Assertion failure: kMaxLine > numTracks, at /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:1166
Categories
(Core :: Layout: Grid, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr68 | --- | unaffected |
firefox-esr78 | --- | wontfix |
firefox77 | --- | wontfix |
firefox78 | --- | wontfix |
firefox79 | --- | fixed |
People
(Reporter: jkratzer, Assigned: alaskanemily)
References
(Blocks 1 open bug, Regression)
Details
(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])
Attachments
(4 files, 1 obsolete file)
Testcase found while fuzzing mozilla-central rev a99c73301874 (built with --enable-debug).
Assertion failure: kMaxLine > numTracks, at /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:1166
rax = 0x00007f060fca6a2b rdx = 0x0000000000000000
rcx = 0x000055e83e80aa48 rbx = 0x00007ffe8efb7018
rsi = 0x00007f06209f38b0 rdi = 0x00007f06209f2680
rbp = 0x00007ffe8efb63d0 rsp = 0x00007ffe8efb6380
r8 = 0x00007f06209f38b0 r9 = 0x00007f0621b59780
r10 = 0x0000000000000000 r11 = 0x0000000000000000
r12 = 0x000055e83f5cf460 r13 = 0x000000008ff6a68c
r14 = 0x0000000000000002 r15 = 0x0000000000002700
rip = 0x00007f060ad48aa1
OS|Linux|0.0.0 Linux 5.3.0-46-generic #38~18.04.1-Ubuntu SMP Tue Mar 31 04:17:56 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsGridContainerFrame::TrackSizingFunctions::CalculateRepeatFillCount(mozilla::StyleGenericLengthPercentageOrNormal<mozilla::StyleLengthPercentageUnion> const&, int, int, int) const|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGridContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1166|0x29
0|1|libxul.so|nsGridContainerFrame::TrackSizingFunctions::InitRepeatTracks(mozilla::StyleGenericLengthPercentageOrNormal<mozilla::StyleLengthPercentageUnion> const&, int, int, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGridContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1083|0x5
0|2|libxul.so|nsGridContainerFrame::Grid::PlaceGridItems(nsGridContainerFrame::GridReflowInput&, RepeatTrackSizingInput const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGridContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4436|0x14
0|3|libxul.so|nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGridContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|8634|0x5
0|4|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|927|0x1a
0|5|libxul.so|nsHTMLButtonControlFrame::ReflowButtonContents(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/forms/nsHTMLButtonControlFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|238|0x38
0|6|libxul.so|nsHTMLButtonControlFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/forms/nsHTMLButtonControlFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|184|0x15
0|7|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.cpp:a99c73301874690830624ae0a98c7940bc754c7d|878|0x31
0|8|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4467|0x10
0|9|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4269|0x2a
0|10|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4154|0x51
0|11|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|3135|0x15
0|12|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|2671|0x24
0|13|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1383|0xb
0|14|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:a99c73301874690830624ae0a98c7940bc754c7d|293|0x1e
0|15|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|3785|0x43
0|16|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|3132|0x16
0|17|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|2671|0x24
0|18|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1383|0xb
0|19|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|927|0x1a
0|20|libxul.so|nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|750|0x2a
0|21|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|927|0x1a
0|22|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|654|0x3a
0|23|libxul.so|nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|768|0x15
0|24|libxul.so|nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1155|0x15
0|25|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|967|0x18
0|26|libxul.so|mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|298|0x2b
0|27|libxul.so|mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:a99c73301874690830624ae0a98c7940bc754c7d|9356|0x1c
0|28|libxul.so|mozilla::PresShell::ProcessReflowCommands(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:a99c73301874690830624ae0a98c7940bc754c7d|9529|0x12
0|29|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4221|0x12
0|30|libxul.so|nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.h:a99c73301874690830624ae0a98c7940bc754c7d|1443|0xb
0|31|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:a99c73301874690830624ae0a98c7940bc754c7d|374|0xb
0|32|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:a99c73301874690830624ae0a98c7940bc754c7d|368|0x12
0|33|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:a99c73301874690830624ae0a98c7940bc754c7d|746|0x17
0|34|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:a99c73301874690830624ae0a98c7940bc754c7d|645|0xf
0|35|libxul.so|mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:a99c73301874690830624ae0a98c7940bc754c7d|55|0x13
