Closed Bug 1506895 Opened 7 years ago Closed 7 years ago

Assertion failure: !nsLayoutUtils::GetAsBlock(aFrame) || !aFrame->IsBlockOutside() (unexpected block frame), at /builds/worker/workspace/build/src/layout/generic/TextOverflow.cpp:78

Categories

(Core :: Layout: Text and Fonts, defect, P3)

Product:
Core
Component:
Layout: Text and Fonts
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla65
Tracking Flags:
Tracking Status
firefox-esr60 --- unaffected
firefox63 --- wontfix
firefox64 --- wontfix
firefox65 --- fixed

People

(Reporter: jkratzer, Assigned: MatsPalmgren_bugz)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(3 files, 2 obsolete files)

testcase.html
401 bytes, text/html
Details
Minimal testcase
302 bytes, text/html
Details
fix v2+tests
28.05 KB, patch
emilio
: review+
Details | Diff | Splinter Review
Attached file testcase.html —
Testcase found while fuzzing mozilla-central rev f6df375b8698. Assertion failure: !nsLayoutUtils::GetAsBlock(aFrame) || !aFrame->IsBlockOutside() (unexpected block frame), at /builds/worker/workspace/build/src/layout/generic/TextOverflow.cpp:78 rax = 0x0000000000000000 rdx = 0x0000000000000000 rcx = 0x0000000000000b40 rbx = 0x00007f5d8992c740 rsi = 0x00007f5da44538b0 rdi = 0x00007f5da4452680 rbp = 0x00007fff209ffa80 rsp = 0x00007fff209ffa70 r8 = 0x00007f5da44538b0 r9 = 0x00007f5da55c4740 r10 = 0x0000000000000000 r11 = 0x0000000000000000 r12 = 0x000000008992c701 r13 = 0x00007fff209ffb01 r14 = 0x00007fff209ffd00 r15 = 0x0000000000002490 rip = 0x00007f5d94a4495b OS|Linux|0.0.0 Linux 4.15.0-38-generic #41-Ubuntu SMP Wed Oct 10 10:59:38 UTC 2018 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV /SEGV_MAPERR|0x0|0 0|0|libxul.so|mozilla::css::IsAtomicElement|hg:hg.mozilla.org/mozilla-central:layout/generic/TextOverflow.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|77|0x18 0|1|libxul.so|mozilla::css::TextOverflow::ExamineFrameSubtree(nsIFrame*, mozilla::LogicalRect const&, mozilla::LogicalRect const&, nsTHashtable<nsPtrHashKey<nsIFrame> >*, mozilla::css::TextOverflow::AlignmentEdges*, bool*, mozilla::css::TextOverflow::InnerClipEdges*)|hg:hg.mozilla.org/mozilla-central:layout/generic/TextOverflow.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|405|0xb 0|2|libxul.so|mozilla::css::TextOverflow::ExamineFrameSubtree(nsIFrame*, mozilla::LogicalRect const&, mozilla::LogicalRect const&, nsTHashtable<nsPtrHashKey<nsIFrame> >*, mozilla::css::TextOverflow::AlignmentEdges*, bool*, mozilla::css::TextOverflow::InnerClipEdges*)|hg:hg.mozilla.org/mozilla-central:layout/generic/TextOverflow.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|437|0x22 0|3|libxul.so|mozilla::css::TextOverflow::ExamineFrameSubtree(nsIFrame*, mozilla::LogicalRect const&, mozilla::LogicalRect const&, nsTHashtable<nsPtrHashKey<nsIFrame> >*, mozilla::css::TextOverflow::AlignmentEdges*, bool*, mozilla::css::TextOverflow::InnerClipEdges*)|hg:hg.mozilla.org/mozilla-central:layout/generic/TextOverflow.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|437|0x22 0|4|libxul.so|mozilla::css::TextOverflow::ExamineFrameSubtree(nsIFrame*, mozilla::LogicalRect const&, mozilla::LogicalRect const&, nsTHashtable<nsPtrHashKey<nsIFrame> >*, mozilla::css::TextOverflow::AlignmentEdges*, bool*, mozilla::css::TextOverflow::InnerClipEdges*)|hg:hg.mozilla.org/mozilla-central:layout/generic/TextOverflow.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|437|0x22 0|5|libxul.so|mozilla::css::TextOverflow::ExamineLineFrames(nsLineBox*, nsTHashtable<nsPtrHashKey<nsIFrame> >*, mozilla::css::TextOverflow::AlignmentEdges*)|hg:hg.mozilla.org/mozilla-central:layout/generic/TextOverflow.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|640|0x3f 0|6|libxul.so|mozilla::css::TextOverflow::ProcessLine(nsDisplayListSet const&, nsLineBox*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/TextOverflow.