1373898 - ASSERTION: overflow area should be at least as large as frame rect: 'kidOverflowBEnd >= kidBEnd', file layout/generic/nsAbsoluteContainingBlock.cpp:210 (with fixed-position, small "clip", and padding)

Status: NEW

(Core :: Layout, defect, P3)

Description

[Bob Clary [:bc] (inactive)]

Attachment: crash report

1. http://www.nbp.pl/home.aspx?f=/statystyka/kursy.html

2. Assertion failure: kidOverflowBEnd >= kidBEnd, at /home/worker/workspace/build/src/layout/generic/nsAbsoluteContainingBlock.cpp:156

Windows/Linux Nightly.

Assertion failure: kidOverflowBEnd >= kidBEnd, at /home/worker/workspace/build/src/layout/generic/nsAbsoluteContainingBlock.cpp:156
#01: mozilla::ViewportFrame::Reflow [layout/generic/ViewportFrame.cpp:376]
#02: mozilla::PresShell::DoReflow [layout/generic/ReflowOutput.h:282]
#03: mozilla::PresShell::ProcessReflowCommands [layout/base/PresShell.cpp:9490]
#04: mozilla::PresShell::DoFlushPendingNotifications [layout/base/PresShell.cpp:4212]
#05: nsRefreshDriver::Tick [mfbt/RefPtr.h:284]
#06: nsRefreshDriver::DoTick [layout/base/nsRefreshDriver.cpp:1478]
#07: nsRefreshDriver::Tick [layout/base/nsRefreshDriver.cpp:1833]
#08: nsRefreshDriver::DoTick [layout/base/nsRefreshDriver.cpp:1478]
#09: nsRefreshDriver::FinishedWaitingForTransaction [layout/base/nsRefreshDriver.cpp:2134]
#10: mozilla::layers::ClientLayerManager::DidComposite [gfx/layers/client/ClientLayerManager.cpp:503]
#11: mozilla::layers::CompositorBridgeChild::RecvDidComposite [mfbt/RefPtr.h:77]
#12: mozilla::layers::PCompositorBridgeChild::OnMessageReceived [obj-firefox/ipc/ipdl/PCompositorBridgeChild.cpp:1443]
#13: mozilla::ipc::MessageChannel::DispatchAsyncMessage [ipc/glue/MessageChannel.h:612]
#14

Comment 1

[Carsten Book [:Tomcat]]

also reproducible on http://temple.summon.serialssolutions.com/advanced with crash on load 

Mats, Johnathan could you take a look ? Thanks !

Comment 2

[Daniel Holbert [:dholbert]]

(In reply to Carsten Book [:Tomcat] from comment #1)
> also reproducible on http://temple.summon.serialssolutions.com/advanced with

I took a quick look at this testcase, while triaging recent bugs.

The assertion here is declaring that the kidFrame's overflow rect BEnd should be at least as large as the frame's mRect (border-box) BEnd.  This seems reasonable, because its overflow rect should be at least as large as its mRect.  But in this case, the kidFrame has a 0-sized overflow rect somehow, vs. a 1200-appunit-sized mRect.

Here's what I get if I attach gdb at the point where the asserted condition fails:

(gdb) p kidFrame->GetScrollableOverflowRectRelativeToSelf()
$5 = {
  <mozilla::gfx::BaseRect<int, nsRect, nsPoint, nsSize, nsMargin>> = {
    x = 60, 
    y = 60, 
    width = 0, 
    height = 0
  }, <No data fields>}
(gdb) p kidFrame->mRect
$6 = {
  <mozilla::gfx::BaseRect<int, nsRect, nsPoint, nsSize, nsMargin>> = {
    x = 600, 
    y = 600, 
    width = 1200, 
    height = 1200
  }, <No data fields>}


Here, I'm pretty sure kidFrame is for this element in the DOM:
>  <div id="skipnav" class="skipnav offscreen">
...which has "position:fixed", "overflow:hidden".  Its size comes from "padding: 10px" (so 20px total in each dimension, = 1200 app units).  (It also has "height: 1px; width: 1px" -- not sure why those aren't adding an extra 60 app units, but that probably isn't relevant.)

Comment 3

[Daniel Holbert [:dholbert]]

Attachment: reduced testcase 1

Here's a reduced testcase. This only triggers the bug if I open the devtools "inspector" pane[1], so I'm guessing it depends on some layout API having been exercised (maybe we have to query for some bounding box, or something).

[1] It is specifically the devtools inspector pane that triggers it -- if I go straight to some other pane, e.g. the JS console or the JS debugger, the assert doesn't fire.

Comment 4

[Daniel Holbert [:dholbert]]

Attachment: reduced testcase 2

Comment 5

[Bob Clary [:bc] (inactive)]

fyi, bughunter shows this is still happening on the original url and 205 others in the last 2 months.

Comment 6

[Daniel Holbert [:dholbert]]

SearchFox says this assertion was added in bug 1365449. --> Adding dependency.

(Also, we're hitting this on rei.com in bug 1666888.)

Comment 7

[Bob Clary [:bc] (inactive)]

no longer reproducible even with the test cases for me. :dholbert: Can you reproduce or should we WFM it?

Comment 8

[Daniel Holbert [:dholbert]]

When I load the attached testcase and open DevTools inspector, I get:

###!!! ASSERTION: overflow area should be at least as large as frame rect: 'kidOverflowBEnd >= kidBEnd', file layout/generic/nsAbsoluteContainingBlock.cpp:210

This is the same assertion as was originally failing here; its text/severity has just changed (in https://hg.mozilla.org/mozilla-central/rev/e8e82eb1b9f0 for bug 1667507).