVGDisplayContainerFrame::UpdateBounds
nsSVGTextFrame::UpdateBounds
nsSVGOuterSVGFrame::DidReflow

The fourth assertion is in nsSVGUtils::ScheduleBoundsUpdate, which is called by nsSVGUtils::InvalidateAndScheduleBoundsUpdate when nsSVGUtils::InvalidateBounds returns.

The problem is that nsIFrame::InvalidateInternal calls nsSVGEffects::InvalidateDirectRenderingObservers, but nsIFrame::InvalidateInternal can be called during reflow, which is a bad time to be trying to invalidate observers since we want to be able to mark frames as dirty and call FrameNeedsReflow under nsSVGUtils::InvalidateBounds.

One way to prevent this would be to have an nsSVGOuterSVGFrame::InvalidateInternal override that checks the state of its mCallingUpdateBounds member, but that's probably not the best way for various reasons.

	Robert Longson [:longsonr]
	Comment 3 • 12 years ago

bug 539356 fixed this. It would be great if the testcase could land as a crashtest though as that bug didn't have any tests that test this case.

	Robert Longson [:longsonr]
	Comment 4 • 12 years ago

Apologies comment 3 is for a different bug.

	Robert Longson [:longsonr]
	Comment 5 • 12 years ago

This is bug 779971. The function name changed which is why there are two bugs.