Closed Bug 1870200 Opened 1 years ago Closed 1 year ago

stack-overflow on mozilla::SVGUtils::GetBBox, with `transform-box: border-box` and `vector-effect="non-scaling-stroke"`

Categories

(Core :: SVG, defect)

Product:
Core
Component:
SVG
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
125 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox120 --- disabled
firefox121 --- disabled
firefox122 --- disabled
firefox123 --- disabled
firefox124 --- disabled
firefox125 --- verified

People

(Reporter: wh0tlif3, Assigned: boris)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords, Whiteboard: [reporter-external] [client-bounty-form] [verif?][bugmon:bisected,confirmed], [wptsync upstream])

Crash Data

Attachments

(3 files, 1 obsolete file)

testcase.html
179 bytes, text/html
Details
testcase 2 (further simplified)
171 bytes, text/html
Details
Bug 1870200 - Break the cyclic dependency if any of the desendants uses non-scaling-stroke.
48 bytes, text/x-phabricator-request
Details | Review
Attached file test_7622.html (obsolete) — 
==4155306==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd39910a48 (pc 0x55cde4210aef bp 0x7ffd39911290 sp 0x7ffd39910a50 T0)
    #0 0x55cde4210aef in __asan_memcpy /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3
    #1 0x7fe53550aa6f in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:886:14
    #2 0x7fe534e63bce in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9632:11
    #3 0x7fe534bff37c in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:74:31
    #4 0x7fe534bff37c in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #5 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #6 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #7 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layo
ut/painting/nsDisplayList.cpp:6160:11
    #8 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #9 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479
:13
    #10 0x7fe5329d98ec in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:496:22
    #11 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #12 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #13 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #14 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #15 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #16 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFr
ame.cpp
    #17 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #18 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #19 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #20 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #21 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #22 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #23 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/lay
out/painting/nsDisplayList.cpp:6160:11
    #24 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #25 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:47
9:13
    #26 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #27 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #28 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #29 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #30 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #31 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #32 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFr
ame.cpp
    #33 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #34 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #35 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #36 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #37 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #38 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #39 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/lay
out/painting/nsDisplayList.cpp:6160:11
    #40 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #41 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:47
9:13
    #42 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #43 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #44 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #45 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #46 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #47 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #48 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFr
ame.cpp
    #49 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #50 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #51 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #52 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #53 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #54 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #55 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #56 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #57 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #58 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #59 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #60 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #61 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #62 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #63 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #64 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #65 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #66 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #67 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #68 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #69 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #70 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #71 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #72 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #73 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #74 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #75 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #76 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #77 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #78 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #79 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #80 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #81 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #82 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #83 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #84 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #85 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #86 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #87 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #88 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #89 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #90 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #91 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #92 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #93 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #94 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #95 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #96 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #97 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #98 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #99 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #100 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #101 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #102 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #103 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #104 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #105 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #106 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #107 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #108 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #109 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #110 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #111 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #112 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #113 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #114 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #115 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #116 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #117 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #118 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #119 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #120 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #121 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #122 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #123 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #124 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #125 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #126 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #127 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #128 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #129 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #130 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #131 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #132 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #133 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #134 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #135 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #136 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #137 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #138 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #139 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #140 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #141 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #142 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #143 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #144 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #145 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #146 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #147 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #148 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #149 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #150 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #151 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #152 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #153 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #154 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #155 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #156 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #157 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #158 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #159 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #160 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #161 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #162 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #163 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #164 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #165 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #166 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #167 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #168 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #169 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #170 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #171 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #172 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #173 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #174 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #175 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #176 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #177 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #178 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #179 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #180 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #181 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #182 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #183 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #184 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #185 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #186 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #187 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #188 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #189 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #190 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #191 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #192 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #193 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #194 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #195 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #196 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #197 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #198 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #199 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #200 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #201 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #202 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #203 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #204 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #205 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #206 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #207 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #208 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #209 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #210 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #211 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #212 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #213 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #214 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #215 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #216 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #217 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #218 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #219 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #220 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #221 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #222 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #223 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #224 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #225 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #226 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #227 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #228 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #229 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #230 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #231 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #232 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #233 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #234 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #235 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #236 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #237 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #238 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #239 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #240 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #241 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #242 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #243 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #244 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #245 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #246 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #247 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #248 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #249 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #250 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #251 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #252 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #253 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #254 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #255 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #256 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #257 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #258 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #259 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #260 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #261 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #262 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #263 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #264 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #265 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #266 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #267 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #268 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #269 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #270 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #271 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #272 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #273 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #274 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #275 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #276 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #277 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #278 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #279 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #280 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #281 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #282 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #283 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #284 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #285 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #286 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #287 0x7fe5354659b3 in mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp:422:17
    #288 0x7fe535465f04 in non-virtual thunk to mozilla::SVGDisplayContainerFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGContainerFrame.cpp
    #289 0x7fe53550ae0a in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:907:12
    #290 0x7fe534e63b10 in nsLayoutUtils::ComputeSVGReferenceRect(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9615:11
    #291 0x7fe534bff606 in GetSVGBox /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:103:26
    #292 0x7fe534bff606 in nsStyleTransformMatrix::TransformReferenceBox::EnsureDimensionsAreCached() /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.cpp:129:12
    #293 0x7fe535758fb4 in X /builds/worker/checkouts/gecko/layout/style/nsStyleTransformMatrix.h:96:5
    #294 0x7fe535758fb4 in GetDeltaToTransformOrigin /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6074:46
    #295 0x7fe535758fb4 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6160:11
    #296 0x7fe53551090e in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1520:48
    #297 0x7fe532a0e0a9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #298 0x7fe5329d99df in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:504:15
    #299 0x7fe5329d97a7 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #300 0x7fe535512bf4 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1082:35
    #301 0x7fe53547d87b in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #302 0x7fe5354818b1 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp

SUMMARY: AddressSanitizer: stack-overflow /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:63:3 in __asan_memcpy
==4155306==ABORTING
Flags: sec-bounty?

only tested nightly version

Stack overflow just means there was very deep recursion and we ran out of stack space, so it normally is not a security issue.

Group: firefox-core-security
Component: Security → Layout
Product: Firefox → Core
Attached file testcase.html —

Reduced test case.

Attachment #9368805 - Attachment is obsolete: true
Blocks: grizzly
Status: UNCONFIRMED → NEW
status-firefox122: --- → affected
Component: Layout → SVG
Ever confirmed: true
Flags: in-testsuite?
Keywords: bugmon, testcase

There's a <line> with non-scaling-stroke. We're trying to render the parent <a> element but to do that we need to get the line's bounding box. The <a> element isn't non-scaling-stroke itself so it doesn't trigger the mitigation in bug 1864396. When we try to get the a bounds we need to get the CTM but the line child has non-scaling-stroke.

This only crashes if layout.css.transform-box-content-stroke.enabled is true

We may want to revert bug 1868374

Flags: needinfo?(boris.chiou)
Regressed by: 1868374

Set release status flags based on info from the regressing bug 1868374

status-firefox120: --- → unaffected
status-firefox121: --- → unaffected
status-firefox-esr115: --- → unaffected

In release builds, this manifests (for me at least) as a crash with signature [@ mozilla::SVGUtils::GetBBox] (like similar bug 1864396 did). --> Adding signature to assist with tracking potentially-related crash volume.

