1194928 - Artifacts in image placeholder

Status: NEW

(Core :: Layout: Images, Video, and HTML Frames, defect)

Description

[Ray Satiro]

Attachment: Screenshot of artifacts in image placeholder

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Build ID: 20150811011940

Steps to reproduce:

- Go to https://github.com/mozilla/mozregression

- Scroll down the page until the README is in view and you can see the following links:

- - Latest Version Downloads Python versions License

- Click on setup.py

- Click the back button on your mouse

- Note that the links are truncated and not rendering properly

- To coax the issue you may have to repeat clicking forward and then back up to several dozen times.


Actual results:

There are artifacts in the image placeholders, see screenshot. Also see a short video at https://vid.me/OkZ5 demonstrating the problem.

I ran mozregression and bisected it to acc0b3f3daba. Refer to bug #1176081.


Expected results:

I don't know:

In this particular case I don't think the prior behavior is correct either though. You can see in prior builds, eg 20150710030206, instead of those artifacts there'd occasionally be missing image placeholders which never went away; which is weird because they're just links and if I'm going back a page those should already be rendered and never missing. Should I file that as a different bug?

Comment 1

[Timothy Nikkel (:tnikkel)]

The readme file has changed so now one needs to use this starting point to observe the bug
https://github.com/mozilla/mozregression/tree/60da9cd67dbc4bf87e28c788cf3508440835e54f

Comment 2

[Timothy Nikkel (:tnikkel)]

HTMLImageElement::HTMLImageElement calls AddStatesSilently(NS_EVENT_STATE_BROKEN) in its constructor.

Then the network request for the image errors out (404), so nsImageLoadingContent::UpdateState runs and sets mBroken to true.

Then HTMLImageElement::BindToTree runs and calls

    ClearBrokenState();
    RemoveStatesSilently(NS_EVENT_STATE_BROKEN);

ClearBrokenState sets mBroken on nsImageLoadingContent to false. and nsImageLoadingContent::UpdateState is never called again because there is no state change on it's image. So when we goto construct a frame (nsImageFrame::ShouldCreateImageFrameFor) for the image we see an image in normal state and construct an nsImageFrame instead of an inline frame.

Seems like we should have an extra state bool on nsImageLoadingContent to force it to report as broken (separate from mBroken and that overrides mBroken when set to true) that HTMLImageElement can set/clear.