Assertion failure: aReflowInput.ComputedISize() != nscoord((1 << 30) - 1) (Must have a computed inline size), at /builds/worker/workspace/build/src/layout/forms/nsListControlFrame.cpp:372

RESOLVED FIXED in Firefox 62

Status

()

defect
RESOLVED FIXED
a year ago
10 months ago

People

(Reporter: jkratzer, Assigned: mihir)

Tracking

(Blocks 1 bug, {assertion, regression, testcase})

59 Branch
mozilla62
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox-esr60 unaffected, firefox60 unaffected, firefox61 unaffected, firefox62 fixed)

Details

Attachments

(2 attachments)

Reporter

Description

a year ago
Posted file trigger.html
Testcase found while fuzzing mozilla-central rev 043e4ab6e724.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007f40646cf2dd   rbx = 0x00007ffcb62301e0
rsi = 0x00007f406499e770   rdi = 0x00007f406499d540
rbp = 0x00007ffcb6230100   rsp = 0x00007ffcb622ffb0
r8 = 0x00007f406499e770    r9 = 0x00007f4065a6d740
r10 = 0x0000000000000039   r11 = 0x0000000000000000
r12 = 0x00007ffcb6230101   r13 = 0x00007f4041a19800
r14 = 0x00007ffcb6230280   r15 = 0x00007f4041a8dca0
rip = 0x00007f4054961d2e
OS|Linux|0.0.0 Linux 4.4.0-124-generic #148-Ubuntu SMP Wed May 2 13:00:18 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsListControlFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/forms/nsListControlFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|371|0x18
0|1|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|951|0x1a
0|2|libxul.so|nsComboboxControlFrame::ReflowDropdown|hg:hg.mozilla.org/mozilla-central:layout/forms/nsComboboxControlFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|494|0x5
0|3|libxul.so|nsComboboxControlFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/forms/nsComboboxControlFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|874|0xe
0|4|libxul.so|nsLineLayout::ReflowFrame|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|924|0x30
0|5|libxul.so|nsBlockFrame::ReflowInlineFrame|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|4158|0x14
0|6|libxul.so|nsBlockFrame::DoReflowInlineFrames|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|3958|0x29
0|7|libxul.so|nsBlockFrame::ReflowInlineFrames|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|3835|0x41
0|8|libxul.so|nsBlockFrame::ReflowLine|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|2816|0x1a
0|9|libxul.so|nsBlockFrame::ReflowDirtyLines|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|2352|0x20
0|10|libxul.so|nsBlockFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|1225|0xf
0|11|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|951|0x1a
0|12|libxul.so|nsCanvasFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|714|0x4d
0|13|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|951|0x1a
0|14|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|557|0x5
0|15|libxul.so|nsHTMLScrollFrame::ReflowContents|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|679|0x14
0|16|libxul.so|nsHTMLScrollFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|1055|0x5
0|17|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|995|0x19
0|18|libxul.so|mozilla::ViewportFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|336|0x2b
0|19|libxul.so|mozilla::PresShell::DoReflow|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|8946|0x25
0|20|libxul.so|mozilla::PresShell::ProcessReflowCommands|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|9119|0xe
0|21|libxul.so|mozilla::PresShell::DoFlushPendingNotifications|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|4336|0x15
0|22|libxul.so|nsRefreshDriver::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|1923|0x5
0|23|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|301|0xb
0|24|libxul.so|mozilla::RefreshDriverTimer::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|320|0xf
0|25|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|760|0x5
0|26|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|574|0xc
0|27|libxul.so|mozilla::layout::VsyncChild::RecvNotify|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|68|0x9
0|28|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived|s3:gecko-generated-sources:0c7cf777c2ff93c34ff1546f677320cb1229427e6947e87c6fa76720f9b9c5b6a4a4d036521ed9a643f4fa5e10a57d8748e2532d47fce8282aa653340c0c00ff/ipc/ipdl/PVsyncChild.cpp:|167|0xc
0|29|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|2136|0x6
0|30|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|2066|0xb
0|31|libxul.so|mozilla::ipc::MessageChannel::RunMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|1912|0xb
0|32|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|1945|0xc
0|33|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|1090|0x15
0|34|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|519|0x11
0|35|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|97|0xa
0|36|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:043e4ab6e72469ed8121f4da98dcdfef983a49d9|326|0x17
0|37|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:043e4ab6e72469ed8121f4da98dcdfef983a49d9|319|0x8
0|38|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|157|0xd
0|39|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|893|0x11
0|40|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|269|0x5
0|41|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:043e4ab6e72469ed8121f4da98dcdfef983a49d9|326|0x17
0|42|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:043e4ab6e72469ed8121f4da98dcdfef983a49d9|319|0x8
0|43|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|719|0x8
0|44|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|50|0x14
0|45|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:043e4ab6e72469ed8121f4da98dcdfef983a49d9|282|0x11
0|46|libc-2.23.so||||0x20830
0|47|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:043e4ab6e72469ed8121f4da98dcdfef983a49d9|164|0x5
Flags: in-testsuite?
I've got an intern starting next week who I'll task with fixing this as a first-bug. (Very similar to bug 1460787 / bug 1461979 )
Flags: needinfo?(dholbert)
Assignee

Updated

a year ago
Assignee: nobody → iyermihir
This should be as simple as replacing MOZ_ASSERT with NS_WARNING_ASSERTION at line 372 of nsListControlFrame.cpp (and reindenting the next line so that it still lines up just inside the NS_WARNING_ASSERTION(....) open-paren)

You'll want to create a "crashtest", too -- just create a copy of the testcase in layout/forms/crashtests with name "1464165-1.html" and add a line to the crashtest.list file in that directory to get it loaded. See bug 1460787 / bug 1461979 for an example.
Flags: needinfo?(dholbert)

Comment 4

a year ago
mozreview-review
Comment on attachment 8981962 [details]
Bug 1464165 - Relax assertion for isize not being nscoord_MAX in nsListControlFrame.

https://reviewboard.mozilla.org/r/247982/#review254080

::: layout/forms/crashtests/1464165-1.html:11
(Diff revision 1)
> +        try { o2 = document.createElementNS('http://www.w3.org/1999/xhtml', 'style') } catch(e) { }
> +        try { document.documentElement.appendChild(o1) } catch(e) { }
> +        try { document.documentElement.appendChild(o2) } catch(e) { }
> +        try { o2.sheet.insertRule('* { border-left: green; -moz-padding-start: 5% !important; padding: 171798691; -moz-border-end: solid;', 0) } catch(e) { }
> +      }
> +      

Please fix whitespace on blank line (probably from the fuzzer tool or whatever).

::: layout/forms/crashtests/1464165-1.html:15
(Diff revision 1)
> +      }
> +      
> +      document.addEventListener('DOMContentLoaded', start)
> +    </script>
> +  </head>
> +</html>

Let's add a newline at the end of this file (looks like it's missing one in the raw patch view).

::: layout/forms/crashtests/crashtests.list:75
(Diff revision 1)
> +load 1464165-1.html
>  asserts(2-4) load 1460787-1.html

Let's insert this one line lower down.
Attachment #8981962 - Flags: review?(dholbert) → review-
Comment hidden (mozreview-request)
Comment hidden (mozreview-request)

Comment 7

a year ago
mozreview-review
Comment on attachment 8981962 [details]
Bug 1464165 - Relax assertion for isize not being nscoord_MAX in nsListControlFrame.

https://reviewboard.mozilla.org/r/247982/#review254106

Looks good!
Attachment #8981962 - Flags: review?(dholbert) → review+

Comment 8

a year ago
Pushed by dholbert@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/6272dd5e7417
Relax assertion for isize not being nscoord_MAX in nsListControlFrame. r=dholbert

Comment 9

a year ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/6272dd5e7417
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla62
Blocks: 1457813
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.