1384627 - Assertion failure: !inner->GetWritingMode().IsOrthogonalTo(aWM), at /home/worker/workspace/build/src/layout/forms/nsFieldSetFrame.cpp:638

Status: RESOLVED DUPLICATE of bug 1383938

(Core :: Layout: Form Controls, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev 20170726-e8400551c2e3.

Assertion failure: !inner->GetWritingMode().IsOrthogonalTo(aWM), at /home/worker/workspace/build/src/layout/forms/nsFieldSetFrame.cpp:638

ASAN:DEADLYSIGNAL
=================================================================
==1335==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fb6c119c066 bp 0x7fff0b6573b0 sp 0x7fff0b6572c0 T0)
==1335==The signal is caused by a WRITE memory access.
==1335==Hint: address points to the zero page.
    #0 0x7fb6c119c065 in nsFieldSetFrame::GetVerticalAlignBaseline(mozilla::WritingMode, int*) const /home/worker/workspace/build/src/layout/forms/nsFieldSetFrame.cpp:639:15
    #1 0x7fb6c0f86ef5 in nsBlockFrame::GetNaturalBaselineBOffset(mozilla::WritingMode, mozilla::BaselineSharingGroup, int*) const /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:510:16
    #2 0x7fb6c0f86bcd in nsIFrame::BaselineBOffset(mozilla::WritingMode, mozilla::BaselineSharingGroup, mozilla::AlignmentContext) const /home/worker/workspace/build/src/layout/generic/nsIFrameInlines.h:153:7
    #3 0x7fb6c0f86a5b in nsBlockFrame::GetLogicalBaseline(mozilla::WritingMode) const /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:492:5
    #4 0x7fb6c10e884b in nsLineLayout::PlaceFrame(nsLineLayout::PerFrameData*, mozilla::ReflowOutput&) /home/worker/workspace/build/src/layout/generic/nsLineLayout.cpp:1421:35
    #5 0x7fb6c10da413 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /home/worker/workspace/build/src/layout/generic/nsLineLayout.cpp:1102:7
    #6 0x7fb6c10d8795 in nsInlineFrame::ReflowInlineFrame(nsPresContext*, mozilla::ReflowInput const&, nsInlineFrame::InlineReflowInput&, nsIFrame*, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsInlineFrame.cpp:798:15
    #7 0x7fb6c10d79bb in nsInlineFrame::ReflowFrames(nsPresContext*, mozilla::ReflowInput const&, nsInlineFrame::InlineReflowInput&, mozilla::ReflowOutput&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsInlineFrame.cpp:681:7
    #8 0x7fb6c10d7016 in nsInlineFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsInlineFrame.cpp:460:3
    #9 0x7fb6c10d96c3 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /home/worker/workspace/build/src/layout/generic/nsLineLayout.cpp:921:13
    #10 0x7fb6c112318f in nsRubyBaseContainerFrame::ReflowOneColumn(nsRubyBaseContainerFrame::RubyReflowInput const&, unsigned int, mozilla::RubyColumn const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsRubyBaseContainerFrame.cpp:658:17
    #11 0x7fb6c1121e3b in nsRubyBaseContainerFrame::ReflowColumns(nsRubyBaseContainerFrame::RubyReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsRubyBaseContainerFrame.cpp:477:15
    #12 0x7fb6c1121216 in nsRubyBaseContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsRubyBaseContainerFrame.cpp:389:11
    #13 0x7fb6c10d96c3 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /home/worker/workspace/build/src/layout/generic/nsLineLayout.cpp:921:13
    #14 0x7fb6c1126010 in nsRubyFrame::ReflowSegment(nsPresContext*, mozilla::ReflowInput const&, nsRubyBaseContainerFrame*, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsRubyFrame.cpp:222:29
    #15 0x7fb6c112587d in nsRubyFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsRubyFrame.cpp:165:5
    #16 0x7fb6c10d96c3 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /home/worker/workspace/build/src/layout/generic/nsLineLayout.cpp:921:13
    #17 0x7fb6c0fa8787 in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:4220:15
    #18 0x7fb6c0fa6fec in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:4016:5
    #19 0x7fb6c0f9f719 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:3890:9
    #20 0x7fb6c0f99b8b in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:2873:5
    #21 0x7fb6c0f90eb2 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:2409:7
    #22 0x7fb6c0f8c05c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:1233:3
    #23 0x7fb6c0fccbba in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:935:14
    #24 0x7fb6c0fcbe32 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsCanvasFrame.cpp:752:5
    #25 0x7fb6c0fccbba in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:935:14
    #26 0x7fb6c106b569 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*, bool) /home/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:549:3
    #27 0x7fb6c106c7f2 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /home/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:661:3
    #28 0x7fb6c106eb27 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:1037:3
    #29 0x7fb6c0f7bb6f in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:979:14
    #30 0x7fb6c0f7b162 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /home/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:329:7

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

$ ./mach file-info bugzilla-component layout/forms/nsFieldSetFrame.cpp 
Core :: Layout: Form Controls
  layout/forms/nsFieldSetFrame.cpp

Comment 2

[Jason Kratzer [:jkratzer]]

(In reply to David Baron :dbaron: ⌚️UTC+1 from comment #1)
> $ ./mach file-info bugzilla-component layout/forms/nsFieldSetFrame.cpp 
> Core :: Layout: Form Controls
>   layout/forms/nsFieldSetFrame.cpp

Thanks! I wasn't aware of mach file-info.

Comment 3

[Jason Kratzer [:jkratzer]]

This appears to be a duplicate of bug 1383938.

Comment 4

[Intermittent Failures Robot]

1 failures in 939 pushes (0.001 failures/push) were associated with this bug in the last 7 days.   

Repository breakdown:
* autoland: 1

Platform breakdown:
* android-4-4-armv7-api15: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1384627&startday=2017-08-28&endday=2017-09-03&tree=all

Comment 5

[Ryan VanderMeulen [:RyanVM]]

(In reply to Jason Kratzer [:jkratzer] from comment #3)
> This appears to be a duplicate of bug 1383938.

Same regression range, so let's go with that.