Closed Bug 1429962 Opened 2 years ago Closed 2 years ago

Assertion failure: MaybeGetListBoxBodyFrame(aContainer, child) || (!child->GetPrimaryFrame() && !GetDisplayNoneStyleFor(child) && !GetDisplayContentsStyleFor(child)), at /src/layout/base/nsCSSFrameConstructor.cpp:7398

Categories

(Core :: CSS Parsing and Computation, defect, P3)

59 Branch
defect

Tracking

()

RESOLVED FIXED
mozilla60
Tracking Status
firefox-esr52 --- unaffected
firefox58 --- wontfix
firefox59 --- wontfix
firefox60 --- fixed

People

(Reporter: tsmith, Assigned: emilio)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file testcase.html
Assertion failure: MaybeGetListBoxBodyFrame(aContainer, child) || (!child->GetPrimaryFrame() && !GetDisplayNoneStyleFor(child) && !GetDisplayContentsStyleFor(child)), at /src/layout/base/nsCSSFrameConstructor.cpp:7398

#0 0x7f3842fe1e2c in nsCSSFrameConstructor::IssueSingleInsertNofications(nsIContent*, nsIContent*, nsIContent*) /src/layout/base/nsCSSFrameConstructor.cpp:7395:5
#1 0x7f3842fe2225 in nsCSSFrameConstructor::GetRangeInsertionPoint(nsIContent*, nsIContent*, nsIContent*) /src/layout/base/nsCSSFrameConstructor.cpp:7428:7
#2 0x7f3842fded0f in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, nsCSSFrameConstructor::InsertionKind, TreeMatchContext*) /src/layout/base/nsCSSFrameConstructor.cpp:8079:17
#3 0x7f3842f2e344 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /src/layout/base/RestyleManager.cpp:1410:27
#4 0x7f3842f8746a in mozilla::ServoRestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /src/layout/base/ServoRestyleManager.cpp:1164:9
#5 0x7f3842f524c8 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /src/layout/base/PresShell.cpp:4215:41
#6 0x7f3842f51cbc in mozilla::PresShell::DoFlushPendingNotifications(mozilla::FlushType) /src/layout/base/PresShell.cpp:4088:3
#7 0x7f383f631032 in nsDocument::FlushPendingNotifications(mozilla::FlushType, mozilla::FlushTarget) /src/dom/base/nsDocument.cpp:8225:14
#8 0x7f383e6dbf71 in nsDocLoader::DocLoaderIsEmpty(bool) /src/uriloader/base/nsDocLoader.cpp:704:14
#9 0x7f383e6ddaa5 in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /src/uriloader/base/nsDocLoader.cpp:633:5
#10 0x7f383e6de4bc in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /src/uriloader/base/nsDocLoader.cpp
#11 0x7f383cf02bc5 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /src/netwerk/base/nsLoadGroup.cpp:629:28
#12 0x7f383f6359e2 in nsDocument::DoUnblockOnload() /src/dom/base/nsDocument.cpp:9047:18
#13 0x7f383f6356be in nsDocument::UnblockOnload(bool) /src/dom/base/nsDocument.cpp:8969:9
#14 0x7f383f61be88 in nsDocument::DispatchContentLoadedEvents() /src/dom/base/nsDocument.cpp:5601:3
#15 0x7f383f67d095 in mozilla::detail::RunnableMethodImpl<nsDocument*, void (nsDocument::*)(), true, (mozilla::RunnableKind)0>::Run() /src/obj-firefox/dist/include/nsThreadUtils.h:1192:13
#16 0x7f383cd13809 in mozilla::SchedulerGroup::Runnable::Run() /src/xpcom/threads/SchedulerGroup.cpp:395:25
#17 0x7f383cd4a6e7 in nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1040:14
#18 0x7f383cd6d128 in NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:517:10
#19 0x7f383d988743 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#20 0x7f383d8ce848 in MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#21 0x7f383d8ce6cc in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#22 0x7f38429a0eaa in nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:157:27
#23 0x7f3845e9de60 in XRE_RunAppShell() /src/toolkit/xre/nsEmbedFunctions.cpp:875:22
#24 0x7f383d989365 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:269:9
#25 0x7f383d8ce848 in MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#26 0x7f383d8ce6cc in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#27 0x7f3845e9d5be in XRE_InitChildProcess(int, char**, XREChildData const*) /src/toolkit/xre/nsEmbedFunctions.cpp:701:34
#28 0x4ef5f6 in content_process_main(mozilla::Bootstrap*, int, char**) /src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
#29 0x4ef87e in main /src/browser/app/nsBrowserApp.cpp:280:18
#30 0x7f385c36c82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#31 0x41f3d4 in _start (firefox+0x41f3d4)
Flags: in-testsuite?
Flags: needinfo?(emilio)
Gah, this is annoying... So we're inserting a <li> into a <fieldset>, and there's a text-node that stops being suppressed due to that, which had been marked for reframing right before because the <canvas> had been removed (in ReframeTextIfNeeded)...

So the text node ends up with NS_CREATE_FRAME_IF_NON_WHITESPACE _and_ the NODE_NEEDS_FRAME, which means that when we go to process restyles, since we're inserting in a frameset, we insert individually.

When inserting the <li> we see that the node has NS_CREATE_FRAME_IF_NON_WHITESPACE, and create a frame item for it, and thus give it a frame.

When inserting the text, we already have a frame because of that, and we assert...

The right fix may be making the NS_CREATE_FRAME_IF_NON_WHITESPACE flag exclusive with the lazy frame construction bits... Though not 100% sure yet
Priority: -- → P3
> and create a frame item for it, and thus give it a frame

At that point we should clear lazy frame construction bits, imo.  That's what we do for "normal" things that get frame construction items, via ShouldCreateItemsForChild() and the like.
(In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from comment #2)
> > and create a frame item for it, and thus give it a frame
> 
> At that point we should clear lazy frame construction bits, imo.  That's
> what we do for "normal" things that get frame construction items, via
> ShouldCreateItemsForChild() and the like.

Right, the annoying part is that at that point it's too late already (we've already issued the ContentRangeInserted)...
Assignee: nobody → emilio
Flags: needinfo?(emilio)
Comment on attachment 8950883 [details]
Bug 1429962: Don't add frames / reframe text that is going to get reframed anyway.

https://reviewboard.mozilla.org/r/220140/#review226272

r=me.  This seems pretty non-invasive, thank you.
Attachment #8950883 - Flags: review?(bzbarsky) → review+
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/63e930c8b308
Don't add frames / reframe text that is going to get reframed anyway. r=bz
https://hg.mozilla.org/mozilla-central/rev/63e930c8b308
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla60
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.