1506216 - Assertion failure: anonKids.IsEmpty() (We support only column-span on block and inline frame. They should not create any native anonymous children.), at src/layout/generic/ColumnSetWrapperFrame.cpp:154

Status: RESOLVED FIXED

(Core :: Layout: Columns, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20181109174520
SourceStamp=2f1158e5e0ce2523f93482abf6158db058a782a1

Assertion failure: anonKids.IsEmpty() (We support only column-span on block and inline frame. They should not create any native anonymous children.), at src/layout/generic/ColumnSetWrapperFrame.cpp:154

#0 mozilla::ColumnSetWrapperFrame::AssertColumnSpanWrapperSubtreeIsSane(nsIFrame const*) src/layout/generic/ColumnSetWrapperFrame.cpp:145:3
#1 mozilla::ColumnSetWrapperFrame::AppendFrames(mozilla::layout::FrameChildListID, nsFrameList&) src/layout/generic/ColumnSetWrapperFrame.cpp:103:7
#2 nsCSSFrameConstructor::FinishBuildingColumns(nsFrameConstructorState&, nsContainerFrame*, nsContainerFrame*, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:11372:22
#3 nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameItems&, nsIFrame*, PendingBinding*) src/layout/base/nsCSSFrameConstructor.cpp:11223:5
#4 nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*, nsILayoutHistoryState*) src/layout/base/nsCSSFrameConstructor.cpp:2640:5
#5 nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsILayoutHistoryState*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:7367:9
#6 nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:9107:7
#7 mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) src/layout/base/RestyleManager.cpp:1551:25
#8 mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) src/layout/base/RestyleManager.cpp:3065:9
#9 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4359:39
#10 nsRefreshDriver::Tick(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1907:18
#11 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:301:7
#12 mozilla::RefreshDriverTimer::Tick(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:318:5
#13 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:676:16
#14 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() src/layout/base/nsRefreshDriver.cpp:514:20
#15 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1246:14
#16 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:530:10
#17 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#18 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10
#19 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3
#20 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27
#21 nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:290:30
#22 XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4789:22
#23 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4934:8
#24 XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5026:21
#25 do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:233:22
#26 main src/browser/app/nsBrowserApp.cpp:315:16
#27 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#28 _start (firefox+0x329f4)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

Comment 2

[Ting-Yu Lin [:TYLin] (UTC-8)]

The test uses multi-columns on html element, and html element (root element) creates native anonymous children like scroll bars in https://searchfox.org/mozilla-central/rev/647b9eb1099e373e079e16f147f74f3d1d65eed3/dom/base/nsContentUtils.cpp#10530. Hence the assert.

Comment 3

[Ting-Yu Lin [:TYLin] (UTC-8)]

Attachment: Bug 1506216 - Remove bogus assert in AssertColumnSpanWrapperSubtreeIsSane().

nsContentUtils::AppendNativeAnonymousChildren() calls
AppendDocumentLevelNativeAnonymousContentTo() to create native anonymous
children for root element.

Comment 4

[Ting-Yu Lin [:TYLin] (UTC-8)]

Attachment: Bug 1506216 - Remove bogus assert in AssertColumnSpanWrapperSubtreeIsSane().

The assert is testing that the content's primary frame shouldn't
generate any native anonymous children, but what we really want to
ensure is that :-moz-column-span-wrapper doesn't create any native
anonymous child (because we don't restyle the wrapper), not the content
which creates ::-moz-column-span-wrapper. The condition is already
guaranteed by !aFrame->HasAnyStateBits(NS_FRAME_OWNS_ANON_BOXES) above.

Also, at this point during the frame construction, we haven't associate
the content with the its primary frame. Therefore,
nsContentUtils::AppendNativeAnonymousChildren() won't return anything
except for scrollbars on root element. That's why we have the crash in
this bug.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e70144f3fc89
Remove bogus assert in AssertColumnSpanWrapperSubtreeIsSane(). r=bzbarsky

Comment 6

[Eliza Balazs [:ebalazs_]]

https://hg.mozilla.org/mozilla-central/rev/e70144f3fc89