0|36|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:40b57a5f11db1f2975fc13c74f20fea3c72418dd5cc7be16b1724f135b6995163d22588c816f1fb7f6cdadad80e8ed2fcea1ccf234f0788643e6a5e4e1859c1e/ipc/ipdl/PVsyncChild.cpp:|187|0x8
0|37|libxul.so|mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:1521fe5e4880bb37ab5dc5a7d9fd40ef3a119c31da52fb7b7c6fde229e424452545f0ee11c662cc0893995c6cf7b7b67f7e85bd7436ee2a85bbacc42d5a5a789/ipc/ipdl/PBackgroundChild.cpp:|5970|0x24
0|38|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:a99c73301874690830624ae0a98c7940bc754c7d|2186|0x1c
0|39|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:a99c73301874690830624ae0a98c7940bc754c7d|2110|0x12
0|40|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1958|0xb
0|41|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1989|0x12
0|42|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1200|0x11
0|43|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:a99c73301874690830624ae0a98c7940bc754c7d|481|0xc
0|44|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:a99c73301874690830624ae0a98c7940bc754c7d|87|0x7
0|45|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:a99c73301874690830624ae0a98c7940bc754c7d|315|0x17
0|46|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:a99c73301874690830624ae0a98c7940bc754c7d|290|0x8
0|47|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:a99c73301874690830624ae0a98c7940bc754c7d|137|0xd
0|48|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:a99c73301874690830624ae0a98c7940bc754c7d|909|0xe
0|49|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:a99c73301874690830624ae0a98c7940bc754c7d|237|0x5
0|50|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:a99c73301874690830624ae0a98c7940bc754c7d|315|0x17
0|51|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:a99c73301874690830624ae0a98c7940bc754c7d|290|0x8
0|52|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:a99c73301874690830624ae0a98c7940bc754c7d|740|0x5
0|53|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:a99c73301874690830624ae0a98c7940bc754c7d|56|0x11
0|54|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:a99c73301874690830624ae0a98c7940bc754c7d|303|0x20
0|55|libc.so.6||||0x21b97
0|56|firefox-bin|<name omitted>|hg:hg.mozilla.org/mozilla-central:mfbt/UniquePtr.h:a99c73301874690830624ae0a98c7940bc754c7d|253|0x17
Reporter | ||
Updated•5 years ago
|
Reporter | ||
Comment 1•5 years ago
|
||
Comment 2•5 years ago
|
||
Because this bug's Severity has not been changed from the default since it was filed, and it's Priority is --
(non,) indicating it has has not been previously triaged, the bug's Severity is being updated to --
(default, untriaged.)
Comment 3•5 years ago
|
||
The priority flag is not set for this bug.
:svoisen, could you have a look please?
For more information, please visit auto_nag documentation.
Comment 4•5 years ago
|
||
Emily: Can you take a look? The pushlog seems to indicate your patch for bug 1625051.
Assignee | ||
Comment 5•5 years ago
|
||
Also add the test which triggered the assert.
This weakens the assert's check, but since it is asserting that an integer
underflow does not occur this should still only fire on a logic error.
Updated•5 years ago
|
Assignee | ||
Updated•5 years ago
|
Comment 6•5 years ago
|
||
This is the same test with one added track in the auto-fill list. It still asserts with the proposed fix.
Reporter | ||
Updated•5 years ago
|
Updated•5 years ago
|
Comment 7•5 years ago
|
||
This testcase asserts:
Assertion failure: numSizes >= numLeadingImplicitTracks + numExplicitTracks, at layout/style/nsComputedDOMStyle.cpp:1579
with or without the suggested fix. Could you look into that please to see if it's related?
Comment 8•5 years ago
•
|
||
And this asserts:
Assertion failure: !mHasRepeatAuto || (mExpandedTracks.Length() >= 1 && mRepeatAutoStart < mExpandedTracks.Length()), at layout/generic/nsGridContainerFrame.cpp:1029
with or without the suggested fix...
If these are unrelated issues then please file separate bug(s) as needed and mark them as blocking this bug.
I'll postpone reviewing this bug until that's sorted out because I want to be able to test what the actual behavior is with the suggested fix.
Assignee | ||
Comment 9•5 years ago
|
||
I've got a patch which should fix the two new testcases, as well as a few auto-fit testcases I found to crash. I will update the review soon.
Updated•5 years ago
|
Comment 10•5 years ago
|
||
Comment 11•5 years ago
•
|
||
Backed out changeset a59280f412c0 (Bug 1633737) for crashtest assertion failures at nsGridContainerFrame.cpp.
https://hg.mozilla.org/integration/autoland/rev/d0f9d98b428c437b3fe913b4fc099c60eaf64e52
Failure log:
https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=306711972&repo=autoland&lineNumber=46103
Comment 12•5 years ago
|
||
Comment 13•5 years ago
|
||
bugherder |
Comment 14•5 years ago
|
||
Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.
Updated•5 years ago
|
Assignee | ||
Updated•5 years ago
|
Updated•5 years ago
|
Comment 15•5 years ago
|
||
:alaskanemily, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.
Updated•5 years ago
|
Updated•4 years ago
|
Reporter | ||
Comment 16•4 years ago
|
||
Bugmon Analysis:
Unable to reproduce bug using mozilla-central 2020-04-28.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.
Description
•