1367413 - Assertion failure: kidOverflowBEnd >= kidBEnd, at /mozilla/builds/nightly/mozilla/layout/generic/nsAbsoluteContainingBlock.cpp:154

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: crash report

1. https://www.tumblr.com/search/jody%20comer
2. Assertion failure: kidOverflowBEnd >= kidBEnd, at /home/worker/workspace/build/src/layout/generic/nsAbsoluteContainingBlock.cpp:154

This reproduces on Fedora 25 x86_64. We've seen this on about 133 urls since this assertion landed in bug 1365449 though Windows is the most common occurrence. Urls on https://ok.ru/ are fairly common.

Reproduced locally with a build from https://hg.mozilla.org/mzilla-central/rev/96e18bec9fc8a5ce623c16167c12756bbe190d73

Thread 0 (crashed)
 0  libxul.so!nsAbsoluteContainingBlock::Reflow [nsAbsoluteContainingBlock.cpp:6dfa56094f0c : 154 + 0x18]

Comment 1

[Mats Palmgren (inactive)]

Attachment: Testcase

Comment 2

[Mats Palmgren (inactive)]

|kidOverflowBEnd| comes from GetScrollableOverflowRectRelativeToParent():
http://searchfox.org/mozilla-central/rev/2933592c4a01b634ab53315ce2d0e43fccb82181/layout/generic/nsAbsoluteContainingBlock.cpp#152
which is just GetScrollableOverflowRect() translated to the parent's coordinates.
So I think the invariant doesn't hold, as explained in:
http://searchfox.org/mozilla-central/rev/2933592c4a01b634ab53315ce2d0e43fccb82181/layout/generic/nsIFrame.h#3019-3022

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

OK, I guess we need to use the version that ignores transforms, and then manually convert to the parent's coordinate space.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Mats's testcase also doesn't hit the assertion for me until I resize the window, so I'll need to modify it a drop to make it a crashtest.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: Fix assertion that can occur when paginating abs-pos elements with a transform

I confirmed that the test crashes in the crashtest harness without the
patch (although the harness doesn't exit!), whereas it passes with the
patch.

MozReview-Commit-ID: 37S6i1kvw37

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=6cdc1b5ab20ce1e6e4654da3d850a193c5f7d874&group_state=expanded

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e6bf2e19464cd774d46d243c82a64fa1b05056c8
Bug 1367413 - Fix assertion that can occur when paginating abs-pos elements with a transform.  r=mats

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e6bf2e19464c