[Webkit-unassigned] [Bug 93453] New: SVG+animation+viewBox+relative-size via <html:img> = FractionalLayoutUnit error log.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=93453

           Summary: SVG+animation+viewBox+relative-size via <html:img> =
                    FractionalLayoutUnit error log.
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: SVG
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: kinaba at chromium.org
                CC: zimmermann at kde.org


Created an attachment (id=157154)
 --> (https://bugs.webkit.org/attachment.cgi?id=157154&action=review)
Loading from an HTML <img src="foo.svg" width="256" height="20"/> reproduces the issue.

Reduction of an issue reported at http://crbug.com/129465.
I have seen it on debug build of Chromium and DumpRenderTree (on Linux).

If an SVG image
* with viewBox attribute,
* without width/height attributes,
* and with <animate> element
is loaded via html <img> element, it triggers the following diagnosing message:

ERROR: !(isInBounds(value))
../../third_party/WebKit/Source/WebCore/platform/FractionalLayoutUnit.h(79) : WebCore::FractionalLayoutUnit::FractionalLayoutUnit(float)

I don't see any visible trouble in SVG rendering result, but in the originally reported case,
this message is infinitely generated and floods my console.
Substituting the line with an assertion, I got the following stack trace in DumpRenderTree,
and the "out-of-bound" value was -NaN.

        base::debug::StackTrace::StackTrace() [0x7f8bd9c2dffe]
        base::(anonymous namespace)::StackDumpSignalHandler() [0x7f8bd9ca0e74]
        0x7f8bd1e0caf0
        WebCore::FractionalLayoutUnit::FractionalLayoutUnit() [0x7f8bd5a413fe]
        WebCore::FractionalLayoutUnit::FractionalLayoutUnit() [0x7f8bd5a3e13f]
        WebCore::FractionalLayoutPoint::FractionalLayoutPoint() [0x7f8bd5a60bea]
        WebCore::FractionalLayoutPoint::FractionalLayoutPoint() [0x7f8bd5a60bad]
        WebCore::roundedLayoutPoint() [0x7f8bd5a5cecc]
        WebCore::RenderBox::mapLocalToContainer() [0x7f8bd5b0407e]
        WebCore::RenderSVGRoot::mapLocalToContainer() [0x7f8bd608f369]
        WebCore::SVGRenderSupport::mapLocalToContainer() [0x7f8bd60a6306]
        WebCore::RenderSVGModelObject::mapLocalToContainer() [0x7f8bd606546b]
        WebCore::RenderObject::localToContainerQuad() [0x7f8bd5c0347b]
        WebCore::RenderSVGModelObject::outlineBoundsForRepaint() [0x7f8bd60655b2]
        WebCore::LayoutRepainter::LayoutRepainter() [0x7f8bd5a83040]
        WebCore::RenderSVGShape::layout() [0x7f8bd6092ef0]
        WebCore::SVGRenderSupport::layoutChildren() [0x7f8bd60a6d17]
        WebCore::RenderSVGRoot::layout() [0x7f8bd608e2e2]
        WebCore::FrameView::layout() [0x7f8bd6ba2e15]
        WebCore::FrameView::visibleContentsResized() [0x7f8bd6ba7fd6]
        WebCore::ScrollView::updateScrollbars() [0x7f8bd62a869d]
        WebCore::ScrollView::setFrameRect() [0x7f8bd62ac4f4]
        WebCore::FrameView::setFrameRect() [0x7f8bd6ba02ef]
        WebCore::Widget::resize() [0x7f8bd51b748e]
        WebCore::SVGImage::dataChanged() [0x7f8bd623840b]
        WebCore::Image::setData() [0x7f8bd6351af5]
        WebCore::CachedImage::data() [0x7f8bd6b16ec7]
        WebCore::SubresourceLoader::didFinishLoading() [0x7f8bd6af96e9]
        WebCore::ResourceLoader::didFinishLoading() [0x7f8bd6af4605]
        WebCore::ResourceHandleInternal::didFinishLoading() [0x7f8bd6413652]
        webkit_glue::WebURLLoaderImpl::Context::OnCompletedRequest() [0x7f8bd9f58253]
        (anonymous namespace)::RequestProxy::NotifyCompletedRequest() [0x5d9285]
        base::internal::RunnableAdapter<>::Run() [0x5d96d4]
        base::internal::InvokeHelper<>::MakeItSo() [0x5d960b]
        base::internal::Invoker<>::Run() [0x5d959a]
        base::Callback<>::Run() [0x7f8bd9c2429e]
        MessageLoop::RunTask() [0x7f8bd9c6e104]
        MessageLoop::DeferOrRunPendingTask() [0x7f8bd9c6e41b]
        MessageLoop::DoWork() [0x7f8bd9c6e5f5]
        base::MessagePumpGlib::RunWithDispatcher() [0x7f8bd9c05b52]
        base::MessagePumpGlib::Run() [0x7f8bd9c06069]
        MessageLoop::RunInternal() [0x7f8bd9c6dbe6]
        MessageLoop::RunHandler() [0x7f8bd9c6da95]
        base::RunLoop::Run() [0x7f8bd9ca7e52]
        MessageLoop::Run() [0x7f8bd9c6d331]
        webkit_support::RunMessageLoop() [0x542741]
        TestShell::waitTestFinished() [0x49836f]
        TestShell::runFileTest() [0x48feaa]
        runTest() [0x45ad1c]
        main [0x45aa35]

If I directly load the SVG file, or load it via <iframe> or <embed> element, there was no problem.
Adding absolute size info to SVG or dropping viewBox attribute also dissolved the message flood.

As far as I looked, SVGImage::frameView() has size (0,0) in this case and it is causing 0/0 = NaN
in SVGPreserveAspectRatio::getCTM.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.