stylo: Assertion failure: parent->FirstContinuation() == aParent || (parent->StyleContext()->IsInheritingAnonBox() && parent->GetContent() == aParent->GetContent())

RESOLVED FIXED in Firefox 57

Status

()

defect
P2
normal
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: truber, Assigned: bzbarsky)

Tracking

(Blocks 2 bugs, {assertion, testcase})

Trunk
mozilla57
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox55 unaffected, firefox56 unaffected, firefox57 fixed)

Details

Attachments

(3 attachments)

Posted file testcase.html
The attached testcase causes an assertion in m-c rev df9beb78189 with stylo enabled by pref

Assertion failure: parent->FirstContinuation() == aParent || (parent->StyleContext()->IsInheritingAnonBox() && parent->GetContent() == aParent->GetContent()), at /home/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:208
# 0  libxul.so!mozilla::ServoRestyleState::ProcessMaybeNestedWrapperRestyle [ServoRestyleManager.cpp:183]
# 1  libxul.so!mozilla::ServoRestyleState::ProcessWrapperRestyles [ServoRestyleManager.cpp:168]
# 2  libxul.so!mozilla::ServoRestyleManager::ProcessPostTraversal [ServoRestyleManager.cpp:888]
# 3  libxul.so!mozilla::ServoRestyleManager::ProcessPostTraversal [ServoRestyleManager.cpp:873]
# 4  libxul.so!mozilla::ServoRestyleManager::DoProcessPendingRestyles [ServoRestyleManager.cpp:1094]
# 5  libxul.so!mozilla::PresShell::DoFlushPendingNotifications [PresShell.cpp:4200]
Flags: in-testsuite?
Priority: -- → P2
Boris, you wrote this assertion. Any ideas?
Flags: needinfo?(bzbarsky)

Comment 2

2 years ago
fyi, bughunter reproduces this on <https://id.yahoo.com/> and <https://maktoob.yahoo.com/?p=us>. STR: Load page, open Web Developer -> Web Console
This is the partial frame tree when this assertion happens.

At the moment, in ServoRestyleState::ProcessMaybeNestedWrapperRestyle,
* "cur" points to the table frame (116aec9a1d8 in this dump),
* "parent", according to the context, should point to its first inline ancestor (116aec9a0b0 in this dump),
* "aParent" points to the first ib-split continuation of "parent" (116aec99de0 in this dump).
Finally got to this.  Comment 3 is spot-on: we should be using FirstContinuationOrPartOfIBSplit in the assert, not just FirstContinuation.  Patch coming up.
Flags: needinfo?(bzbarsky)
MozReview-Commit-ID: AtBFlvLyg6b
Attachment #8903011 - Flags: review?(xidorn+moz)
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Comment on attachment 8903011 [details] [diff] [review]
Fix anon box restyling assertions to correctly handle ib splits

Review of attachment 8903011 [details] [diff] [review]:
-----------------------------------------------------------------

Looks reasonable to me, but I don't have enough confident to review this code. Redirecting to emilio.
Attachment #8903011 - Flags: review?(xidorn+moz) → review?(emilio)
Comment on attachment 8903011 [details] [diff] [review]
Fix anon box restyling assertions to correctly handle ib splits

Review of attachment 8903011 [details] [diff] [review]:
-----------------------------------------------------------------

::: layout/base/ServoRestyleManager.cpp
@@ +214,3 @@
>    Maybe<ServoRestyleState> parentRestyleState;
> +  nsIFrame* parentForRestyle = aParent;
> +  if (FirstContinuationOrPartOfIBSplit(parent) != aParent) {

This means we need to move FirstContinuationOrPartOfIBSplit out of the `ifdef DEBUG` as well, right?
Attachment #8903011 - Flags: review?(emilio) → review+
> This means we need to move FirstContinuationOrPartOfIBSplit out of the `ifdef DEBUG` as well, right?

I actually just changed this to:

  if (nsLayoutUtils::FirstContinuationOrIBSplitSibling(parent) != aParent) {

locally last night when I found the opt build bustage, and thought I'd requested review with that change... clearly not.

Comment 10

2 years ago
Pushed by bzbarsky@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ca0fcfb8cec2
Fix anon box restyling assertions to correctly handle ib splits. r=xidorn

Comment 11

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/ca0fcfb8cec2
Status: ASSIGNED → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.