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|718|0xc 0|7|libxul.so|DisplayLine|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|6766|0x1e 0|8|libxul.so|nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|6856|0x33 0|9|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3879|0x17 0|10|libxul.so|nsColumnSetFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|1297|0x1c 0|11|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3879|0x17 0|12|libxul.so|DisplayLine|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|6761|0x19 0|13|libxul.so|nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|6856|0x33 0|14|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3879|0x17 0|15|libxul.so|mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3736|0x1a 0|16|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3879|0x17 0|17|libxul.so|DisplayLine|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|6761|0x19 0|18|libxul.so|nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|6856|0x33 0|19|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3879|0x17 0|20|libxul.so|nsColumnSetFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|1297|0x1c 0|21|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3879|0x17 0|22|libxul.so|DisplayLine|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|6761|0x19 0|23|libxul.so|nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|6856|0x33 0|24|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3879|0x17 0|25|libxul.so|nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|651|0x18 0|26|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3879|0x17 0|27|libxul.so|mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3736|0x1a 0|28|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3879|0x17 0|29|libxul.so|mozilla::ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|66|0x11 0|30|libxul.so|nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3167|0x16 0|31|libxul.so|nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3841|0x5 0|32|libxul.so|js::CheckThreadLocal::check() const|hg:hg.mozilla.org/mozilla-central:js/src/threading/posix/Thread.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|169|0x5 0|33|libxul.so|mozilla::BufferList<js::SystemAllocPolicy>::WriteBytes(char const*, unsigned long)|hg:hg.mozilla.org/mozilla-central:mfbt/BufferList.h:f6df375b86987b2772067a61873ebfe3a98c353a|437|0x1b 0|34|libxul.so|_fini|||0x10930cc 0|35|libxul.so|_fini|||0x10b3dcf 0|36|firefox-bin|arena_t::arena_t(arena_params_s*)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3700|0x1 0|37|firefox-bin|AutoLock<Mutex>::~AutoLock()|hg:hg.mozilla.org/mozilla-central:memory/build/Mutex.h:f6df375b86987b2772067a61873ebfe3a98c353a|79|0x9 0|38|firefox-bin|arena_dalloc|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3524|0x8 0|39|libxul.so|mozilla::Vector<mozilla::BufferList<js::SystemAllocPolicy>::Segment, 1ul, js::SystemAllocPolicy>::~Vector()|hg:hg.mozilla.org/mozilla-central:mfbt/Vector.h:f6df375b86987b2772067a61873ebfe3a98c353a|927|0x8 0|40|libxul.so|JSStructuredCloneWriter::~JSStructuredCloneWriter()|hg:hg.mozilla.org/mozilla-central:mfbt/BufferList.h:f6df375b86987b2772067a61873ebfe3a98c353a|125|0x8 0|41|libxul.so|WriteStructuredClone(JSContext*, JS::Handle<JS::Value>, JSStructuredCloneData*, JS::StructuredCloneScope, JS::CloneDataPolicy, JSStructuredCloneCallbacks const*, void*, JS::Value const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/StructuredClone.