1489149 - Assertion failure: !aPrevFrame || (!aPrevFrame->GetNextContinuation() || (((aPrevFrame->GetNextContinuation()->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER)) && !(aPrevFrame->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER))) (aPrevFrame must be the la

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 0c947d96e8f3.

Assertion failure: !aPrevFrame || (!aPrevFrame->GetNextContinuation() || (((aPrevFrame->GetNextContinuation()->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER)) && !(aPrevFrame->GetStateBits() & NS_FRAME_IS_OVERFLOW_CONTAINER))) (aPrevFrame must be the la

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007f8d991fa1f0
rsi = 0x00007f8db33958b0   rdi = 0x00007f8db3394680
rbp = 0x00007ffece2f97f0   rsp = 0x00007ffece2f97d0
r8 = 0x00007f8db33958b0    r9 = 0x00007f8db450d740
r10 = 0x00000000ffffffc7   r11 = 0x0000000000000000
r12 = 0x00007f8d991fa140   r13 = 0x0000000000000800
r14 = 0x00007ffece2f9f48   r15 = 0x00007ffece2f9ee8
rip = 0x00007f8da3da04a2
OS|Linux|0.0.0 Linux 4.15.0-33-generic #36-Ubuntu SMP Wed Aug 15 16:00:05 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|nsFrameManager::InsertFrames(nsContainerFrame*, mozilla::layout::FrameChildListID, nsIFrame*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsFrameManager.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|86|0x18
0|1|libxul.so|nsFrameConstructorState::ProcessFrameInsertions(nsAbsoluteItems&, mozilla::layout::FrameChildListID)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1449|0x18
0|2|libxul.so|nsFrameConstructorState::~nsFrameConstructorState()|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1031|0x18
0|3|libxul.so|nsCSSFrameConstructor::ContentAppended(nsIContent*, nsCSSFrameConstructor::InsertionKind)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|7084|0x5
0|4|libxul.so|mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1444|0xe
0|5|libxul.so|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|3057|0xb
0|6|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|4301|0x19
0|7|libxul.so|nsRefreshDriver::Tick(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1901|0x5
0|8|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|324|0x8
0|9|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|317|0xc
0|10|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|755|0xc
0|11|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|571|0xc
0|12|libxul.so|mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&)|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|78|0x9
0|13|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:2c36fa176485b987fd1c1ce548d1f34c4c8bfdea36ff5dd016400feb13d3c5c0c7f99d5a56d13733937c9483a48617af010c09f521533a5ce0fc1f74c50b86a2/ipc/ipdl/PVsyncChild.cpp:|167|0xc
0|14|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|2248|0x6
0|15|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|2175|0xb
0|16|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|2012|0xb
0|17|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|2045|0xc
0|18|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1161|0x15
0|19|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|519|0x11
0|20|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|97|0xa
0|21|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|325|0x17
0|22|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|318|0x8
0|23|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|158|0xd
0|24|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|944|0x11
0|25|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|269|0x5
0|26|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|325|0x17
0|27|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|318|0x8
0|28|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|770|0x8
0|29|firefox|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|50|0x14
0|30|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|287|0x11
0|31|libc-2.27.so||||0x21b97
0|32|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|164|0x5

Comment 1

[Sean Voisen (:svoisen)]

Mats: Any thoughts on this one?

Comment 2

[Mats Palmgren (inactive)]

Attachment: frame dump

The assertion fails because aPrevFrame=625000ae1240 (blue) has a next-in-flow
(green) that isn't a NS_FRAME_IS_OVERFLOW_CONTAINER.  The bug is that we chose
625000ae1190 (red) as the container to insert to in the first place. We should
have chosen its next-in-flow (yellow) instead.

Comment 3

[Mats Palmgren (inactive)]

Attachment: fix + crashtest

Comment 4

[Daniel Holbert [:dholbert]]

Comment on attachment 9009423 [details] [diff] [review]
fix + crashtest

Review of attachment 9009423 [details] [diff] [review]:
-----------------------------------------------------------------

The crashtest has a setTimeout(..., 2000).

If that is required to trigger the crash, then this probably needs reftest-wait, right? (And might want a lower timeout value)

Or if it's not needed, maybe remove that line so that it doesn't set off anyone's "bogus arbitrary setTimeout" alarms when auditing tests.

Comment 5

[Mats Palmgren (inactive)]

The original testcase never fires the load event because the iframe
is too busy doing DOM stuff + reload() ad infinitum:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=14812ce9fd2cfa71b2e3be295a32a9027d0581be&selectedJob=199517228
The 2 sec timeout is a fallback to make sure the test ends
soon-ish if that happens.  Adding "reftest-wait" too is a good
idea though, in case the load event starts to come sooner for some
reason, to ensure the test runs for a minimum time as well...

So I added reftest-wait and lowered the timeout to 1 sec.
It triggers the assertion in about one third of the runs:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=3db83d7bce54c5151fc83aebc8c81487c7be82aa
which is probably good enough to be detected.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f3bf35137fe8
Check all child lists for children, not just the principal list.  r=dholbert

Comment 7

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/f3bf35137fe8