1186147 - "ASSERTION: ReflowChild with unconstrained container width" with writing-mode, flex

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: ReflowChild with unconstrained container width!: 'aContainerSize.width != NS_UNCONSTRAINEDSIZE', file layout/generic/nsContainerFrame.cpp, line 985

###!!! ASSERTION: FinishReflowChild with unconstrained container width!: 'aContainerSize.width != NS_UNCONSTRAINEDSIZE', file layout/generic/nsContainerFrame.cpp, line 1122

(tbsaunde found this by running DOMFuzz)

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Daniel Holbert [:dholbert]]

So, this ends up happening because we have a flex item whose cross size (width) is nscoord_MAX (which makes us think its line is also nscoord_MAX, and hence the auto-sized flex container is also nscoord_MAX).

We get in this situation with the flex item because right now, the call to SizeItemInCrossAxis is guarded by a "!IsCrossAxisHorizontal()" condition, which only makes sense in a horizontal writing-mode.

Bug 1180107 will generify that check; setting dependency on that bug.

Comment 3

[Daniel Holbert [:dholbert]]

This still reproduces on latest trunk:
=======
[Child 22729, Main Thread] ###!!! ASSERTION: ReflowChild with unconstrained container width!: 'aContainerSize.width != NS_UNCONSTRAINEDSIZE', file /scratch/work/builds/mozilla-central/mozilla/layout/generic/nsContainerFrame.cpp, line 924

[Child 22729, Main Thread] ###!!! ASSERTION: FinishReflowChild with unconstrained container width!: 'aContainerSize.width != NS_UNCONSTRAINEDSIZE', file /scratch/work/builds/mozilla-central/mozilla/layout/generic/nsContainerFrame.cpp, line 1067

nsBlockReflowContext: FlexContainer(span)(0)@7f1d5f5ecc20 metrics=540,1073741823!
nsBlockReflowContext: Block(div)(0)@7f1d5f5ecb70 metrics=540,1073741823!
[Child 22729, Main Thread] ###!!! ASSERTION: Computed overflow area must contain frame bounds: 'aNewSize.width == 0 || aNewSize.height == 0 || r->width == nscoord_MAX || r->height == nscoord_MAX || (mState & NS_FRAME_SVG_LAYOUT) || r->Contains(nsRect(nsPoint(0,0), aNewSize))', file /scratch/work/builds/mozilla-central/mozilla/layout/generic/nsFrame.cpp, line 9465
=======

This spam all goes away with my patch stack from bug 1267462, though.  After I've landed that bug's patches, I'll land a crashtest here and close this out.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2bd2d30e69c0
add crashtest for this bug (now that it's been fixed by a dependent bug). (no review, crashtest-only)

Comment 5

[Daniel Holbert [:dholbert]]

Resolving as FIXED by bug 1267462.  Crashtest landed as well (per comment 4).

Comment 6

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/2bd2d30e69c0