1493741 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Extra child frame found in nsVideoFrame. Possibly from stray whitespace around the videocontrols container element.), at /builds/worker/workspace/build/src/layout/generic/nsVideoFrame.cpp:408

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Extra child frame found in nsVideoFrame. Possibly from stray whitespace around the videocontrols container element.), at /builds/worker/workspace/build/src/layout/generic/nsVideoFrame.cpp:408

Testcase found while fuzzing mozilla-central rev 095ec59a8800.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007ffcaaba94a0
rsi = 0x00007f7b15beb8b0   rdi = 0x00007f7b15bea680
rbp = 0x00007ffcaaba92d0   rsp = 0x00007ffcaaba8ff0
r8 = 0x00007f7b15beb8b0    r9 = 0x00007f7b16d63740
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007f7afb6822c0   r13 = 0x00007f7afb682628
r14 = 0x00007ffcaaba91a0   r15 = 0x00007ffcaaba9448
rip = 0x00007f7b066391e0
OS|Linux|0.0.0 Linux 4.15.0-34-generic #37-Ubuntu SMP Mon Aug 27 15:21:48 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|nsVideoFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsVideoFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|314|0x18
0|1|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:095ec59a8800360154df6668394803e5a84d031c|309|0x10
0|2|libxul.so|nsBlockFrame::ReflowFloat(mozilla::BlockReflowInput&, mozilla::LogicalRect const&, nsIFrame*, mozilla::LogicalMargin&, mozilla::LogicalMargin&, bool, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|6457|0x2d
0|3|libxul.so|mozilla::BlockReflowInput::FlowAndPlaceFloat(nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:095ec59a8800360154df6668394803e5a84d031c|917|0x9
0|4|libxul.so|mozilla::BlockReflowInput::AddFloat(nsLineLayout*, nsIFrame*, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:095ec59a8800360154df6668394803e5a84d031c|627|0xb
0|5|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.cpp:095ec59a8800360154df6668394803e5a84d031c|982|0x8
0|6|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|4274|0x14
0|7|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|4074|0x2d
0|8|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|3950|0x41
0|9|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|2929|0x1a
0|10|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|2463|0x20
0|11|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|1297|0xf
0|12|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:095ec59a8800360154df6668394803e5a84d031c|309|0x10
0|13|libxul.so|nsBlockFrame::ReflowFloat(mozilla::BlockReflowInput&, mozilla::LogicalRect const&, nsIFrame*, mozilla::LogicalMargin&, mozilla::LogicalMargin&, bool, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|6457|0x2d
0|14|libxul.so|mozilla::BlockReflowInput::FlowAndPlaceFloat(nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:095ec59a8800360154df6668394803e5a84d031c|917|0x9
0|15|libxul.so|mozilla::BlockReflowInput::AddFloat(nsLineLayout*, nsIFrame*, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/BlockReflowInput.cpp:095ec59a8800360154df6668394803e5a84d031c|627|0xb
0|16|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.cpp:095ec59a8800360154df6668394803e5a84d031c|982|0x8
0|17|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|4274|0x14
0|18|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|4074|0x2d
0|19|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|3950|0x41
0|20|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|2929|0x1a
0|21|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|2463|0x20
0|22|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|1297|0xf
0|23|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|951|0x1a
0|24|libxul.so|nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|804|0x4d
0|25|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|951|0x1a
0|26|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|608|0x5
0|27|libxul.so|nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|731|0x14
0|28|libxul.so|nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|1120|0x5
0|29|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|995|0x19
0|30|libxul.so|mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:095ec59a8800360154df6668394803e5a84d031c|339|0x2b
0|31|libxul.so|mozilla::PresShell::DoReflow(nsIFrame*, bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:095ec59a8800360154df6668394803e5a84d031c|9016|0x25
0|32|libxul.so|mozilla::PresShell::ProcessReflowCommands(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:095ec59a8800360154df6668394803e5a84d031c|9189|0xe
0|33|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:095ec59a8800360154df6668394803e5a84d031c|4342|0x15
0|34|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::FlushType)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:095ec59a8800360154df6668394803e5a84d031c|4132|0x7
0|35|libxul.so|mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventStateManager.cpp:095ec59a8800360154df6668394803e5a84d031c|690|0xb
0|36|libxul.so|mozilla::PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:095ec59a8800360154df6668394803e5a84d031c|7639|0x26
0|37|libxul.so|mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:095ec59a8800360154df6668394803e5a84d031c|7283|0x1e
0|38|libxul.so|nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:view/nsViewManager.cpp:095ec59a8800360154df6668394803e5a84d031c|812|0x20
0|39|libxul.so|nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool)|hg:hg.mozilla.org/mozilla-central:view/nsView.cpp:095ec59a8800360154df6668394803e5a84d031c|1141|0x1a
0|40|libxul.so|mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&)|hg:hg.mozilla.org/mozilla-central:widget/PuppetWidget.cpp:095ec59a8800360154df6668394803e5a84d031c|409|0x20
0|41|libxul.so|mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/apz/util/APZCCallbackHelper.cpp:095ec59a8800360154df6668394803e5a84d031c|537|0x1f
0|42|libxul.so|mozilla::dom::TabChild::HandleRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:095ec59a8800360154df6668394803e5a84d031c|1736|0x8
0|43|libxul.so|mozilla::dom::TabChild::RecvRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:095ec59a8800360154df6668394803e5a84d031c|1708|0x8
0|44|libxul.so|mozilla::dom::TabChild::RecvSynthMouseMoveEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:095ec59a8800360154df6668394803e5a84d031c|1669|0x5
0|45|libxul.so|mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:02268f1ba9e00ffe07e4bcc063446705fe510c810ccf33c05846c03ad0fc77979f42d11c7c0e57dd9cf4358837bdb5f4900d13276554f827b03e90e220c13177/ipc/ipdl/PBrowserChild.cpp:|3582|0x1d
0|46|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:095ec59a8800360154df6668394803e5a84d031c|2248|0x6
0|47|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:095ec59a8800360154df6668394803e5a84d031c|2175|0xb
0|48|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:095ec59a8800360154df6668394803e5a84d031c|2012|0xb
0|49|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:095ec59a8800360154df6668394803e5a84d031c|2045|0xc
0|50|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:095ec59a8800360154df6668394803e5a84d031c|337|0x15
0|51|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:095ec59a8800360154df6668394803e5a84d031c|1166|0x15
0|52|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:095ec59a8800360154df6668394803e5a84d031c|519|0x11
0|53|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:095ec59a8800360154df6668394803e5a84d031c|97|0xa
0|54|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:095ec59a8800360154df6668394803e5a84d031c|325|0x17
0|55|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:095ec59a8800360154df6668394803e5a84d031c|318|0x8
0|56|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:095ec59a8800360154df6668394803e5a84d031c|158|0xd
0|57|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:095ec59a8800360154df6668394803e5a84d031c|939|0x11
0|58|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:095ec59a8800360154df6668394803e5a84d031c|269|0x5
0|59|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:095ec59a8800360154df6668394803e5a84d031c|325|0x17
0|60|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:095ec59a8800360154df6668394803e5a84d031c|318|0x8
0|61|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:095ec59a8800360154df6668394803e5a84d031c|765|0x8
0|62|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:095ec59a8800360154df6668394803e5a84d031c|50|0x14
0|63|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:095ec59a8800360154df6668394803e5a84d031c|287|0x11
0|64|libc-2.27.so||||0x21b97
0|65|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:095ec59a8800360154df6668394803e5a84d031c|164|0x5

