Closed Bug 1186147 Opened 4 years ago Closed 2 years ago

"ASSERTION: ReflowChild with unconstrained container width" with writing-mode, flex

Categories

(Core :: Layout, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
Tracking Status
firefox42 --- affected

People

(Reporter: jruderman, Assigned: dholbert)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file testcase
###!!! ASSERTION: ReflowChild with unconstrained container width!: 'aContainerSize.width != NS_UNCONSTRAINEDSIZE', file layout/generic/nsContainerFrame.cpp, line 985

###!!! ASSERTION: FinishReflowChild with unconstrained container width!: 'aContainerSize.width != NS_UNCONSTRAINEDSIZE', file layout/generic/nsContainerFrame.cpp, line 1122

(tbsaunde found this by running DOMFuzz)
Attached file stack
Assignee: nobody → dholbert
Status: NEW → ASSIGNED
So, this ends up happening because we have a flex item whose cross size (width) is nscoord_MAX (which makes us think its line is also nscoord_MAX, and hence the auto-sized flex container is also nscoord_MAX).

We get in this situation with the flex item because right now, the call to SizeItemInCrossAxis is guarded by a "!IsCrossAxisHorizontal()" condition, which only makes sense in a horizontal writing-mode.

Bug 1180107 will generify that check; setting dependency on that bug.
Depends on: 1180107
This still reproduces on latest trunk:
=======
[Child 22729, Main Thread] ###!!! ASSERTION: ReflowChild with unconstrained container width!: 'aContainerSize.width != NS_UNCONSTRAINEDSIZE', file /scratch/work/builds/mozilla-central/mozilla/layout/generic/nsContainerFrame.cpp, line 924

[Child 22729, Main Thread] ###!!! ASSERTION: FinishReflowChild with unconstrained container width!: 'aContainerSize.width != NS_UNCONSTRAINEDSIZE', file /scratch/work/builds/mozilla-central/mozilla/layout/generic/nsContainerFrame.cpp, line 1067

nsBlockReflowContext: FlexContainer(span)(0)@7f1d5f5ecc20 metrics=540,1073741823!
nsBlockReflowContext: Block(div)(0)@7f1d5f5ecb70 metrics=540,1073741823!
[Child 22729, Main Thread] ###!!! ASSERTION: Computed overflow area must contain frame bounds: 'aNewSize.width == 0 || aNewSize.height == 0 || r->width == nscoord_MAX || r->height == nscoord_MAX || (mState & NS_FRAME_SVG_LAYOUT) || r->Contains(nsRect(nsPoint(0,0), aNewSize))', file /scratch/work/builds/mozilla-central/mozilla/layout/generic/nsFrame.cpp, line 9465
=======

This spam all goes away with my patch stack from bug 1267462, though.  After I've landed that bug's patches, I'll land a crashtest here and close this out.
Flags: needinfo?(dholbert)
Flags: in-testsuite?
Pushed by dholbert@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2bd2d30e69c0
add crashtest for this bug (now that it's been fixed by a dependent bug). (no review, crashtest-only)
Resolving as FIXED by bug 1267462.  Crashtest landed as well (per comment 4).
Flags: needinfo?(dholbert)
Flags: in-testsuite?
Flags: in-testsuite+
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.