1547391 - Assertion failure: isSingleInsert || frameType != LayoutFrameType::Details, at src/layout/base/nsCSSFrameConstructor.cpp:7089

Status: RESOLVED FIXED

(Core :: Layout: Columns, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Test case requires: layout.css.column-span.enabled=true

Assertion failure: isSingleInsert || frameType != LayoutFrameType::Details, at src/layout/base/nsCSSFrameConstructor.cpp:7089

eip = 0xce5eca35   esp = 0xd43fc160   ebp = 0xd43fc2d8   ebx = 0xd37e0dd4
esi = 0x00001bb1   edi = 0xd43fc1c8   eax = 0xd11a6891   ecx = 0xd48b217c
edx = 0x000000aa   efl = 0x00210286
OS|Android|0.0.0 Linux 4.4.124+ #1 SMP PREEMPT Sun Nov 4 14:31:25 UTC 2018 i686
CPU|x86|GenuineIntel family 6 model 6 stepping 3|4
GPU|||
Crash|SIGSEGV|0x0|13
13|0|libxul.so|nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsILayoutHistoryState*, nsCSSFrameConstructor::InsertionKind)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|0|0x8
13|1|libxul.so|mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|1451|0x20
13|2|libxul.so|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|3110|0x12
13|3|libxul.so|mozilla::RestyleManager::ProcessPendingRestyles()|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|3182|0xd
13|4|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|4145|0x18
13|5|libxul.so|nsIPresShell::FlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/nsIPresShell.h:ff3ec9547e4f15209af87010ed39a0590c253efe|532|0x18
13|6|libxul.so|mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|7354|0x23
13|7|libxul.so|mozilla::dom::Document::FlushPendingNotifications(mozilla::FlushType)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|7285|0x1d
13|8|libxul.so|mozilla::SMILAnimationController::DoSample(bool)|hg:hg.mozilla.org/mozilla-central:dom/smil/SMILAnimationController.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|400|0x1b
13|9|libxul.so|mozilla::SMILAnimationController::Resample()|hg:hg.mozilla.org/mozilla-central:dom/smil/SMILAnimationController.h:ff3ec9547e4f15209af87010ed39a0590c253efe|72|0x1e
13|10|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|4127|0x18
13|11|libxul.so|nsIPresShell::FlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/nsIPresShell.h:ff3ec9547e4f15209af87010ed39a0590c253efe|532|0x18
13|12|libxul.so|mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|7354|0x23
13|13|libxul.so|mozilla::dom::Document::FlushPendingNotifications(mozilla::FlushType)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|7285|0x1d
13|14|libxul.so|nsGenericHTMLElement::GetInnerText(mozilla::dom::DOMString&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/html/nsGenericHTMLElement.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|2681|0x10
13|15|libxul.so|mozilla::dom::HTMLElement_Binding::get_innerText(JSContext*, JS::Handle<JSObject*>, nsGenericHTMLElement*, JSJitGetterCallArgs)|s3:gecko-generated-sources:e6370ea65d7cb78a07179afa3e1e0afea681b80cca3e7fe5a000e9bbd54e3c745e05c0c6b5be1903634781be0a979efc34193e4af1d193d2b77935455e3056e4/dom/bindings/HTMLElementBinding.cpp:|327|0xd
13|16|libxul.so|bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|3049|0x23
13|17|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|443|0x16
13|18|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|535|0xd
13|19|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|590|0x17
13|20|libxul.so|js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|730|0x27
13|21|libxul.so|bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::Shape*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType)|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|2268|0x5c
