1171935 - Assertion failure: !aContent->GetPrimaryFrame() || aState.mCreatingExtraFrames || aContent->NodeInfo()->NameAtom() == nsGkAtoms::area, at c:/Users/mozilla/debug-builds/mozilla-central/layout /base/nsCSSFrameConstructor.cpp:5481

Status: RESOLVED DUPLICATE of bug 1317937

(Core :: CSS Parsing and Computation, defect)

Description

[Carsten Book [:Tomcat]]

found via bughunter on http://www.zjks.com/default.aspx

Crash/Assertion on load also reproduced on a windows 7 Trunk Build with mozilla-central tip

Steps to reproduce:
-> Load http://www.zjks.com/default.aspx

--> Assertion failure: !aContent->GetPrimaryFrame() || aState.mCreatingExtraFrames || aContent->NodeInfo()->NameAtom() == nsGkAtoms::area, at c:/Users/mozilla/debug-builds/mozilla-central/layout
/base/nsCSSFrameConstructor.cpp:5481
[536] WARNING: Previous vsync timestamp is ahead of the calculated vsync timestamp.: file c:/Users/mozilla/debug-builds/mozilla-central/gfx/thebes/gfxWindowsPlatform.cpp, line 2187
#01: nsCSSFrameConstructor::DoAddFrameConstructionItems (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nscssframeconstructor.cpp:5421)
#02: nsCSSFrameConstructor::AddFrameConstructionItems (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nscssframeconstructor.cpp:5440)
#03: nsCSSFrameConstructor::ContentAppended (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nscssframeconstructor.cpp:7220)
#04: nsCSSFrameConstructor::CreateNeededFrames (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nscssframeconstructor.cpp:6896)
#05: nsCSSFrameConstructor::CreateNeededFrames (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nscssframeconstructor.cpp:6901)
#06: nsCSSFrameConstructor::CreateNeededFrames (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nscssframeconstructor.cpp:6901)
#07: nsCSSFrameConstructor::CreateNeededFrames (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nscssframeconstructor.cpp:6901)
#08: nsCSSFrameConstructor::CreateNeededFrames (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nscssframeconstructor.cpp:6901)
#09: nsCSSFrameConstructor::CreateNeededFrames (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nscssframeconstructor.cpp:6918)
#10: nsRefreshDriver::Tick (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nsrefreshdriver.cpp:1687)
#11: nsRefreshDriver::DoTick (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nsrefreshdriver.cpp:1402)
#12: nsRefreshDriver::WillRefresh (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nsrefreshdriver.cpp:2001)
#13: nsRefreshDriver::DoTick (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nsrefreshdriver.cpp:1402)
#14: nsRefreshDriver::FinishedWaitingForTransaction (c:\users\mozilla\debug-builds\mozilla-central\layout\base\nsrefreshdriver.cpp:1941)
#15: mozilla::layers::ClientLayerManager::DidComposite (c:\users\mozilla\debug-builds\mozilla-central\gfx\layers\client\clientlayermanager.cpp:395)
#16: mozilla::layers::CompositorChild::RecvDidComposite (c:\users\mozilla\debug-builds\mozilla-central\gfx\layers\ipc\compositorchild.cpp:348)
#17: mozilla::layers::PCompositorChild::OnMessageReceived (c:\users\mozilla\debug-builds\mozilla-central\firefox-debug\ipc\ipdl\pcompositorchild.cpp:862)
#18: mozilla::ipc::MessageChannel::DispatchAsyncMessage (c:\users\mozilla\debug-builds\mozilla-central\ipc\glue\messagechannel.cpp:1281)
#19: mozilla::ipc::MessageChannel::DispatchMessageW (c:\users\mozilla\debug-builds\mozilla-central\ipc\glue\messagechannel.cpp:1199)
#20: mozilla::ipc::MessageChannel::OnMaybeDequeueOne (c:\users\mozilla\debug-builds\mozilla-central\ipc\glue\messagechannel.cpp:1183)
#21: MessageLoop::RunTask (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:362)
#22: MessageLoop::DeferOrRunPendingTask (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:372)
#23: MessageLoop::DoWork (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:456)
#24: mozilla::ipc::DoWorkRunnable::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\glue\messagepump.cpp:221)
#25: nsThread::ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\threads\nsthread.cpp:846)
#26: NS_ProcessNextEvent (c:\users\mozilla\debug-builds\mozilla-central\xpcom\glue\nsthreadutils.cpp:265)
#27: mozilla::ipc::MessagePump::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\glue\messagepump.cpp:95)
#28: MessageLoop::RunInternal (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:233)
#29: MessageLoop::RunHandler (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:227)
#30: MessageLoop::Run (c:\users\mozilla\debug-builds\mozilla-central\ipc\chromium\src\base\message_loop.cc:201)
#31: nsBaseAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\nsbaseappshell.cpp:167)
#32: nsAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\windows\nsappshell.cpp:180)
#33: nsAppStartup::Run (c:\users\mozilla\debug-builds\mozilla-central\toolkit\components\startup\nsappstartup.cpp:281)
#34: XREMain::XRE_mainRun (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4252)
#35: XREMain::XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4336)
#36: XRE_main (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nsapprunner.cpp:4425)
#37: do_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:214)
#38: NS_internal_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:478)
#39: wmain (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nswindowswmain.cpp:138)
#40: __tmainCRTStartup (f:\dd\vctools\crt\crtw32\startup\crt0.c:255)
#41: BaseThreadInitThunk[kernel32 +0x4ee1c]
#42: RtlInitializeExceptionChain[ntdll +0x637eb]
#43: RtlInitializeExceptionChain[ntdll +0x637be]
[NPAPI 4584] ###!!! ABORT: Aborting on channel error.: file c:/Users/mozilla/debug-builds/mozilla-central/ipc/glue/MessageChannel.cpp, line 1662

