Closed Bug 1568001 Opened 9 months ago Closed 8 months ago

Assertion failure: found (not in child list), at src/layout/base/nsLayoutUtils.cpp:1465

Categories

(Core :: Layout: Columns, defect, P5)

defect

Tracking

()

RESOLVED FIXED
mozilla70
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- disabled
firefox68 --- disabled
firefox69 --- disabled
firefox70 --- fixed

People

(Reporter: tsmith, Assigned: TYLin)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(4 files)

Attached file testcase.html

Reduced with m-c:
BuildID=20190722093634
SourceStamp=db8f3ee41bdf525db2d0e5816d26ee654ab6ec7e

Assertion failure: found (not in child list), at src/layout/base/nsLayoutUtils.cpp:1465

#0 nsLayoutUtils::GetChildListNameFor(nsIFrame*) src/layout/base/nsLayoutUtils.cpp:1465:5
#1 nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) src/layout/base/nsCSSFrameConstructor.cpp:7691:17
#2 nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:8725:7
#3 mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) src/layout/base/RestyleManager.cpp:1558:25
#4 mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) src/layout/base/RestyleManager.cpp:3103:9
#5 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4188:39
#6 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1959:22
#7 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:327:7
#8 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:344:5
#9 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:710:16
#10 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:605:9
#11 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#12 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
#13 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:4821:32
#14 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2184:25
#15 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2108:9
#16 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1955:3
#17 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1986:13
#18 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1225:14
#19 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#20 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:110:5
#21 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#22 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#23 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#24 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:919:20
#25 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#26 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#27 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#28 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:754:34
#29 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#30 main src/browser/app/nsBrowserApp.cpp:267:18
Flags: in-testsuite?
Attached file reduced testcase

I have a reduced test case which demonstrates a wrong frame tree when column-span is enabled. It has height:0 and font-size:0, so almost all of the frames are overflow incomplete. We create a lot of next-in-flows, and put them in OverflowList, ExcessOverflowContainersList. It seems that we don't handle fragmentation for Canvas(html) in a continuous context.

I feel the original testcase is unlikely to happen in the real webpage, and it doesn't crash nightly. It also seems hard to fix given the analysis in comment 1, so make it P5.

Priority: -- → P5

This is fixed by bug 1420528. Mozregression finds this range
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a4c06043401d88a5c7b33277abfa794a10636e1c&tochange=a5d545e31781b28dfc37020e0b622377288d17bd

I'll add both the original test case and my reduced one as crashtests.

Assignee: nobody → aethanyc
Status: NEW → ASSIGNED
Depends on: 1420528
Status: ASSIGNED → RESOLVED
Closed: 8 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70
You need to log in before you can comment on or make changes to this bug.