13|22|libxul.so|bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType)|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|2517|0x13
13|23|libxul.so|<name omitted>|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|2554|0x13
13|24|libxul.so|js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/ObjectOperations-inl.h:ff3ec9547e4f15209af87010ed39a0590c253efe|124|0x77
13|25|libxul.so|js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|4487|0x3a
13|26|libxul.so|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|2767|0x41b
13|27|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|423|0x7
13|28|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|563|0xd
13|29|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|590|0x17
13|30|libxul.so|<name omitted>|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|606|0x7
13|31|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|2636|0x51
13|32|libxul.so|mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:07034a91c20d743b6b1cb0050fb45856e506111933106e79effdb8dcee60d394334ccec99923dca240d02a8a2423627e46882951c1689b39a2e7f0665bac7e9b/dom/bindings/EventHandlerBinding.cpp:|267|0x1f
13|33|libxul.so|void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:400f5854eaa0ecaed3e4b6de4ef056ff5ed59f33939cee029fcff1b03eeff195f4c1df1e3e5019f96bbe28beb9ac8b7f3c48e72df24fb254eded6e83edd51671/dist/include/mozilla/dom/EventHandlerBinding.h:|363|0x32
13|34|libxul.so|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|hg:hg.mozilla.org/mozilla-central:dom/events/JSEventHandler.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|205|0x4a
13|35|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|1045|0xc
13|36|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|1240|0x1f
13|37|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|349|0x18
13|38|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|551|0x18
13|39|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|1046|0x23
13|40|libxul.so|mozilla::(anonymous namespace)::AsyncTimeEventRunner::Run()|hg:hg.mozilla.org/mozilla-central:dom/smil/SMILTimedElement.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|97|0x1c
13|41|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|1180|0x16
13|42|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|486|0x11
13|43|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|88|0xd
13|44|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ff3ec9547e4f15209af87010ed39a0590c253efe|315|0x16
13|45|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ff3ec9547e4f15209af87010ed39a0590c253efe|290|0xb
13|46|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|137|0xe
13|47|libxul.so|nsAppStartup::Run()|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|270|0x18
13|48|libxul.so|XREMain::XRE_mainRun()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|4578|0x10
13|49|libxul.so|XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|4716|0x8
13|50|libxul.so|XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|4797|0xf
13|51|libxul.so|GeckoStart|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAndroidStartup.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|47|0xd
13|52|libxul.so|mozilla::BootstrapImpl::GeckoStart(_JNIEnv*, char**, int, mozilla::StaticXREAppData const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/Bootstrap.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|77|0x11
13|53|libmozglue.so|Java_org_mozilla_gecko_mozglue_GeckoLoader_nativeRun|hg:hg.mozilla.org/mozilla-central:mozglue/android/APKOpen.cpp:ff3ec9547e4f15209af87010ed39a0590c253efe|372|0x2a
13|54|libart.so||||0x634318

