1517297 - Assertion failure: mOwner == ExpectedOwnerForChild(aFrame) (Missed some frame in the hierarchy?), at /builds/worker/workspace/build/src/layout/base/RestyleManager.cpp:2017

Status: RESOLVED FIXED

(Core :: Layout: Columns, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 5826b2352ac0.

Assertion failure: mOwner == ExpectedOwnerForChild(aFrame) (Missed some frame in the hierarchy?), at /builds/worker/workspace/build/src/layout/base/RestyleManager.cpp:2017

We currently don't have symbolized debug builds so no stack trace is available at this time.

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Has column-span -> Over to layout: columns.

Comment 2

[Jonathan Watt [:jwatt]]

Tentatively P3, since we haven't shipped column-span yet.

Comment 3

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

A column-span element in multicol subtree should not go into this path because we have a specialized logic for it in RestyleManager::ProcessPostTraversal() [1].

When the assertion happens,

(rr) p aFrame
$1 = (const nsGridContainerFrame *) 0x7f383c9e9240
(rr) p aFrame->IsColumnSpan()
$2 = true
(rr) p aFrame->IsColumnSpanInMulticolSubtree()
$3 = false

That's because after bug 1507244 is landed, only block and inline frames can have NS_FRAME_HAS_MULTI_COLUMN_ANCESTOR. We need a new notion for IsColumnSpanInMulticolSubtree().

[1] https://searchfox.org/mozilla-central/source/layout/base/RestyleManager.cpp#2590-2591,2621-2624

Comment 4

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1517297 - Fix nsIFrame::IsColumnSpanInMulticolSubtree().

After Bug 1507244 Part 2, only block and inline frames can have
NS_FRAME_HAS_MULTI_COLUMN_ANCESTOR bit set. We need another notion for
IsColumnSpanInMulticolSubtree().

Under multi-column formatting context, every frame having a
column-span:all style will be wrapped by a -moz-column-span-wrapper
frame. We can use this to check whether other types of frames such as
nsGridContainerFrame having column-span:all style are really in a
multi-column subtree.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/763f3f9bc7c3
Fix nsIFrame::IsColumnSpanInMulticolSubtree(). r=emilio

Comment 6

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/763f3f9bc7c3