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|646|0x8 0|42|libxul.so|_fini|||0x271b558 0|43|libxul.so|mozilla::Vector<JS::Value, 8ul, js::TempAllocPolicy>::begin()|hg:hg.mozilla.org/mozilla-central:mfbt/Vector.h:f6df375b86987b2772067a61873ebfe3a98c353a|522|0x1 0|44|||||0x7f5d8c525000 0|45|libxul.so|_fini|||0x271b558 0|46|libxul.so|mozilla::Vector<JS::Value, 8ul, js::TempAllocPolicy>::begin()|hg:hg.mozilla.org/mozilla-central:mfbt/Vector.h:f6df375b86987b2772067a61873ebfe3a98c353a|522|0x1 0|47|||||0x7f5d8c525000 0|48|libxul.so|mozilla::dom::Document_Binding::get_contentType|s3:gecko-generated-sources:1102b96ede98f292b18340cd25c8aa24de9da1fe139ae73c7fc848652d3a40e2270987d5d54604df868d57a761d2bacbb9b3cd6a13a75b6fccdf4ebe060e9c96/dom/bindings/DocumentBinding.cpp:|957|0x8 0|49|libxul.so|mozilla::Vector<jsid, 8ul, js::TempAllocPolicy>::begin()|hg:hg.mozilla.org/mozilla-central:mfbt/Vector.h:f6df375b86987b2772067a61873ebfe3a98c353a|522|0x1 0|50|||||0x7f5d8c525000 0|51|firefox-bin|RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::TreeNode::IsRed()|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:f6df375b86987b2772067a61873ebfe3a98c353a|197|0x5 0|52|firefox-bin|RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::Insert(RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::TreeNode)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:f6df375b86987b2772067a61873ebfe3a98c353a|405|0x5 0|53|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:f6df375b86987b2772067a61873ebfe3a98c353a|621|0xb 0|54|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/prtpd.c:f6df375b86987b2772067a61873ebfe3a98c353a|204|0x5 0|55|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:f6df375b86987b2772067a61873ebfe3a98c353a|621|0xb 0|56|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/prtpd.c:f6df375b86987b2772067a61873ebfe3a98c353a|204|0x5 0|57|libxul.so|AssertActivityIsLegal|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsTraceRefcnt.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|205|0x5 0|58|libxul.so|NS_LogRelease|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsTraceRefcnt.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|1021|0x5 0|59|libxul.so|_fini|||0xd13e6e 0|60|libxul.so|_fini|||0x381c8 0|61|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:f6df375b86987b2772067a61873ebfe3a98c353a|621|0xb 0|62|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:f6df375b86987b2772067a61873ebfe3a98c353a|621|0xb 0|63|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/prtpd.c:f6df375b86987b2772067a61873ebfe3a98c353a|204|0x5 0|64|libxul.so|AssertActivityIsLegal|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsTraceRefcnt.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|205|0x5 0|65|libxul.so|NS_LogRelease|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsTraceRefcnt.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|1021|0x5 0|66|libxul.so|_fini|||0xd0c077 0|67|libxul.so|base::MessagePumpLibevent::ScheduleWork()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_pump_libevent.cc:f6df375b86987b2772067a61873ebfe3a98c353a|404|0x10 0|68|libxul.so|base::MessagePump::Release()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_pump.h:f6df375b86987b2772067a61873ebfe3a98c353a|20|0x1a 0|69|libxul.so|MessageLoop::PostTask_Helper(already_AddRefed<nsIRunnable>, int)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.h:f6df375b86987b2772067a61873ebfe3a98c353a|300|0x8 0|70|libxul.so|_fini|||0xd13e6e 0|71|firefox-bin|BaseAllocator::malloc(unsigned long)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|4163|0xd 0|72|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:f6df375b86987b2772067a61873ebfe3a98c353a|621|0xb 0|73|libxul.so|mozilla::detail::VectorImpl<mozilla::ipc::MessageChannel::InterruptFrame, 0ul, mozilla::MallocAllocPolicy, false>::destroy(mozilla::ipc::MessageChannel::InterruptFrame*, mozilla::ipc::MessageChannel::InterruptFrame*)|hg:hg.mozilla.org/mozilla-central:mfbt/Vector.h:f6df375b86987b2772067a61873ebfe3a98c353a|74|0x5 