Crash Signature: [@ mozilla::SVGUtils::GetBBox]

Verified bug as reproducible on mozilla-central 20231215214115-8fd04cb03fbd.
The bug appears to have been introduced in the following build range:

Start: ece9fb8fbedfa6acc08840151034f2468832c851 (20230822160239)
End: e215151d2549581c23a1d3c8b53d8899f9776114 (20230822195239)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=ece9fb8fbedfa6acc08840151034f2468832c851&tochange=e215151d2549581c23a1d3c8b53d8899f9776114

Whiteboard: [reporter-external] [client-bounty-form] [verif?] → [reporter-external] [client-bounty-form] [verif?][bugmon:bisected,confirmed]
Blocks: 1868374
Regressed by: 1819464
No longer regressed by: 1868374

Set release status flags based on info from the regressing bug 1819464

status-firefox123: --- → affected

:jwatt could this be triaged for severity?

Flags: needinfo?(jwatt)
Severity: -- → S2
Flags: needinfo?(jwatt)

:jwatt, it looks like the affected versions were not correct. The regressor was changed after they were added.
Could you confirm the regressor is correct? Has there been any investigation into a possible fix?

status-firefox120: unaffected → wontfix
status-firefox121: unaffected → affected
Flags: needinfo?(jwatt)

Downgrading to S3 given that we un-shipped the associated feature (bug 1868374).

Severity: S2 → S3

Changing 120-123 status to disabled, since the pref layout.css.transform-box-content-stroke.enabled is Nightly only

status-firefox120: wontfix → disabled
status-firefox121: wontfix → disabled
status-firefox122: affected → disabled

(In reply to Donal Meehan [:dmeehan] from comment #13)

Changing 120-123 status to disabled, since the pref layout.css.transform-box-content-stroke.enabled is Nightly only

That's correct -- thanks! (I think that answers your ni to jwatt in comment 11, so canceling the needinfo.)

Flags: needinfo?(jwatt)
Duplicate of this bug: 1882361

There was a CSSWG resolution a few weeks back that gives us a way forward to address this, I think:

RESOLVED: If the tranform-box is stroke-box and the element has non-scaling-stroke, then the used transform-box is fill-box.

https://github.com/w3c/csswg-drafts/issues/9640#issuecomment-1942894984

Boris, could you look at implementing this^ and hopefully that'll avoid this crash?

Keywords: crash
Summary: stack-overflow on mozilla::SVGUtils::GetBBox → stack-overflow on mozilla::SVGUtils::GetBBox, with `transform-box: border-box` and `vector-effect="non-scaling-stroke"`

We have a partial implementation for this (bug 1864396). However, we may need a better way to detect non-scaling-stroke because it may happen on child elements (comment 4).

I keep my ni so this is on my radar.

Assignee: nobody → boris.chiou
Flags: needinfo?(boris.chiou)

While we are computing the transfom-box:stroke-box, for CSS Transforms or
Motion path Transforms, we have to avoid the cyclic dependency not only
for the SVG geometry frame itself, but also for the desendants of
the SVG container frame. Therefore, we just compute its fill-box (i.e.
make |getStroke| be false) for this case.

https://github.com/w3c/csswg-drafts/issues/9640

Attachment #9388509 - Attachment description: Bug 1870200 - Break the cyclic dependency if any of the desendants use non-scaling-stroke. → Bug 1870200 - Break the cyclic dependency if any of the desendants uses non-scaling-stroke.
Pushed by bchiou@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/ec44194caefb Break the cyclic dependency if any of the desendants uses non-scaling-stroke. r=emilio
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/44919 for changes under testing/web-platform/tests
Whiteboard: [reporter-external] [client-bounty-form] [verif?][bugmon:bisected,confirmed] → [reporter-external] [client-bounty-form] [verif?][bugmon:bisected,confirmed], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/ec44194caefb

Status: NEW → RESOLVED
Closed: 1 year ago
status-firefox125: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 125 Branch

Verified bug as fixed on rev mozilla-central 20240305094850-63e18d5ef9ec.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox125: fixed → verified
Keywords: bugmon
Flags: sec-bounty? → sec-bounty-
Upstream PR merged by moz-wptsync-bot
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: