1466170 - Assertion failure: applyState.mWidth.mConsumed == applyState.mWidth.mAvailable (Unprocessed justification width), at /builds/worker/workspace/build/src/layout/generic/nsLineLayout.cpp:3187 with XUL -moz-grid-line and vertical writing mode

Status: RESOLVED FIXED

(Core :: XUL, defect, P5)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev 9900cebb1f90.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007f7886e072dd   rbx = 0x00007ffee60cfcf8
rsi = 0x00007f78870d6770   rdi = 0x00007f78870d5540
rbp = 0x00007ffee60cf9d0   rsp = 0x00007ffee60cf940
r8 = 0x00007f78870d6770    r9 = 0x00007f78881a5740
r10 = 0x0000000000000039   r11 = 0x0000000000000000
r12 = 0x0000000000000000   r13 = 0x00007f786879ec20
r14 = 0x00007f786447ad3c   r15 = 0x00007f786447ad20
rip = 0x00007f78770ec281
OS|Linux|0.0.0 Linux 4.4.0-127-generic #153-Ubuntu SMP Sat May 19 10:58:46 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsLineLayout::TextAlignLine(nsLineBox*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|3160|0x18
0|1|libxul.so|nsBlockFrame::PlaceLine(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFloatManager::SavedState*, mozilla::LogicalRect&, int&, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|4611|0x1b
0|2|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|4086|0x30
0|3|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|3835|0x41
0|4|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|2816|0x1a
0|5|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|2352|0x20
0|6|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|1225|0xf
0|7|libxul.so|nsFrame::BoxReflow(nsBoxLayoutState&, nsPresContext*, mozilla::ReflowOutput&, gfxContext*, int, int, int, int, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|10671|0x27
0|8|libxul.so|nsFrame::RefreshSizeCache(nsBoxLayoutState&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|10207|0x33
0|9|libxul.so|nsFrame::GetXULMinSize(nsBoxLayoutState&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|10321|0xb
0|10|libxul.so|nsSprocketLayout::GetXULMinSize(nsIFrame*, nsBoxLayoutState&)|hg:hg.mozilla.org/mozilla-central:layout/xul/nsSprocketLayout.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|1371|0x11
0|11|libxul.so|nsGridRowLeafLayout::GetXULMinSize(nsIFrame*, nsBoxLayoutState&)|hg:hg.mozilla.org/mozilla-central:layout/xul/grid/nsGridRowLeafLayout.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|64|0xe
0|12|libxul.so|nsBoxFrame::GetXULMinSize(nsBoxLayoutState&)|hg:hg.mozilla.org/mozilla-central:layout/xul/nsBoxFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|780|0x1b
0|13|libxul.so|nsBoxFrame::GetMinISize(gfxContext*)|hg:hg.mozilla.org/mozilla-central:layout/xul/nsBoxFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|551|0x10
0|14|libxul.so|nsFrame::ShrinkWidthToFit(gfxContext*, int, nsIFrame::ComputeSizeFlags)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|6368|0x10
0|15|libxul.so|nsContainerFrame::ComputeAutoSize(gfxContext*, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::LogicalSize const&, nsIFrame::ComputeSizeFlags)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|862|0x21
0|16|libxul.so|nsFrame::ComputeSize(gfxContext*, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::LogicalSize const&, nsIFrame::ComputeSizeFlags)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|5614|0x35
0|17|libxul.so|mozilla::ReflowInput::InitConstraints(nsPresContext*, mozilla::LogicalSize const&, nsMargin const*, nsMargin const*, mozilla::LayoutFrameType)|hg:hg.mozilla.org/mozilla-central:layout/generic/ReflowInput.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|2478|0xd
0|18|libxul.so|mozilla::ReflowInput::Init(nsPresContext*, mozilla::LogicalSize const*, nsMargin const*, nsMargin const*)|hg:hg.mozilla.org/mozilla-central:layout/generic/ReflowInput.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|414|0x23
0|19|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:mfbt/Maybe.h:9900cebb1f9000bd05731ba67736b7c51f7eb812|599|0x1e
0|20|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|4158|0x14
0|21|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|3958|0x29
0|22|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|3835|0x41
0|23|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|2816|0x1a
0|24|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|2352|0x20
0|25|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|1225|0xf
0|26|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|306|0x10
0|27|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|3465|0x1e
0|28|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|2813|0x13
0|29|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|2352|0x20
0|30|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|1225|0xf
0|31|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|951|0x1a
0|32|libxul.so|nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|714|0x4d
0|33|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|951|0x1a
0|34|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|557|0x5
0|35|libxul.so|nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|679|0x14
0|36|libxul.so|nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|1055|0x5
0|37|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|995|0x19
0|38|libxul.so|mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|336|0x2b
0|39|libxul.so|mozilla::PresShell::DoReflow(nsIFrame*, bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|8944|0x25
0|40|libxul.so|mozilla::PresShell::ProcessReflowCommands(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|9117|0xe
0|41|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|4335|0x15
0|42|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::FlushType)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|4128|0x7
0|43|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsIPresShell.h:9900cebb1f9000bd05731ba67736b7c51f7eb812|566|0xf
0|44|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|7161|0x18
0|45|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|6954|0x18
0|46|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|1309|0x2b
0|47|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|852|0x22
0|48|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|741|0xf
0|49|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|627|0x16
0|50|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|629|0x1f
0|51|libxul.so|nsIDocument::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|8344|0x20
0|52|libxul.so|nsDocument::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|8266|0x8
0|53|libxul.so|nsIDocument::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|5224|0x11
0|54|libxul.so|mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:9900cebb1f9000bd05731ba67736b7c51f7eb812|1165|0x13
0|55|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|337|0x15
0|56|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|1088|0x15
0|57|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|519|0x11
0|58|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|97|0xa
0|59|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9900cebb1f9000bd05731ba67736b7c51f7eb812|326|0x17
0|60|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9900cebb1f9000bd05731ba67736b7c51f7eb812|319|0x8
0|61|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|157|0xd
0|62|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|893|0x11
0|63|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|269|0x5
0|64|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9900cebb1f9000bd05731ba67736b7c51f7eb812|326|0x17
0|65|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9900cebb1f9000bd05731ba67736b7c51f7eb812|319|0x8
0|66|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|719|0x8
0|67|firefox|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|50|0x14
0|68|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:9900cebb1f9000bd05731ba67736b7c51f7eb812|282|0x11
0|69|libc-2.23.so||||0x20830
0|70|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:9900cebb1f9000bd05731ba67736b7c51f7eb812|164|0x5

Comment 1

[Mats Palmgren (inactive)]

We should simply unship these 'display' values for web content...

Comment 2

[Tyson Smith [:tsmith]]

The fuzzers are tripping over this frequently. Marking as fuzzblocker.

Mats: Are you able to take this issue?

Comment 3

[Mats Palmgren (inactive)]

Nope, I refuse to make any kind of "improvements" to XUL layout. XUL layout code should be removed, that's the only thing I'll contribute to when it comes to XUL.

We should stop using display:-moz-grid in our UI so that we can finally remove it.
It looks like it's close, there's only one remaining usage that I can find:
toolkit/components/prompts/content/tabprompts.jsm

(Queries: moz-grid and <grid)

Maybe Gijs can say how hard it would be to convert that one to use display:grid/flex instead?

Comment 4

[:Gijs (he/him)]

bug 1583696 covers removing xul grid from tabprompts. It's not really trivial because there's no 1-1 corresponding CSS/markup that can be used instead, and the previous attempt in that bug got backed out over a number of regressions in the prompt display - tab prompts have to cope with almost arbitrary input from websites, as well as arbitrary window sizes, so getting them to behave correctly in all cases is not trivial.

At this point, tbh, I'd sooner switch tab prompts over to the new-style in-content prompts -- but that'd probably want some discussion around styling, to avoid the impression that the contents come from the browser, and so on. It may end up being part of the proton work in the next 2-3 months; it may not.