1304184 - Assertion failure: !nifNeedPushedItem || mDidPushItemsBitMayLie (NS_STATE_GRID_DID_PUSH_ITEMS lied), at src/layout/generic/nsGridContainerFrame.cpp:5474

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Schwartzentruber (:truber)]

Attachment: testcase

The attached testcase asserts on mozilla-central revision 62f79d676e0e

Assertion failure: !nifNeedPushedItem || mDidPushItemsBitMayLie (NS_STATE_GRID_DID_PUSH_ITEMS lied), at src/layout/generic/nsGridContainerFrame.cpp:5474

Removing line 5 or 6 results in a similar assertion:

Assertion failure: foundOwnPushedChild || !items.IsEmpty() || mDidPushItemsBitMayLie (NS_STATE_GRID_DID_PUSH_ITEMS lied), at /home/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:5661

Comment 1

[Jesse Schwartzentruber (:truber)]

Attachment: stacktrace

Comment 2

[Jesse Schwartzentruber (:truber)]

Attachment: stacktrace2

Comment 3

[Jesse Schwartzentruber (:truber)]

Attachment: testcase

Comment 4

[Mats Palmgren (inactive)]

Same underlying issue as bug 1278461?

Comment 5

[Brad Werth [:bradwerth]]

For the moment, I can't reproduce the crash. I'll pull freshies from central and try again.

Comment 6

[Brad Werth [:bradwerth]]

Sorry, pulling the 62f79d676e0e revision to test...

Comment 7

[Brad Werth [:bradwerth]]

truber, I can't replicate this bug with revision 62f79d676e0e or with a more current mozilla-central. Do you have another testcase?

Comment 8

[Jesse Schwartzentruber (:truber)]

Still reproduces for me in m-c f0e6cc636021. Just tried debug and it is intermittent there (I'm using asan-debug usually). Changing the timeout makes it more reliable, I'll update it.

Comment 9

[Jesse Schwartzentruber (:truber)]

Attachment: testcase2

Comment 10

[Brad Werth [:bradwerth]]

A pending fix for bug 1278461 also fixes this bug, which has a similar pathology. I rolled attachment 8793765 [details] into the crashtests in the patch on the other bug.

Comment 11

[Mats Palmgren (inactive)]

Resolving this as fixed by bug 1278461.