1497076 - Assertion failure: aMin <= aMax, at FontPropertyTypes.h:426

Status: RESOLVED FIXED

(Core :: DOM: CSS Object Model, defect, P3)

Description

[Bob Clary [:bc] (inactive)]

Attachment: windows log

1. https://www.shutterstock.com/editor/image/set-medisine-package-design-3dtemplate-vector-425275021?ref=image-photo&exit=/image-photo/425275021

2. Beta 63/Nightly 64, Windows/Linux at least. Doesn't crash opt.

Assertion failure: aMin <= aMax, at z:/build/build/src/obj-firefox/dist/include/mozilla/FontPropertyTypes.h:426
#01: mozilla::dom::FontFaceSet::UpdateRules(nsTArray<nsFontFaceRuleContainer> const &) [layout/style/FontFaceSet.cpp:767]
#02: nsIDocument::FlushUserFontSet() [dom/base/nsDocument.cpp:12578]
#03: nsIDocument::GetUserFontSet(bool) [dom/base/nsDocument.cpp:12534]
#04: mozilla::ServoStyleSet::PreTraverseSync() [layout/style/ServoStyleSet.cpp:428]
#05: mozilla::ServoStyleSet::ResolveStyleFor(mozilla::dom::Element *,mozilla::LazyComputeBehavior) [layout/style/ServoStyleSet.cpp:387]
#06: static class mozilla::dom::Element * GetPropagatedScrollStylesForViewport(class nsPresContext *, struct mozilla::ScrollStyles *) [layout/base/nsPresContext.cpp:1371]
#07: nsPresContext::UpdateViewportScrollStylesOverride() [layout/base/nsPresContext.cpp:1417]
#08: nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element *,nsILayoutHistoryState *) [layout/base/nsCSSFrameConstructor.cpp:2379]
#09: nsCSSFrameConstructor::ContentRangeInserted(nsIContent *,nsIContent *,nsILayoutHistoryState *,nsCSSFrameConstructor::InsertionKind) [layout/base/nsCSSFrameConstructor.cpp:7307]
#10: nsCSSFrameConstructor::ContentInserted(nsIContent *,nsILayoutHistoryState *,nsCSSFrameConstructor::InsertionKind) [layout/base/nsCSSFrameConstructor.cpp:7220]

Comment 1

[Emilio Cobos Álvarez (:emilio)]

I'm rewriting some of this code in bug 1496486, may be worth waiting for that.

Comment 2

[Cameron McCormack (:heycam)]

Looks like this is still happening.

Comment 3

[Cameron McCormack (:heycam)]

There's an @font-face { font-weight: normal 300; } descriptor, so I guess we're not correctly following "User agents must swap the computed value of the startpoint and endpoint of the range in order to forbid decreasing ranges." when there's a keyword in there.

Comment 4

[Cameron McCormack (:heycam)]

Actually we're not even copying with `font-weight: 400 300;`.

Comment 5

[Cameron McCormack (:heycam)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2c4a096ad2b6b4bc61cfe8eb0e04ca05918922e6

Comment 6

[Cameron McCormack (:heycam)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=15736d8675a656a741c2daf11a92c0b8b7984c28

Comment 7

[Cameron McCormack (:heycam)]

Attachment: Bug 1497076 - Handle reversed ranges in @font-face descriptors

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9536fe8330a8
Handle reversed ranges in @font-face descriptors r=jfkthame

Comment 9

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/13837 for changes under testing/web-platform/tests

Comment 10

[Eliza Balazs [:ebalazs_]]

https://hg.mozilla.org/mozilla-central/rev/9536fe8330a8

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Is there a user impact which justifies backport consideration here or can this fix ride the trains?

Comment 12

[Cameron McCormack (:heycam)]

This can ride the trains, thanks for checking.

Comment 13

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged