1568001 - Assertion failure: found (not in child list), at src/layout/base/nsLayoutUtils.cpp:1465

Status: RESOLVED FIXED

(Core :: Layout: Columns, defect, P5)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20190722093634
SourceStamp=db8f3ee41bdf525db2d0e5816d26ee654ab6ec7e

Assertion failure: found (not in child list), at src/layout/base/nsLayoutUtils.cpp:1465

#0 nsLayoutUtils::GetChildListNameFor(nsIFrame*) src/layout/base/nsLayoutUtils.cpp:1465:5
#1 nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) src/layout/base/nsCSSFrameConstructor.cpp:7691:17
#2 nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:8725:7
#3 mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) src/layout/base/RestyleManager.cpp:1558:25
#4 mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) src/layout/base/RestyleManager.cpp:3103:9
#5 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4188:39
#6 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1959:22
#7 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:327:7
#8 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:344:5
#9 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:710:16
#10 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:605:9
#11 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#12 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
#13 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:4821:32
#14 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2184:25
#15 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2108:9
#16 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1955:3
#17 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1986:13
#18 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1225:14
#19 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#20 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:110:5
#21 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#22 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#23 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#24 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:919:20
#25 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#26 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#27 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#28 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:754:34
#29 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#30 main src/browser/app/nsBrowserApp.cpp:267:18

Comment 1

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: reduced testcase

I have a reduced test case which demonstrates a wrong frame tree when column-span is enabled. It has height:0 and font-size:0, so almost all of the frames are overflow incomplete. We create a lot of next-in-flows, and put them in OverflowList, ExcessOverflowContainersList. It seems that we don't handle fragmentation for Canvas(html) in a continuous context.

Comment 2

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Sample frame tree of the reduced testcase

Comment 3

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

I feel the original testcase is unlikely to happen in the real webpage, and it doesn't crash nightly. It also seems hard to fix given the analysis in comment 1, so make it P5.

Comment 4

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

This is fixed by bug 1420528. Mozregression finds this range
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a4c06043401d88a5c7b33277abfa794a10636e1c&tochange=a5d545e31781b28dfc37020e0b622377288d17bd

I'll add both the original test case and my reduced one as crashtests.

Comment 5

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1568001 - Add crashtests fixed by bug 1420528.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a8646f9a5ab1
Add crashtests fixed by bug 1420528. r=dbaron

Comment 7

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/a8646f9a5ab1