1602003 - Assertion failure: mPresContext->GetVisibleArea().height != nscoord((1 << 30) - 1) (height should not be NS_UNCONSTRAINEDSIZE after reflow), at /builds/worker/workspace/build/src/layout/base/PresShell.cpp:1977

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev e2394b695d21.

Assertion failure: mPresContext->GetVisibleArea().height != nscoord((1 << 30) - 1) (height should not be NS_UNCONSTRAINEDSIZE after reflow), at /builds/worker/workspace/build/src/layout/base/PresShell.cpp:1977

==15018==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f3e0381631c bp 0x7fff7c100580 sp 0x7fff7c1003c0 T0)
==15018==The signal is caused by a WRITE memory access.
==15018==Hint: address points to the zero page.
    #0 0x7f3e0381631b in mozilla::PresShell::ResizeReflowIgnoreOverride(int, int, mozilla::ResizeReflowOptions) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:1972:3
    #1 0x7f3e0394e5f5 in nsDocumentViewer::GetContentSizeInternal(int*, int*, int, int) /builds/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:3188:28
    #2 0x7f3e0394ea28 in nsDocumentViewer::GetContentSize(int*, int*) /builds/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:3220:10
    #3 0x7f3dfe36162b in nsGlobalWindowOuter::SizeToContentOuter(mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:5264:16
    #4 0x7f3dfff25ce3 in mozilla::dom::Window_Binding::sizeToContent(JSContext*, JS::Handle<JSObject*>, nsGlobalWindowInner*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:5624:24
    #5 0x7f3e009a83b5 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3153:13
    #6 0x7f3e075a287a in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:457:13
    #7 0x7f3e075a287a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:549:12
    #8 0x7f3e075a5819 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:635:8
    #9 0x7f3e0786b667 in js::ForwardingProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const /builds/worker/workspace/build/src/js/src/proxy/Wrapper.cpp:162:10
    #10 0x7f3e0782b71c in js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const /builds/worker/workspace/build/src/js/src/proxy/CrossCompartmentWrapper.cpp:237:19
    #11 0x7f3e0784e5d3 in js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) /builds/worker/workspace/build/src/js/src/proxy/Proxy.cpp:492:19
    #12 0x7f3e075a36d9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:523:14
    #13 0x7f3e075880fe in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:622:10
    #14 0x7f3e075880fe in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3118:16
    #15 0x7f3e07567d3f in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:424:10
    #16 0x7f3e075a2e08 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:590:13
    #17 0x7f3e075a5819 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:635:8
    #18 0x7f3e0779cb0e in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2756:10
    #19 0x7f3e002a5538 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:52:8
    #20 0x7f3e010c38d0 in HandleEvent<mozilla::dom::EventTarget *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12
    #21 0x7f3e010c38d0 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1072:43
    #22 0x7f3e010c53a3 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1270:17
    #23 0x7f3e010ac766 in HandleEvent /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/EventListenerManager.h:355:5
    #24 0x7f3e010ac766 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:356:17
    #25 0x7f3e010aa99d in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:558:16
    #26 0x7f3e010b016d in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:1056:11
    #27 0x7f3e0393d16c in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:1163:7
    #28 0x7f3e0677b3b3 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:6294:20
    #29 0x7f3e0677a607 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:6077:7
    #30 0x7f3e0677f47f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp
    #31 0x7f3dfcefa8e4 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1352:3
    #32 0x7f3dfcef9261 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:911:14
    #33 0x7f3dfcef5006 in nsDocLoader::DocLoaderIsEmpty(bool) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:731:9
    #34 0x7f3dfcef7fea in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:619:5
    #35 0x7f3dfcef8f6c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp
    #36 0x7f3dfa61e3ab in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:595:22
    #37 0x7f3dfa620d14 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:502:10
    #38 0x7f3dfe53fd58 in DoUnblockOnload /builds/worker/workspace/build/src/dom/base/Document.cpp:10514:18
    #39 0x7f3dfe53fd58 in mozilla::dom::Document::UnblockOnload(bool) /builds/worker/workspace/build/src/dom/base/Document.cpp:10446:9
    #40 0x7f3dfe56b53c in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/workspace/build/src/dom/base/Document.cpp:7111:3
    #41 0x7f3dfe64de24 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1124:12
    #42 0x7f3dfe64de24 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1130:12
    #43 0x7f3dfe64de24 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1176:13
    #44 0x7f3dfa366a81 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:295:32
    #45 0x7f3dfa39699a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1250:14
    #46 0x7f3dfa39de41 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
    #47 0x7f3dfb5dff9f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:88:21
    #48 0x7f3dfb4e7fa2 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #49 0x7f3dfb4e7fa2 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #50 0x7f3dfb4e7fa2 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #51 0x7f3e03258888 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #52 0x7f3e07322dd6 in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:943:20
    #53 0x7f3dfb4e7fa2 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #54 0x7f3dfb4e7fa2 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #55 0x7f3dfb4e7fa2 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #56 0x7f3e0732265f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:778:34
    #57 0x55de417c95cc in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #58 0x55de417c95cc in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:303:18
    #59 0x7f3e1d771b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

Comment 1

[Emilio Cobos Álvarez (:emilio)]

I converted the assertions to DIAGNOSTIC_ASSERTs so I guess this is my thing now :)

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

I couldn't repro this, any tips?

Comment 4

[Jason Kratzer [:jkratzer]]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #3)

I couldn't repro this, any tips?

Emilio, looks like I forgot to mention that it needs to be served via a local webserver in order to reproduce. Further it looks like it contains special prefs which I will attach. If it'd help, I can also make a pernosco recording. Just let me know.

Comment 5

[Jason Kratzer [:jkratzer]]

Attachment: prefs-default-e10s.js

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Alright, thanks! let's try again... :)

Comment 7

[Emilio Cobos Álvarez (:emilio)]

This is really a regression from bug 1272997, I just made the assertion assert harder. The writing-mode handling in that function doesn't make any sense. The caller really passes aISize and aBSize rather than aWidth and aHeight...

I guess it could be said it's a bug in the caller.

Comment 8

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1602003 - Correct writing-mode handling of nsDocumentViewer::GetContentSize. r=jfkthame

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2f8098e1060d
Correct writing-mode handling of nsDocumentViewer::GetContentSize. r=jfkthame

Comment 10

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/2f8098e1060d