0|74|libxul.so|mozilla::Vector<mozilla::ipc::MessageChannel::InterruptFrame, 0ul, mozilla::MallocAllocPolicy>::shrinkBy(unsigned long)|hg:hg.mozilla.org/mozilla-central:mfbt/Vector.h:f6df375b86987b2772067a61873ebfe3a98c353a|1132|0x8 0|75|libxul.so|mozilla::ipc::MessageChannel::ExitedCxxStack()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|2383|0xd 0|76|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:f6df375b86987b2772067a61873ebfe3a98c353a|621|0xb 0|77|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/prtpd.c:f6df375b86987b2772067a61873ebfe3a98c353a|204|0x5 0|78|libxul.so|mozilla::Vector<mozilla::BufferList<js::SystemAllocPolicy>::Segment, 1ul, js::SystemAllocPolicy>::clear()|hg:hg.mozilla.org/mozilla-central:mfbt/Vector.h:f6df375b86987b2772067a61873ebfe3a98c353a|1227|0x8 0|79|firefox-bin|RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::Insert(RedBlackTree<arena_chunk_t, ArenaDirtyChunkTrait>::TreeNode)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:f6df375b86987b2772067a61873ebfe3a98c353a|405|0x5 0|80|firefox-bin|RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::Insert(RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::TreeNode)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:f6df375b86987b2772067a61873ebfe3a98c353a|405|0x5 0|81|libxul.so|mozilla::dom::TabChild::DoSendAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, mozilla::dom::ipc::StructuredCloneData&, JS::Handle<JSObject*>, nsIPrincipal*)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3035|0x8 0|82|firefox-bin|arena_t::DallocRun(arena_run_t*, bool)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:f6df375b86987b2772067a61873ebfe3a98c353a|142|0x5 0|83|firefox-bin|AutoLock<Mutex>::~AutoLock()|hg:hg.mozilla.org/mozilla-central:memory/build/Mutex.h:f6df375b86987b2772067a61873ebfe3a98c353a|79|0x9 0|84|firefox-bin|arena_dalloc|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|3524|0x8 0|85|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:f6df375b86987b2772067a61873ebfe3a98c353a|621|0xb 0|86|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/prtpd.c:f6df375b86987b2772067a61873ebfe3a98c353a|204|0x5 0|87|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:f6df375b86987b2772067a61873ebfe3a98c353a|621|0xb 0|88|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/prtpd.c:f6df375b86987b2772067a61873ebfe3a98c353a|204|0x5 0|89|libxul.so|AssertActivityIsLegal|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsTraceRefcnt.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|205|0x5 0|90|libxul.so|NS_LogDtor|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsTraceRefcnt.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|1115|0x5 0|91|libxul.so|mozilla::dom::StructuredCloneHolder::~StructuredCloneHolder()|hg:hg.mozilla.org/mozilla-central:xpcom/ds/nsTArray.h:f6df375b86987b2772067a61873ebfe3a98c353a|2608|0x9 0|92|libxul.so|nsFrameMessageManager::DispatchAsyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, JS::Handle<JSObject*>, nsIPrincipal*, JS::Handle<JS::Value>, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsFrameMessageManager.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|617|0x8 0|93|libxul.so|_fini|||0x2961280 0|94|libxul.so|js::CheckThreadLocal::check() const|hg:hg.mozilla.org/mozilla-central:js/src/threading/ProtectedData.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|45|0x8 0|95|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:f6df375b86987b2772067a61873ebfe3a98c353a|621|0xb 0|96|libxul.so|nsAutoOwningThread::IsCurrentThread() const|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsISupportsImpl.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|53|0x8 0|97|libxul.so|_fini|||0x32d12 0|98|libxul.so|nsAutoOwningThread::AssertCurrentThreadOwnsMe(char const*) const|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsISupportsImpl.cpp:f6df375b86987b2772067a61873ebfe3a98c353a|44|0x5 0|99|libxul.so|mozilla::binding_danger::TErrorResult<mozilla::binding_danger::JustAssertCleanupPolicy>::~TErrorResult()|hg:hg.mozilla.org/mozilla-central:dom/bindings/ErrorResult.h:f6df375b86987b2772067a61873ebfe3a98c353a|140|0x8 0|100|libxul.so|mozilla::dom::ContentFrameMessageManager_Binding::sendAsyncMessage|s3:gecko-generated-sources:1ed55c0cd06a60f5383494f049d28e28177fae7136a9a4b62156edb0dbec3166d17ab023e34a4b36c1f59698d142a8a935e324d281bffcbb22e2ba33c3260777/dom/bindings/MessageManagerBinding.cpp:|2349|0xc 0|101|libxul.so|js::CurrentThreadCanAccessRuntime(JSRuntime const*)|hg:hg.mozilla.org/mozilla-central:mfbt/ThreadLocal.h:f6df375b86987b2772067a61873ebfe3a98c353a|177|0xf 0|102|libxul.so|_fini|||0x67068 0|103|libxul.so|_fini|||0x9dc38 0|104|libxul.so|void* mozilla::dom::UnwrapDOMObject<void>(JSObject*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.h:f6df375b86987b2772067a61873ebfe3a98c353a|142|0x5 0|105|libxul.so|nsresult mozilla::dom::binding_detail::UnwrapObjectInternal<void, true, void*, mozilla::dom::binding_detail::MutableObjectHandleWrapper>(mozilla::dom::binding_detail::MutableObjectHandleWrapper&, void*&, mozilla::dom::prototypes::id::ID, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.h:f6df375b86987b2772067a61873ebfe3a98c353a|243|0x8 0|106|libxul.so|_fini|||0x273ee78
Flags: in-testsuite?
Text-overflow seems to be running into an unexpected frame tree. Mats, any chance you could take a look at what's going on here?
Flags: needinfo?(mats)
Priority: -- → P3
Attached file Minimal testcase —
Here's the frame tree we create for this testcase: Block(body) Ruby(ruby) RubyBaseContainer(ruby) RubyBase(ruby) Inline(span) Block(span) nsTextControlFrame ... Inline(span) where "Block(span)" is "aFrame" in the assertion condition. At first glance, this seems like an invalid frame tree because children of RubyBase should have been Inlinified, per step 1 in: https://drafts.csswg.org/css-ruby-1/#box-fixup BTW, the frames for <span> above is an ib-split sequence.
Assignee: nobody → mats
Flags: needinfo?(mats)
Attached patch fix+tests (obsolete) — — Splinter Review
So the problem is that inlinification of layout-internal display values map to themselves so adjust_for_ruby() doesn't do anything. Then, since it's a <textarea>, we can't create table pseudos either, so we end up with a nsTextControlFrame with a 'table-header-group' inside an inline, which triggers the ib-split which wraps it in a ::-moz-block-inside-inline-wrapper which has 'display:block' which is invalid inside <rb>. A solution which I think could work is to simply use an anonymous wrapper that has 'display:inline-block' instead.
Attachment #9027252 - Flags: review?(emilio)
Comment on attachment 9027252 [details] [diff] [review] fix+tests Review of attachment 9027252 [details] [diff] [review]: ----------------------------------------------------------------- Yeah, I agree this looks reasonable, but I'm still somewhat fascinated us entering the ib-split code in the test-case... So (just double-checking here, so feel free to ignore), the issue is that a frame for a textarea (or any other frame that we don't honor display for really) with a table-internal display type is, effectively: IsBlockOutside() -> false IsInlineOutside() -> false StyleDisplay()->IsInnerTableStyle() -> true Yet it of course doesn't create any table wrappers, since it's not a table frame. It may be worth to inlinify table-internal display types Why do we split frames to find the first block using !IsInlineOutside() instead of IsBlockOutside()? That seems slightly suspicious, but we do it in a bunch of other places, and it looks like Blink and WebKit do the same thing, if I'm reading their code right... (Maybe we