1507244 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: How did this produce an nsTableRowGroupFrame?), at /builds/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:3073

Status: RESOLVED FIXED

(Core :: Layout: Columns, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 073045259e75.

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: How did this produce an nsTableRowGroupFrame?), at /builds/worker/workspace/build/src/layout/tables/nsTableFrame.cpp:3073

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007fb4218612c8
rsi = 0x00007fb4518bc8b0   rdi = 0x00007fb4518bb680
rbp = 0x00007ffe8f679330   rsp = 0x00007ffe8f6792e0
r8 = 0x00007fb4518bc8b0    r9 = 0x00007fb452a2d740
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007ffe8f6793a0   r13 = 0x00007ffe8f6792f8
r14 = 0x0000000000000000   r15 = 0x0000000000000000
rip = 0x00007fb441f30183
OS|Linux|0.0.0 Linux 4.15.0-38-generic #41-Ubuntu SMP Wed Oct 10 10:59:38 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|nsTableFrame::OrderRowGroups(AutoTArray<nsTableRowGroupFrame*, 8ul>&, nsTableRowGroupFrame**, nsTableRowGroupFrame**) const|hg:hg.mozilla.org/mozilla-central:layout/tables/nsTableFrame.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3073|0x18
0|1|libxul.so|nsTableFrame::InsertRowGroups(nsFrameList::Slice const&)|hg:hg.mozilla.org/mozilla-central:layout/tables/nsTableFrame.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1116|0xf
0|2|libxul.so|nsTableFrame::SetInitialChildList(mozilla::layout::FrameChildListID, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/tables/nsTableFrame.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|347|0x5
0|3|libxul.so|nsCSSFrameConstructor::ConstructTable(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|2180|0x15
0|4|libxul.so|nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3855|0x24
0|5|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|6002|0x16
0|6|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameItems&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|10034|0x16
0|7|libxul.so|nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|10209|0x23
0|8|libxul.so|nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameItems&, nsIFrame*, PendingBinding*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|11192|0x5
0|9|libxul.so|nsCSSFrameConstructor::ConstructNonScrollableBlockWithConstructor(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&, nsBlockFrame* (*)(nsIPresShell*, mozilla::ComputedStyle*))|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4825|0x2d
0|10|libxul.so|nsCSSFrameConstructor::ConstructNonScrollableBlock(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4786|0xa
0|11|libxul.so|nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3855|0x24
0|12|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|6002|0x16
0|13|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameItems&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|10034|0x16
0|14|libxul.so|nsCSSFrameConstructor::ContentAppended(nsIContent*, nsCSSFrameConstructor::InsertionKind)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|7200|0x2e
0|15|libxul.so|mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1445|0xe
0|16|libxul.so|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|3080|0xb
0|17|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4359|0x19
0|18|libxul.so|nsRefreshDriver::Tick(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1907|0x5
0|19|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|326|0x8
0|20|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0xc
0|21|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|760|0xc
0|22|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run()|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|514|0x11
0|23|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|1244|0x11
0|24|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|530|0x11
0|25|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|97|0xa
0|26|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|325|0x17
0|27|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|318|0x8
0|28|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|158|0xd
0|29|libxul.so|nsAppStartup::Run()|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|290|0xe
0|30|libxul.so|XREMain::XRE_mainRun()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4789|0x11
0|31|libxul.so|XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|4934|0x8
0|32|libxul.so|XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|5026|0x5
0|33|firefox-bin|do_main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|233|0x22
0|34|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|315|0xd
0|35|libc-2.27.so||||0x21b97
0|36|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:073045259e75e0c8f7b8ffcd5e4bf72570f98f3e|164|0x5

Comment 1

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1507244 Part 1 - Add block formatting context bits for column-span in nsBlockFrame::Init().

That's the common place where the bits are added.

Comment 2

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1507244 Part 2 - Suppress column-span descendants under a new block formatting context.

Bug 1506163 fixed only part of the issue. There are more types of frames
such as table, grid, flex, etc. that create their own block formatting
context. We need to clear NS_FRAME_HAS_MULTI_COLUMN_ANCESTOR for
children of these frames.

I use the following page as a reference for things that create block
formatting context.
https://developer.mozilla.org/en-US/docs/Web/Guide/CSS/Block_formatting_context

Depends on D13596

Comment 3

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1507244 Part 2 - Suppress column-span descendants under a new block formatting context.

Bug 1506163 fixed only part of the issue. There are more types of frames
such as table, grid, flex, etc. that create their own block formatting
context.

Instead of propagating NS_FRAME_HAS_MULTI_COLUMN_ANCESTOR to the
children, we explicit carry the bit over to block and inline frames by
checking that their parent doesn't suppress column-span descendants.

Comment 4

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1507244 Part 2 - Suppress column-span descendants under a new block formatting context.

Bug 1506163 fixed only part of the issue. There are more types of frames
such as table, grid, flex, etc. that create their own block formatting
context.

Instead of propagating NS_FRAME_HAS_MULTI_COLUMN_ANCESTOR to the
children, we explicit carry the bit over to block and inline frames by
checking that their parent doesn't suppress column-span descendants.

Depends on D13596

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8175b21ed05c
Part 1 - Add block formatting context bits for column-span in nsBlockFrame::Init(). r=dbaron
https://hg.mozilla.org/integration/autoland/rev/500edf52a5f5
Part 2 - Suppress column-span descendants under a new block formatting context. r=dbaron

Comment 6

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/14595 for changes under testing/web-platform/tests

Comment 7

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Can't merge web-platform-tests PR due to failing upstream checks:
Github PR https://github.com/web-platform-tests/wpt/pull/14595
* Taskcluster (pull_request) (https://tools.taskcluster.net/task-group-inspector/#/HrD47ngdQVefGW8SgwvflQ)

Comment 8

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/8175b21ed05c
https://hg.mozilla.org/mozilla-central/rev/500edf52a5f5

Comment 9

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Can't merge web-platform-tests PR due to failing upstream checks:
Github PR https://github.com/web-platform-tests/wpt/pull/14595
* Taskcluster (pull_request) (https://tools.taskcluster.net/task-group-inspector/#/HZZ2qAlbSEWMcnfCb7HhAw)

Comment 10

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

I checked why the upstream test fails. By looking at multicol-span-all-004.html failure snapshot images between (TEST) and (REFERENCE), the color of the scrollbar is different sometimes.

https://tools.taskcluster.net/groups/HZZ2qAlbSEWMcnfCb7HhAw/tasks/eBebDL78Tf2baJ7CzmgBeQ/runs/0/logs/public%2Flogs%2Flive.log

Comment 11

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

James, I feel viewport scrollbar color shouldn't contribute to reftest failures. Do you suggest I tweak the test case to let it pass on upstream? Or it's an known infra issue?

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9d1e902ac9e3
followup - Change the width of #column to 500px. r=me

Comment 13

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

The followup commit in comment 12 should fix the stability issue in upstream.

Comment 14

[James Graham [:jgraham]]

I think we previously decided that scrollbars need to show in the screenshots because sometimes we are testing that scrollbars are present when they are expected to be, etc.

Given that I think they have to match.

In this case it looks like there might be an infra problem with the scrollbar fading in or something, but unless the test particuarly depends on overflow it seems better to adjust the width so that everything fits into the 600x600 viewport.

Comment 15

[Eliza Balazs [:ebalazs_]]

https://hg.mozilla.org/mozilla-central/rev/9d1e902ac9e3

Comment 16

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged