1221112 - Assertion failure: IsFrameListSorted<IsLessThanOrEqual>(aFrameList) (After we sort a frame list, it should be in sorted order...), at mozilla-central\layout\generic\nsIFrame.h:3561

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: debug build assertion stack

Found via Bughunter and reproduced on a windows 7 Debug build.

Steps to reproduce:

Load http://www.wday.ru/stil-zhizny/vibor-redakcii/top-10-samyih-strashnyih-misticheskih-mest-mira/?utm_source=e1.ru&utm_medium=partner&utm_campaign=news

-->> Assertion failure 
Assertion failure: IsFrameListSorted<IsLessThanOrEqual>(aFrameList) (After we sort a frame list, it should be in sorted order...), at c:\users\mozilla\debug-builds\mozilla-central\layout\generic\nsIFrame.h:3561

Comment 1

[Carsten Book [:Tomcat]]

Attachment: bughunter crash stack

Comment 2

[Daniel Holbert [:dholbert]]

I can reproduce locally on Linux, too.

Before the fatal assertion, I also get:
[Child 888] ###!!! ASSERTION: Child frames aren't sorted correctly: '(!mFrames.IsEmpty() && mFrames.FirstChild()->GetContent()->GetContainingShadow()) || nsIFrame::IsFrameListSorted<IsOrderLEQWithDOMFallback>(mFrames)', file /scratch/work/builds/mozilla-inbound/mozilla/layout/generic/nsFlexContainerFrame.cpp, line 1975

This is likely related to bug 1219153, and the comment above that ^ non-fatal assertion reminded me of bug 1059138 which is also about the children being out of order with a shadow DOM involved.

Comment 3

[Daniel Holbert [:dholbert]]

Attachment: frame dump, starting with the nsFlexContainerFrame whose kids' order is tripping the assertions

Comment 4

[Daniel Holbert [:dholbert]]

(Side note: at first I thought this might be a recent regression, given the coincidence of this bug & bug 1219153 being filed so close together. But it's not; I can trigger the fatal assert at this bug's URL with a debug build from 2 months ago, http://ftp.mozilla.org/pub/firefox/nightly/2015/09/2015-09-01-mozilla-central-debug/

So, not a recent regression.)

Comment 5

[Daniel Holbert [:dholbert]]

Attachment: testcase 1

Here's a reduced testcase which triggers the fatal assertion ("After we sort a frame list, it should be in sorted order"), and then the non-fatal one ("Child frames aren't sorted correctly") if I allow things to proceed by neutering the fatal assertion.

Comment 6

[Daniel Holbert [:dholbert]]

Attachment: testcase 2 (only triggers non-fatal assertion)

This slightly-smaller testcase (same as previous one but without "order" set) only triggers the non-fatal assertion, "Child frames aren't sorted correctly".

Comment 7

[Daniel Holbert [:dholbert]]

Attachment: fix v1: Dig past placeholder to out-of-flow frame, before checking for ::before/::after

Here's a patch, with both tests included as crashtests.

Basically, the problem here is the following:

So, we have a special case for comparing ::before vs ::after in this function. (since nsContentUtils::PositionIsBefore() doesn't do the right thing for those nodes, per the code comment)

BUT, we're failing to figure out that we've got ::before & ::after, because their frames are abspos, and we're only finding the placeholder frames, which don't have GetPseudo() set to ::before/::after.

So, to actually find out if we've got ::before/::after, we need to use nsPlaceholderFrame::GetRealFrameFor (to dig past the placeholder frame) before we use GetPseudo.

Comment 8

[Daniel Holbert [:dholbert]]

Commit message:
Bug 1221112: When checking for ::before/::after while sorting flex items by DOM order, dig past placeholder to out-of-flow frame. r?mats

Comment 9

[Mats Palmgren (inactive)]

Comment on attachment 8682936 [details] [diff] [review]
fix v1: Dig past placeholder to out-of-flow frame, before checking for ::before/::after

r=mats

Comment 10

[Daniel Holbert [:dholbert]]

Thanks! Landed: https://hg.mozilla.org/integration/mozilla-inbound/rev/f1dd50e3451f

Try run: https://treeherder.mozilla.org/#/jobs?repo=try&revision=928ca4fc2159

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/f1dd50e3451f