don't need to though). It's not clear to me what a table-internal display type on a textarea is even supposed to mean... Oh well. Also, looks like we do something slightly different for <svg:text>: https://searchfox.org/mozilla-central/rev/f997bd6bbfc4773e774fdb6cd010142370d186f9/layout/style/nsStyleStructInlines.h#105 For which we wouldn't end up creating an IB split in this case... Though I suspect you can't do something like stashing an <svg:foreignObject> with a <textarea> inside <svg:text>, can you? If so, it'd be nice to unify both codepaths... Why don't we need to check the new pseudo type in ComputeAndIncludeOutlineArea? https://searchfox.org/mozilla-central/rev/f997bd6bbfc4773e774fdb6cd010142370d186f9/layout/generic/nsFrame.cpp#9838 Maybe a static function like `nsCSSAnonBoxes::IsIBSplitWrapper(nsAtom*)` would make it a bit harder to mess up in the future? Not a big deal though. I'd like bz to sanity-check the approach here when he has the time, though feel free block landing this in the meantime, it's not a very invasive / complex patch anyway, and it seems consistent with what bug 1021952 introduced for tables. Thanks for digging through this! ::: layout/base/nsCSSFrameConstructor.cpp @@ +11665,5 @@ > + // If our parent is a ruby content box however, this is specced in > + // https://www.w3.org/TR/css-display-3/#inlinify > + // "Inlinification has no effect on layout-internal boxes. (However, > + // placement in such an inline context will typically cause them to be > + // wrapped in an appropriately-typed anonymous inline-level box.)" Maybe link to the draft instead of the TR version of the spec? https://drafts.csswg.org/css-display/#inlinify ::: layout/generic/nsInlineFrame.cpp @@ +958,5 @@ > > // The anonymous block's style inherits from ours, and we already have our new > // ComputedStyle. > + auto parentType = GetParent()->Type(); > + auto* pseudo = MOZ_UNLIKELY(RubyUtils::IsRubyContentBox(parentType)) ? Can we just do blockFrame->Style()->GetPseudo()? The SetComputedStyle call will assert if the condition is wrong anyway, but it seems worth to avoid duplicating the logic here.
Attachment #9027252 - Flags: review?(emilio) → review+
Boris (can't set a feedback request), mind checking out comment 4?
Flags: needinfo?(bzbarsky)
Comment on attachment 9027252 [details] [diff] [review] fix+tests Review of attachment 9027252 [details] [diff] [review]: ----------------------------------------------------------------- ::: layout/base/nsCSSFrameConstructor.cpp @@ +11667,5 @@ > + // "Inlinification has no effect on layout-internal boxes. (However, > + // placement in such an inline context will typically cause them to be > + // wrapped in an appropriately-typed anonymous inline-level box.)" > + auto parentType = aInitialInline->GetParent()->Type(); > + auto* pseudo = MOZ_UNLIKELY(RubyUtils::IsRubyContentBox(parentType)) ? I think you should check `aInitialInline->Style()->ShouldSuppressLineBreak()` instead, so that you don't need to rely on ruby utils, and the code doesn't need to be adjusted in the future if other stuff starts to require the same behavior (although I doubt whether there would be any). ::: layout/generic/nsInlineFrame.cpp @@ +958,5 @@ > > // The anonymous block's style inherits from ours, and we already have our new > // ComputedStyle. > + auto parentType = GetParent()->Type(); > + auto* pseudo = MOZ_UNLIKELY(RubyUtils::IsRubyContentBox(parentType)) ? Same here, I think you can just check `ShouldSuppressLineBreak`.
I would consider this as an edge case that we don't really need to care much about. Wrapping ib-split parts inside an inline-block for inlinified context sounds fine to me if it's the simplest approach. I think it's also fine to inlinify internal display types since why anyone would want to do that...