Comment 1

[Boris Zbarsky [:bzbarsky]]

So when we hit this assert aContent is an HTMLAnchorElement.  Its primary frame is an nsImageFrame.  Its parent is a <span> whose parent is a <div> whose parent is a <map>.  We are in the middle of constructing a normal CSS frame for the <a>.

I guess we need to adjust all these nsGkAtoms::area asserts to also exclude nsGkAtoms::a, since imagemaps can use those too.  :(

This is ridiculous.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Minimalish testcase for the assertion

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Simpler testcase that triggers a different assertion

Comment 4

[Boris Zbarsky [:bzbarsky]]

So I have a patch that fixes this assertion, but not the one from comment 3, and it runs into other assertions on the comment 2 testcase, because we override the nsImageFrame with a different frame from frame construction.

<area> doesn't run into those issues because it's display:none!important, but I don't particularly want to add "map a { display:none !important }" to html.css...

I could just check for "<a> with an existing nsImageFrame" in the code that decides to create an inline frame for it, but that would only fix the issue in the comment 2 testcase, not the comment 3 one, and would make the <a> not render, which doesn't seem right.

This all pretty much sucks.  :(  David, any bright ideas?

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: What I have so far

Comment 6

[Carsten Book [:Tomcat]]

Attachment: new assertion stack

still reproducible on a windows 7 debug build based on current m-c tip

Comment 7

[Carsten Book [:Tomcat]]

(In reply to Carsten Book [:Tomcat] from comment #6)
> Created attachment 8708250 [details]
> new assertion stack
> 
> still reproducible on a windows 7 debug build based on current m-c tip

mats, david: could you take a look, thanks!

Comment 8

[Mats Palmgren (inactive)]

I suspect that the new assertion is the same underlying problem as before.
I think Boris has summed up the situation already in comment 4.

Comment 9

[Carsten Book [:Tomcat]]

david can you take look here ? Thanks!

Comment 11

[Mats Palmgren (inactive)]

Attachment: Testcase for bug 1235369

Here's a reduced testcase for bug 1235369, fwiw.

Loading it reliably produces these two assertions:
ASSERTION: : '!aContent->GetPrimaryFrame() || aState.mCreatingExtraFrames || aContent->NodeInfo()->NameAtom() == nsGkAtoms::area', file layout/base/nsCSSFrameConstructor.cpp, line 5585
ASSERTION: Losing track of existing primary frame: '!aFrame || !mPrimaryFrame || aFrame == mPrimaryFrame', file dom/base/nsIContent.h, line 893

and on Shift+Reload also this:
ASSERTION: Unexpected primary frame: 'area->mArea->GetPrimaryFrame() == mImageFrame', file layout/generic/nsImageMap.cpp, line 721

Comment 13

[Bob Clary [:bc] (inactive)]

same url and assertion->dupe