1571897 - Assertion failure: childReflowStatus.IsComplete() (We gave flex item unconstrained available height, so it should be complete), at src/layout/generic/nsFlexContainerFrame.cpp:1815

Status: RESOLVED FIXED

(Core :: Layout: Columns, defect, P5)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

First found by fuzzers with m-c: 20190621-99f1b315fa89

Assertion failure: childReflowStatus.IsComplete() (We gave flex item unconstrained available height, so it should be complete), at /builds/worker/workspace/build/src/layout/generic/nsFlexContainerFrame.cpp:1815

13|0|libxul.so|nsFlexContainerFrame::MeasureAscentAndBSizeForFlexItem(nsFlexContainerFrame::FlexItem&, nsPresContext*, mozilla::ReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|1813|0x2b
13|1|libxul.so|nsFlexContainerFrame::SizeItemInCrossAxis(nsPresContext*, nsFlexContainerFrame::FlexboxAxisTracker const&, mozilla::ReflowInput&, nsFlexContainerFrame::FlexItem&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|4192|0x9
13|2|libxul.so|nsFlexContainerFrame::DoFlexLayout(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, int, int, nsTArray<nsFlexContainerFrame::StrutInfo>&, nsFlexContainerFrame::FlexboxAxisTracker const&, int, int, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|4743|0x21
13|3|libxul.so|nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|4355|0x2d
13|4|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.cpp:dba2c8019074a017293f708cec0292607c2e803c|877|0x40
13|5|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|4329|0x19
13|6|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|4131|0x3b
13|7|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|4016|0x6d
13|8|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|3003|0x2a
13|9|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|2543|0x39
13|10|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|1283|0x12
13|11|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:dba2c8019074a017293f708cec0292607c2e803c|297|0x2c
13|12|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|3647|0x5b
13|13|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|3000|0x2a
13|14|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|2543|0x39
13|15|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|1283|0x12
13|16|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:dba2c8019074a017293f708cec0292607c2e803c|297|0x2c
13|17|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|3647|0x5b
13|18|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|3000|0x2a
13|19|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|2543|0x39
13|20|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|1283|0x12
13|21|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|895|0x14
13|22|libxul.so|nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|731|0x4d
13|23|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|895|0x14
13|24|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|628|0x31
13|25|libxul.so|nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|741|0x1a
13|26|libxul.so|nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|1143|0x16
13|27|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|934|0x12
13|28|libxul.so|mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:dba2c8019074a017293f708cec0292607c2e803c|309|0x3f
13|29|libxul.so|mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:dba2c8019074a017293f708cec0292607c2e803c|9294|0x34
13|30|libxul.so|mozilla::PresShell::ProcessReflowCommands(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:dba2c8019074a017293f708cec0292607c2e803c|9464|0x1d
13|31|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:dba2c8019074a017293f708cec0292607c2e803c|4231|0x1e
13|32|libxul.so|mozilla::PresShell::FlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.h:dba2c8019074a017293f708cec0292607c2e803c|1468|0x18
13|33|libxul.so|mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:dba2c8019074a017293f708cec0292607c2e803c|10048|0x23
13|34|libxul.so|mozilla::dom::Document::FlushPendingNotifications(mozilla::FlushType)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:dba2c8019074a017293f708cec0292607c2e803c|9978|0x1d
13|35|libxul.so|nsIContent::GetPrimaryFrame(mozilla::FlushType)|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:dba2c8019074a017293f708cec0292607c2e803c|233|0xf
13|36|libxul.so|mozilla::dom::Element::GetScrollFrame(nsIFrame**, mozilla::FlushType)|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:dba2c8019074a017293f708cec0292607c2e803c|663|0xc
13|37|libxul.so|mozilla::dom::Element::GetClientAreaRect()|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:dba2c8019074a017293f708cec0292607c2e803c|985|0x14
13|38|libxul.so|mozilla::dom::Element::ClientWidth()|hg:hg.mozilla.org/mozilla-central:dom/base/Element.h:dba2c8019074a017293f708cec0292607c2e803c|1273|0xf
13|39|libxul.so|mozilla::dom::Element_Binding::get_clientWidth(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Element*, JSJitGetterCallArgs)|s3:gecko-generated-sources:65ec516414d9361511041ce5a14c584266db2b8a604260ec8ec4838f84c229608729e34ce09add6369e418fca7338e2dc123a02fe48160475bd65eaec4a0c730/dom/bindings/ElementBinding.cpp:|3633|0x9
13|40|libxul.so|bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:dba2c8019074a017293f708cec0292607c2e803c|3059|0x23
13|41|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|448|0x16
13|42|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|540|0xd
13|43|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|595|0x17
13|44|libxul.so|js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|735|0x27
13|45|libxul.so|bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::Shape*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType)|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:dba2c8019074a017293f708cec0292607c2e803c|2321|0x5c
13|46|libxul.so|bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType)|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:dba2c8019074a017293f708cec0292607c2e803c|2570|0x13
13|47|libxul.so|<name omitted>|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:dba2c8019074a017293f708cec0292607c2e803c|2607|0x13
13|48|libxul.so|js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/ObjectOperations-inl.h:dba2c8019074a017293f708cec0292607c2e803c|124|0x77
13|49|libxul.so|js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|4513|0x3a
13|50|libxul.so|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|2771|0x428
13|51|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|425|0x7
13|52|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|568|0xd
13|53|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|595|0x17
13|54|libxul.so|<name omitted>|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:dba2c8019074a017293f708cec0292607c2e803c|611|0x7
13|55|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:dba2c8019074a017293f708cec0292607c2e803c|2659|0x51
13|56|libxul.so|mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:07034a91c20d743b6b1cb0050fb45856e506111933106e79effdb8dcee60d394334ccec99923dca240d02a8a2423627e46882951c1689b39a2e7f0665bac7e9b/dom/bindings/EventHandlerBinding.cpp:|267|0x24
13|57|libxul.so|void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:400f5854eaa0ecaed3e4b6de4ef056ff5ed59f33939cee029fcff1b03eeff195f4c1df1e3e5019f96bbe28beb9ac8b7f3c48e72df24fb254eded6e83edd51671/dist/include/mozilla/dom/EventHandlerBinding.h:|363|0x34
13|58|libxul.so|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|hg:hg.mozilla.org/mozilla-central:dom/events/JSEventHandler.cpp:dba2c8019074a017293f708cec0292607c2e803c|205|0x50
13|59|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:dba2c8019074a017293f708cec0292607c2e803c|1031|0xc
13|60|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:dba2c8019074a017293f708cec0292607c2e803c|1223|0x1c
13|61|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:dba2c8019074a017293f708cec0292607c2e803c|349|0x18
13|62|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:dba2c8019074a017293f708cec0292607c2e803c|551|0x18
13|63|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:dba2c8019074a017293f708cec0292607c2e803c|1047|0x23
13|64|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:dba2c8019074a017293f708cec0292607c2e803c|0|0xb
13|65|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:dba2c8019074a017293f708cec0292607c2e803c|1061|0x1f
13|66|libxul.so|nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:dba2c8019074a017293f708cec0292607c2e803c|3990|0x2a
13|67|libxul.so|nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:dba2c8019074a017293f708cec0292607c2e803c|3960|0x1c
13|68|libxul.so|mozilla::dom::HTMLMediaElement::DispatchEvent(nsTSubstring<char16_t> const&)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:dba2c8019074a017293f708cec0292607c2e803c|5874|0x16
13|69|libxul.so|mozilla::dom::HTMLMediaElement::nsAsyncEventRunner::Run()|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:dba2c8019074a017293f708cec0292607c2e803c|286|0x1a
13|70|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:dba2c8019074a017293f708cec0292607c2e803c|1224|0x16
13|71|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:dba2c8019074a017293f708cec0292607c2e803c|486|0x11
13|72|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:dba2c8019074a017293f708cec0292607c2e803c|88|0xd
13|73|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:dba2c8019074a017293f708cec0292607c2e803c|315|0x16
13|74|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:dba2c8019074a017293f708cec0292607c2e803c|290|0xb
13|75|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:dba2c8019074a017293f708cec0292607c2e803c|137|0xe
13|76|libxul.so|nsAppStartup::Run()|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:dba2c8019074a017293f708cec0292607c2e803c|276|0x18
13|77|libxul.so|XREMain::XRE_mainRun()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:dba2c8019074a017293f708cec0292607c2e803c|4631|0x10
13|78|libxul.so|XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:dba2c8019074a017293f708cec0292607c2e803c|4766|0x8
13|79|libxul.so|XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:dba2c8019074a017293f708cec0292607c2e803c|4847|0xf
13|80|libxul.so|GeckoStart|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAndroidStartup.cpp:dba2c8019074a017293f708cec0292607c2e803c|47|0xd
13|81|libxul.so|mozilla::BootstrapImpl::GeckoStart(_JNIEnv*, char**, int, mozilla::StaticXREAppData const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/Bootstrap.cpp:dba2c8019074a017293f708cec0292607c2e803c|77|0x11
13|82|libmozglue.so|Java_org_mozilla_gecko_mozglue_GeckoLoader_nativeRun|hg:hg.mozilla.org/mozilla-central:mozglue/android/APKOpen.cpp:dba2c8019074a017293f708cec0292607c2e803c|372|0x2a
13|83|libart.so||||0x634318

Comment 1

[Daniel Holbert [:dholbert]]

I'm guessing this is a case where we've got a multicol thing as our flex item, and it has 0px-wide columns, and it's reporting that it's incomplete after we reflow it. I'm guessing it gets confused when trying to put its descendants into columns (since its columns are 0px wide, which means stuff doesn't fit, or something...?)

We have an expectation/invariant that all frames should return a "complete" status (possibly with some overflow), if their container reflows them with unconstrained BSize (from the perspective of the container's writing-mode). So I suspect this is a bug in our column-reflow code.

Comment 2

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

We have an expectation/invariant that all frames should return a "complete" status (possibly with some overflow), if their container reflows them with unconstrained BSize (from the perspective of the container's writing-mode). So I suspect this is a bug in our column-reflow code.

When enabling column-span, the outermost column container becomes ColumnSetWrapperFrame, it is very likely that column-reflow code needs to be changed to handle overflow edge cases under constrained BSize.

Comment 3

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

In comment 0, the test case can trigger the assertion on m-c version 20190621, but I can't reproduce this with my own local debug build on lastest m-c (with column-span enabled).

Tyson, could you confirm it is still reproducible, please?

Comment 4

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Per private IRC conversion with Tyson, this can be reproduced only on Android.

Comment 5

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

I add the test as a crashtest, and push to try to see if I can reproduce it on Android. It turns out it didn't trigger any assertion on Android platforms.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=3e19004c28548395c79cde954f72a4f8fc52544c

This could be fixed by any of the recent column-span bugs of mine. Since it's harder to find the exact bug that fixed this for Android by using mozregression, I'll just add the crashtest.

Comment 6

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1571897 - Add a crashtest.

According to the bug, this happens only on Android.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d029cad70073
Add a crashtest. r=dholbert

Comment 8

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/d029cad70073