nsColumnSetFrame's continuation is deleted due to bidi resolution

RESOLVED FIXED in Firefox 67

Status

()

defect
P3
normal
RESOLVED FIXED
6 months ago
5 months ago

People

(Reporter: TYLin, Assigned: TYLin)

Tracking

(Blocks 1 bug)

unspecified
mozilla67
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox67 fixed)

Details

Attachments

(4 attachments)

Load the attached test case (modified from the test in bug 1516737). This needs bug 1516739 fixed, or it crashes immediately.

Expected result:
The page should render some text like "ltr".

Actual result:
The page is blank, and there are some warnings like

[2064, Main Thread] ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file /home/aethanyc/Projects/gecko-dev/layout/base/nsLayoutUtils.cpp, line 7480
[2064, Main Thread] ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file /home/aethanyc/Projects/gecko-dev/layout/base/nsLayoutUtils.cpp, line 7494

When loading the test by GECKO_FRAMECTOR_DEBUG_FLAGS=really-noisy-content-updates ./mach run, I notice that the full frame tree was constructed correctly, but later the nsColumnSetFrame's continuation is somehow being deleted due to some bidi resolution.

The callstack shows that the nsColumnSetFrame (0x7f473c883698) after a -moz-column-span-wrapper is being converted from non-fluid continuation into a fluid continuation.

Assignee: nobody → aethanyc
Status: NEW → ASSIGNED

Calling nsBlockFrame::ResolveBidi() on ColumnSpanWrapperFrame may cause
nsColumnSetFrame's non-fluid continuations being converted into fluid
ones in JoinInlineAncestors().

Since ColumnSpanWrapperFrame can only have nsColumnSetFrame and
column-span wrappers kids, no need to perform bidi resolution. This
doesn't affect column contents because they'll inherit "unicode-bidi"
from ColumnSetWrapperFrame in ua.css.

When doing bidi resolution for column-content blocks, we may still
traverse the parent chain up in RemoveBidiContinuation, reach
nsColumnSetFrame, and accidentally convert nsColumnSetFrame's
continuation into fluid ones.

Depends on D17550

Duplicate of this bug: 1516301
Duplicate of this bug: 1516920
Duplicate of this bug: 1516794
Duplicate of this bug: 1517299
Duplicate of this bug: 1517310
Blocks: 1524431
Attachment #9038931 - Attachment description: Bug 1520722 Part 2 - When removing bidi continuations, go no further beyond the block which needs resolution. → Bug 1520722 Part 2 - When removing bidi continuations, go no further than the block which needs resolution.
Pushed by aethanyc@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/506261cc5d79
Part 1 - Remove NS_BLOCK_NEEDS_BIDI_RESOLUTION flag from ColumnSpanWrapperFrame. r=dbaron
https://hg.mozilla.org/integration/autoland/rev/1617ad03a14e
Part 2 - When removing bidi continuations, go no further than the block which needs resolution. r=dbaron
Status: ASSIGNED → RESOLVED
Closed: 6 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/15223 for changes under testing/web-platform/tests
Duplicate of this bug: 1516606
You need to log in before you can comment on or make changes to this bug.