Comment 1

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

The test wants to insert a range of contents into multicol container. When the assertion happens, the multicol subtree looks like this.

ColumnSetWrapper(details)(1)@7f0477907ed8 parent=7f0477907d08 {0,0,60480,4200} vis-overflow=-30,0,60510,4200 [state=0080060008c00220] [content=7f0476eb68b0] [cs=7f047790df28]<
  line 7f0477908030: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x108] {0,0,60480,2280} vis-overflow=-30,0,60510,2280 scr-overflow=0,0,60480,2280 <
    ColumnSet(details)(1)@7f0477907f98 parent=7f0477907ed8 next=7f04779084c0 next-continuation=7f0477908690 {0,0,60480,2280} vis-overflow=-30,0,60510,2280 [state=0080100000000020] [content=7f0476eb68b0] [cs=7f047790e1f8:-moz-column-set]<
      Details(details)(1)@7f0477907e10 parent=7f0477907f98 next-continuation=7f04779085c8 {0,0,60480,2280} vis-overflow=-30,0,60510,2280 [state=0000100000100000] [content=7f0476eb68b0] [cs=7f047790e2e8:-moz-column-content]<
        line 7f0477908420: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x108] {0,0,60480,1140} <
          Block(summary)(-1)@7f0477908080 parent=7f0477907e10 next=7f04779082d0 {0,0,60480,1140} [state=0100100080100208] [content=7f0476eb6a60] [cs=7f047790e3d8]<
            line 7f0477908280: count=2 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x100] {0,0,4417,1140} <
              Bullet(_moz_generated_content_marker)(-1)@7f0477908138 parent=7f0477908080 next=7f04779081e8 {0,262,1027,638} [state=0100000000000040] [content=7f0476eb6af0] [cs=7f047790e5b8:marker]
              Text(0)"Details"@7f04779081e8 parent=7f0477908080 {1027,0,3390,1140} [state=00000000a0400000] [content=7f0476ebc600] [cs=7f047790e6a8:-moz-text] [run=7f0476eb6b80][0,7,T] 
            >
          >
        >
        line 7f0477908470: count=1 state=inline,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x100] {0,1140,690,1140} vis-overflow=-30,1140,1020,1140 scr-overflow=0,1140,690,1140 <
          Text(3)"\nA\n"@7f04779082d0 parent=7f0477907e10 {0,1140,690,1140} vis-overflow=-30,0,1020,1140 scr-overflow=0,0,690,1140 [state=00000000b0600000] [content=7f0476ebc180] [cs=7f047790e4c8:-moz-text] [run=7f0476ebcb00][0,3,T] 
        >
      >
    >
  >
  line 7f0477908728: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x108] {0,2280,60480,1920} <
    Block(details)(1)@7f04779084c0 parent=7f0477907ed8 next=7f0477908690 {0,2280,60480,1920} [state=0000100008d00200] [content=7f0476eb68b0] [cs=7f047790e888:-moz-column-span-wrapper]<
      line 7f0477908578: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x108] bm=960 {0,960,60480,0} <
        Block(menu)(4)@7f0477908368 parent=7f04779084c0 {0,960,60480,0} [state=0100160000d00200] [content=7f0476eb6940] [cs=7f0476bd9028]<
        >
      >
    >
  >
  line 7f0477908778: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x108] {0,4200,60480,0} <
    ColumnSet(details)(1)@7f0477908690 parent=7f0477907ed8 prev-continuation=7f0477907f98 {0,4200,60480,0} [state=0000100000000020] [content=7f0476eb68b0] [cs=7f047790e1f8:-moz-column-set]<
      Details(details)(1)@7f04779085c8 parent=7f0477908690 prev-continuation=7f0477907e10 {0,0,60480,0} [state=0000100000100200] [content=7f0476eb68b0] [cs=7f047790e2e8:-moz-column-content]<
      >
    >
  >
>

Because the ColumnSetWrapper already contains a column-span child, querying ColumnSetWrapperFrame::GetContentInsertionFrame() yield ColumnSetWrapper itself. Therefore, at [1], the insertion.mParent is ColumnSetWrapper(details)(1)@7f0477907ed8. But further down in nsCSSFrameConstructor::ContentRangeInserted(), a more granular insertion.mParent is going to modified by GetInsertionPrevSibling() [2], and it becomes Details(details)(1)@7f0477907e10.

In bug 1508762, we've added the support of column-span to multicol <details>, so it is legit for DetailsFrames to be -moz-column-content boxes. I think we should soften the assertion to allow a DetailsFrame with -moz-column-content pesudo when doing a range insertion.

[1] https://searchfox.org/mozilla-central/rev/928742d3ea30e0eb4a8622d260041564d81a8468/layout/base/nsCSSFrameConstructor.cpp#7026
[2] https://searchfox.org/mozilla-central/rev/928742d3ea30e0eb4a8622d260041564d81a8468/layout/base/nsCSSFrameConstructor.cpp#7053-7054

Comment 2

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

Attachment: Bug 1547391 - Add a crashtest for multicol <details> containing a column-span.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0c0766222909
Add a crashtest for multicol <details> containing a column-span. r=dbaron

Comment 4

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/0c0766222909

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.

Comment 6

[Julien Cristau [:jcristau]]

column-span is disabled by default.