1342323 - stylo: Crash at [@nsLayoutUtils::DoCompareTreePosition nsFrameConstructorState::ProcessFrameInsertions nsFrameConstructorState::~nsFrameConstructorState nsCSSFrameConstructor::ContentRangeInserted nsCSSFrameConstructor::RecreateFramesForContent]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: bughunter stack

Found via bughunter topsite tests and reproduced on http://www.posta.com.tr with latest stylo debug build.

Steps to reproduce:
-> Load http://www.posta.com.tr
--> after 10-20 seconds the fedora vm crash

before the crash i get 

[6410] ###!!! ASSERTION: Absolutely positioned _and_ floating?: '!aStyleDisplay->IsAbsolutelyPositionedStyle()', file /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp, line 1144

not sure if its relatet

Comment 1

[Emilio Cobos Álvarez (:emilio)]

I believe this is because we don't follow correctly CSS2.1 section 9.7, that makes the computed float value of an absolutely positioned element be none. I have a patch for servo incoming.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

With that I get past that point to hit a rust panic:

thread '<unnamed>' panicked at 'assertion failed: len >= (self.len() as u32)', /home/emilio/projects/moz/stylo/servo/components/style/gecko_bindings/sugar/ns_t_array.rs:91
note: Run with `RUST_BACKTRACE=1` for a backtrace.
Redirecting call to abort() to mozalloc_abort

Will investigate this tomorrow I guess.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

That assert comes from Servo_StyleSet_FillKeyframesForName, hiro, could you take a look?

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Servo patch for the crash described in this bug: https://github.com/servo/servo/pull/15730

Thanks for noting the assertion failure Tomcat! :)

Comment 5

[Hiroyuki Ikezoe (:hiro)]

The index value for missing properties in the initial and final keyframes was apparently wrong!

https://hg.mozilla.org/mozilla-central/file/a08ec245fa24/servo/ports/geckolib/glue.rs#l1503

https://treeherder.mozilla.org/#/jobs?repo=try&revision=020c5c15ab74699050c014bbb17dcba9ed83f35c

Thank you Emilio for notifying. I thought frame construction was totally unrelated to animations!

Comment 6

[Hiroyuki Ikezoe (:hiro)]

Attachment: Bug 1342323 - Fix wrong index for missing properties in the initial and final keyframes.

Review commit: https://reviewboard.mozilla.org/r/115544/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/115544/

Comment 7

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 8841290 [details]
Bug 1342323 - Fix wrong index for missing properties in the initial and final keyframes.

https://reviewboard.mozilla.org/r/115544/#review116988

Thanks for fixing this Hiro! :)

Comment 8

[Hiroyuki Ikezoe (:hiro)]

Fixed.
https://hg.mozilla.org/mozilla-central/rev/0260913ef653