Comment 1

[Nils Ohlmeier [:drno]]

Looking at the stack trace it all seems to be related to Layout

Comment 2

[Tim Guan-tin Chien [:timdream] (please needinfo)]

:'(

Comment 3

[Tim Guan-tin Chien [:timdream] (please needinfo)]

OK. So I'll need to teach nsVideoFrame to ignore CSS generated content...

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Do we without the UA widget, or other browsers really do that? What are we generating?

Comment 5

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Attachment: Bug 1493741 - Don't generate elements around UA Widget shadow root r=emilio

This patch make nsCSSFrameConstructor::CreateGeneratedContentItem() early
returns if the originating element contains an UA Widget shadow root.

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 9011916 [details]
Bug 1493741 - Don't generate elements around UA Widget shadow root r=emilio

Emilio Cobos Álvarez (:emilio) has approved the revision.

Comment 7

[Tim Guan-tin Chien [:timdream] (please needinfo)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=106fe17a5cd1612013c19675ddbda82c17a4235c

Comment 8

[Tim Guan-tin Chien [:timdream] (please needinfo)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=7d24e0e45d62e501e98c47e9c2870ed78e2b11ee

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2ba4c4ab35f5
Don't generate elements around UA Widget shadow root r=emilio

Comment 10

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/2ba4c4ab35f5