Open Bug 1335552 Opened 3 years ago Updated 2 months ago

Assertion failure: !aWM.IsOrthogonalTo(GetWritingMode()), at /home/worker/workspace/build/src/layout/generic/nsIFrameInlines.h:134

Categories

(Core :: Layout, defect, P3)

defect

Tracking

()

Tracking Status
firefox-esr52 --- unaffected
firefox-esr60 --- affected
firefox-esr68 --- affected
firefox54 --- wontfix
firefox55 --- wontfix
firefox56 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox64 --- wontfix
firefox65 --- wontfix
firefox66 --- wontfix
firefox69 --- wontfix
firefox70 --- wontfix
firefox71 --- wontfix
firefox72 --- wontfix
firefox73 --- affected
firefox74 --- affected

People

(Reporter: tsmith, Assigned: mats, NeedInfo)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file log.txt
Assertion failure: !aWM.IsOrthogonalTo(GetWritingMode()), at /home/worker/workspace/build/src/layout/generic/nsIFrameInlines.h:134

==12281==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f512169059e bp 0x7ffdb5700c90 sp 0x7ffdb5700be0 T0)
    #0 0x7f512169059d in nsIFrame::SynthesizeBaselineBOffsetFromBorderBox(mozilla::WritingMode, mozilla::BaselineSharingGroup) const /home/worker/workspace/build/src/layout/generic/nsIFrameInlines.h:140:3
    #1 0x7f512168fc55 in nsLayoutUtils::GetFirstLinePosition(mozilla::WritingMode, nsIFrame const*, nsLayoutUtils::LinePosition*) /home/worker/workspace/build/src/layout/base/nsLayoutUtils.cpp:5912:30
    #2 0x7f512168f8b9 in nsLayoutUtils::GetFirstLinePosition(mozilla::WritingMode, nsIFrame const*, nsLayoutUtils::LinePosition*) /home/worker/workspace/build/src/layout/base/nsLayoutUtils.cpp:5966:11
    #3 0x7f512168f63e in nsLayoutUtils::GetFirstLineBaseline(mozilla::WritingMode, nsIFrame const*, int*) /home/worker/workspace/build/src/layout/base/nsLayoutUtils.cpp:5885:8
    #4 0x7f51219a6509 in nsTableCellFrame::GetCellBaseline() const /home/worker/workspace/build/src/layout/tables/nsTableCellFrame.cpp:730:7
    #5 0x7f51219e7adb in nsTableRowFrame::ReflowChildren(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsTableFrame&, unsigned int&) /home/worker/workspace/build/src/layout/tables/nsTableRowFrame.cpp:971:20
    #6 0x7f51219ea4a0 in nsTableRowFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) /home/worker/workspace/build/src/layout/tables/nsTableRowFrame.cpp:1119:3
    #7 0x7f5121788f4e in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, unsigned int&, nsOverflowContinuationTracker*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:1028:3
    #8 0x7f51219ef47b in nsTableRowGroupFrame::ReflowChildren(nsPresContext*, mozilla::ReflowOutput&, mozilla::TableRowGroupReflowInput&, unsigned int&, bool*) /home/worker/workspace/build/src/layout/tables/nsTableRowGroupFrame.cpp:432:7
    #9 0x7f51219f6405 in nsTableRowGroupFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) /home/worker/workspace/build/src/layout/tables/nsTableRowGroupFrame.cpp:1387:3
    #10 0x7f5121788f4e in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, unsigned int&, nsOverflowContinuationTracker*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:1028:3
    #11 0x7f51219c0979 in nsTableFrame::ReflowChildren(mozilla::TableReflowInput&, unsigned int&, nsIFrame*&, nsOverflowAreas&) /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:3153:7
    #12 0x7f51219bdc18 in nsTableFrame::ReflowTable(mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, nsIFrame*&, unsigned int&) /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:2118:3
    #13 0x7f51219bcad5 in nsTableFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) /home/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:1918:5
    #14 0x7f5121788f4e in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, unsigned int&, nsOverflowContinuationTracker*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:1028:3
    #15 0x7f51219ffc26 in nsTableWrapperFrame::OuterDoReflowChild(nsPresContext*, nsIFrame*, mozilla::ReflowInput const&, mozilla::ReflowOutput&, unsigned int&) /home/worker/workspace/build/src/layout/tables/nsTableWrapperFrame.cpp:832:3
    #16 0x7f5121a010ca in nsTableWrapperFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) /home/worker/workspace/build/src/layout/tables/nsTableWrapperFrame.cpp:994:3
    #17 0x7f512175fa7a in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, unsigned int&, mozilla::BlockReflowInput&) /home/worker/workspace/build/src/layout/generic/nsBlockReflowContext.cpp:306:3
    #18 0x7f5121758228 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:3466:7
    #19 0x7f5121754468 in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:2835:5
    #20 0x7f512174abc7 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:2374:7
    #21 0x7f51217459d3 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:1237:3
    #22 0x7f512175fa7a in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, unsigned int&, mozilla::BlockReflowInput&) /home/worker/workspace/build/src/layout/generic/nsBlockReflowContext.cpp:306:3
...
see log.txt
Attached file test_case.html
Assignee: nobody → mats
OS: Unspecified → All
Hardware: Unspecified → All
Priority: -- → P3
INFO: Last good revision: da6f3eb57c7800df35868f3a52bb04a0caccf97e
INFO: First bad revision: efcaf80ef8590b3dc41b75e836cd13f308a413a1
INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=da6f3eb57c7800df35868f3a52bb04a0caccf97e&tochange=efcaf80ef8590b3dc41b75e836cd13f308a413a1
Blocks: 1312379
Has Regression Range: --- → yes
Flags: in-testsuite?

Hoping to help get this fixed since fuzzers have been tripping over it for a few years now.

Here is a Pernosco session https://pernos.co/debug/OJwdaV_sBxF7lEBXHxWw6g/index.html

Mats, do you have any time to have a look? or is there anything else I can do to help?

You need to log in before you can comment on or make changes to this bug.