1507196 - Assertion failure: columnSet && columnSet->IsColumnSetFrame() (The first child should always be ColumnSet!), at /builds/worker/workspace/build/src/layout/generic/ColumnSetWrapperFrame.cpp:73

Status: RESOLVED FIXED

(Core :: Layout: Columns, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 073045259e75.

Assertion failure: columnSet && columnSet->IsColumnSetFrame() (The first child should always be ColumnSet!), at /builds/worker/workspace/build/src/layout/generic/ColumnSetWrapperFrame.cpp:73

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007ffd52fa2320
rsi = 0x00007fac603558b0   rdi = 0x00007fac60354680
rbp = 0x00007ffd52fa2310   rsp = 0x00007ffd52fa2300
r8 = 0x00007fac603558b0    r9 = 0x00007fac614c6740
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x0000000000000000   r13 = 0x00007ffd52fa2448
r14 = 0x0000000000000000   r15 = 0x00007ffd52fa2401
rip = 0x00007fac50927dd0
OS|Linux|0.0.0 Linux 4.15.0-38-generic #41-Ubuntu SMP Wed Oct 10 10:59:38 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|mozilla::ColumnSetWrapperFrame::AppendDirectlyOwnedAnonBoxes(nsTArray<nsIFrame::OwnedAnonBox>&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ColumnSetWrapperFrame.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|72|0x1c
0|1|libxul.so|nsIFrame::DoUpdateStyleOfOwnedAnonBoxes(mozilla::ServoRestyleState&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|11256|0x6
0|2|libxul.so|mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ComputedStyle*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsIFrame.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3360|0xf
0|3|libxul.so|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3063|0xf
0|4|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4359|0x19
0|5|libxul.so|nsIDocument::FlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/nsIPresShell.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|591|0xf
0|6|libxul.so|nsIDocument::FlushPendingNotifications(mozilla::FlushType)|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|7754|0x7
0|7|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|694|0x10
0|8|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|630|0x16
0|9|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|630|0x1f
0|10|libxul.so|nsIDocument::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|8517|0x20
0|11|libxul.so|nsDocument::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|8439|0x8
0|12|libxul.so|nsIDocument::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5332|0x11
0|13|libxul.so|mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1191|0x13
0|14|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|337|0x15
0|15|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1244|0x11
0|16|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|530|0x11
0|17|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|97|0xa
0|18|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|325|0x17
0|19|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0x8
0|20|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|158|0xd
0|21|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|954|0x11
0|22|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|269|0x5
0|23|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|325|0x17
0|24|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0x8
0|25|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|780|0x8
0|26|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|50|0x14
0|27|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|287|0x11
0|28|libc-2.27.so||||0x21b97
0|29|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|164|0x5

Comment 1

[Emilio Cobos Álvarez (:emilio)]

I don't think this is P2 since it only repros with column-span enabled, and that's disabled by default.

Let me know if you disagree mats :)

Comment 2

[Maire Reavy [:mreavy]]

65 is unaffected.  (We do want to fix this before column-span rides the trains.)

Comment 3

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

When loading the test case in comment 0, we got an frame subtree looks this.

ColumnSetWrapper(c)(3)@7fd12924f078 parent=7fd12924e9c0 {3558420,1256790,0,180} [state=0080060102d00320] [content=7fd1292563a0] [cs=7fd1290e9d08]<
  Overflow-lines 0x7fd129255680/0x7fd129255690 <
    line 7fd12924f1c0: count=1 state=block,dirty,prevmargindirty,not impacted,not wrapped,before:nobr,after:nobr[0xb] {0,0,0,0} <
      ColumnSet(c)(3)@7fd12924f130 parent=7fd12924f078 {0,180,0,0} [state=0080100000000400] [content=7fd1292563a0] [cs=7fd1290e9a08:-moz-column-set]<
        Block(c)(3)@7fd12924efc8 parent=7fd12924f130 {0,0,1,0} [state=0000100000d00400] [content=7fd1292563a0] [cs=7fd1290e9b08:-moz-column-content]<
        >
      >
    >
  >
>

So it's possible that all of the ColumnSetWrapperFrame's child frames can be pushed to overflow-lines, resulting an empty principal child list. Maybe we shouldn't assume there'll always be a ColumnSetFrame as the first child.

Comment 4

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1507196 - Find first ColumnSetFrame in the child lists of ColumnSetWrapperFrame (and it's continuations).

ColumnSetFrame is always created by
nsCSSFrameConstructor::BeginBuildingColumns(). If it is not in the
principal child list, it must be pushed to overflow list.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8bfea6ef25e4
Find first ColumnSetFrame in the child lists of ColumnSetWrapperFrame (and it's continuations). r=dbaron

Comment 6

[Eliza Balazs [:ebalazs_]]

https://hg.mozilla.org/mozilla-central/rev/8bfea6ef25e4