(In reply to Emilio Cobos Álvarez (:emilio) from comment #4) > Yeah, I agree this looks reasonable, but I'm still somewhat fascinated us > entering the ib-split code in the test-case... Normally, say for <rb><span><div style="display:table-header-group">, when we enter CreateNeededPseudoContainers for the <span>, aItems.AllWantParentType(ourParentType) is false: "ourParentType" is eTypeBlock but the desired type for the <div> is "eTypeTable", which comes from FCDATA_DESIRED_PARENT_TYPE_TO_BITS(eTypeTable) on "FCDATA_FOR_DISPLAY( StyleDisplay::TableColumnGroup". But for <textarea> etc we don't create frames based on 'display' really. We go through FindHTMLData instead. I guess we could add "DESIRED_PARENT_TYPE" bits there based on 'display' but we don't normally (as in non-Ruby) create table pseudos for such elements so I don't think we should introduce that here. e.g. data:text/html,<textarea style="display:table-header-group"> > IsBlockOutside() -> false > IsInlineOutside() -> false > StyleDisplay()->IsInnerTableStyle() -> true Correct. > It may be worth to inlinify table-internal display types There are no inline versions on the table-internal values though. I guess we could make it 'inline-table/block', but that would require spec changes... Then again, that seems to be what Chrome does... (the computed value is 'inline-block' in its devtools panel) and it does this for non-Ruby too, which makes us incompatible for things like: data:text/html,<span>A<input style="display:table-header-group">B It only does that for some (replaced?) elements though, data:text/html,<span>A<div style="display:table-header-group"></div>B computes to 'table-header-group'. Yikes... (Fwiw, Edge seems to follow the specs) > Why do we split frames to find the first block using !IsInlineOutside() > instead of IsBlockOutside()? I don't know. Let's see what breaks: https://treeherder.mozilla.org/#/jobs?repo=try&revision=00d95d7c15f5889d9891fdd6b275576a75e4111a Naively inlinifying table-internal values: https://treeherder.mozilla.org/#/jobs?repo=try&revision=abee278e173d56b16d724c39bc5448a881f02349 Both: https://treeherder.mozilla.org/#/jobs?repo=try&revision=d957da324953e3827b989aaea902472f97494ab6
So historically we used IsInlineOutside() here to make sure that anything inside an inline was really ok to have inside an inline. I think it would be ok to switch to treating table-internal display types as consistently not inducing ib splits. Per spec, this is how it should work, since per spec they should get wrapped in anon boxes ending up with an inline-table. We (and everyone else) just doesn't do that for replaced elements. In Blink and WebKit some replaced elements (e.g. input, textarea) effectively do this by forcing display to inline-block if it's table-internal. But others (e.g. img) don't do that and end up inducing ib splits...
Flags: needinfo?(bzbarsky)
For reference, https://mozilla.logbot.info/developers/20181126#c15655627 is the IRC conversation version of the above.
Attached patch fix v2+tests — — Splinter Review
Ah, good catch. There were a few more places I think we need to reverse the logic too. I'll try to make some DOM mutation tests tests for this too that would have caught the missing ones... https://treeherder.mozilla.org/#/jobs?repo=try&revision=b30ce30ca6a7021de9d3699fdc4e126fdbc3ae5e
Attachment #9027660 - Attachment is obsolete: true
Attachment #9027741 - Flags: review?(emilio)
I'm not sure if we should change mIsAllInline. It seems it's more for the definitely-inline-outside case: // Whether construction from this item will create only frames that are // IsInlineOutside() in the principal child list. This is not precise, but // conservative: if true the frames will really be inline, whereas if false // they might still all be inline. bool mIsAllInline:1; I haven't looked in detail how it's used though...
I expect the only use of mIsAllInline is for ib split stuff.
Comment on attachment 9027741 [details] [diff] [review] fix v2+tests Review of attachment 9027741 [details] [diff] [review]: ----------------------------------------------------------------- Thanks, looks good! I double-checked and the only types that are neither IsInlineOutside nor IsBlockOutside nor internal table parts are xul display types. Given those are not web-exposed nowadays I think this change is not really risky.
Attachment #9027741 - Flags: review?(emilio) → review+
Blocks: 1510299
I filed https://bugs.chromium.org/p/chromium/issues/detail?id=908853 about the wrong computed 'display' in Chrome. I filed bug 1510299 for a minor remaining layout issue for display:table-caption.
Flags: in-testsuite? → in-testsuite+
Pushed by mpalmgren@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/639b93112229 Only create an ib-split sequence for truly block-outside children. r=emilio
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/14269 for changes under testing/web-platform/tests
https://hg.mozilla.org/mozilla-central/rev/639b93112229
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox65: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: