nsColumnSetFrame's continuation is deleted due to bidi resolution
Categories
(Core :: Layout: Columns, defect, P3)
Tracking
()
Tracking | Status | |
---|---|---|
firefox67 | --- | fixed |
People
(Reporter: TYLin, Assigned: TYLin)
References
(Blocks 1 open bug)
Details
Attachments
(4 files)
Load the attached test case (modified from the test in bug 1516737). This needs bug 1516739 fixed, or it crashes immediately.
Expected result:
The page should render some text like "ltr".
Actual result:
The page is blank, and there are some warnings like
[2064, Main Thread] ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file /home/aethanyc/Projects/gecko-dev/layout/base/nsLayoutUtils.cpp, line 7480
[2064, Main Thread] ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'start == end || IsInLetterFrame(aSubtreeRoot)', file /home/aethanyc/Projects/gecko-dev/layout/base/nsLayoutUtils.cpp, line 7494
When loading the test by GECKO_FRAMECTOR_DEBUG_FLAGS=really-noisy-content-updates ./mach run
, I notice that the full frame tree was constructed correctly, but later the nsColumnSetFrame's continuation is somehow being deleted due to some bidi resolution.
Assignee | ||
Comment 1•6 years ago
•
|
||
The callstack shows that the nsColumnSetFrame (0x7f473c883698) after a -moz-column-span-wrapper is being converted from non-fluid continuation into a fluid continuation.
Assignee | ||
Updated•6 years ago
|
Assignee | ||
Comment 2•6 years ago
|
||
Calling nsBlockFrame::ResolveBidi() on ColumnSpanWrapperFrame may cause
nsColumnSetFrame's non-fluid continuations being converted into fluid
ones in JoinInlineAncestors().
Since ColumnSpanWrapperFrame can only have nsColumnSetFrame and
column-span wrappers kids, no need to perform bidi resolution. This
doesn't affect column contents because they'll inherit "unicode-bidi"
from ColumnSetWrapperFrame in ua.css.
Assignee | ||
Comment 3•6 years ago
|
||
When doing bidi resolution for column-content blocks, we may still
traverse the parent chain up in RemoveBidiContinuation, reach
nsColumnSetFrame, and accidentally convert nsColumnSetFrame's
continuation into fluid ones.
Depends on D17550
Updated•6 years ago
|
Comment 10•6 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/506261cc5d79
https://hg.mozilla.org/mozilla-central/rev/1617ad03a14e
Description
•