Closed Bug 1633737 Opened 5 years ago Closed 5 years ago

Assertion failure: kMaxLine > numTracks, at /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:1166

Categories

(Core :: Layout: Grid, defect)

defect

Tracking

()

RESOLVED FIXED
mozilla79
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- wontfix
firefox77 --- wontfix
firefox78 --- wontfix
firefox79 --- fixed

People

(Reporter: jkratzer, Assigned: alaskanemily)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(4 files, 1 obsolete file)

Attached file testcase.html (obsolete) —

Testcase found while fuzzing mozilla-central rev a99c73301874 (built with --enable-debug).

Assertion failure: kMaxLine > numTracks, at /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:1166

rax = 0x00007f060fca6a2b   rdx = 0x0000000000000000
rcx = 0x000055e83e80aa48   rbx = 0x00007ffe8efb7018
rsi = 0x00007f06209f38b0   rdi = 0x00007f06209f2680
rbp = 0x00007ffe8efb63d0   rsp = 0x00007ffe8efb6380
r8 = 0x00007f06209f38b0    r9 = 0x00007f0621b59780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x000055e83f5cf460   r13 = 0x000000008ff6a68c
r14 = 0x0000000000000002   r15 = 0x0000000000002700
rip = 0x00007f060ad48aa1
OS|Linux|0.0.0 Linux 5.3.0-46-generic #38~18.04.1-Ubuntu SMP Tue Mar 31 04:17:56 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsGridContainerFrame::TrackSizingFunctions::CalculateRepeatFillCount(mozilla::StyleGenericLengthPercentageOrNormal<mozilla::StyleLengthPercentageUnion> const&, int, int, int) const|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGridContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1166|0x29
0|1|libxul.so|nsGridContainerFrame::TrackSizingFunctions::InitRepeatTracks(mozilla::StyleGenericLengthPercentageOrNormal<mozilla::StyleLengthPercentageUnion> const&, int, int, int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGridContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1083|0x5
0|2|libxul.so|nsGridContainerFrame::Grid::PlaceGridItems(nsGridContainerFrame::GridReflowInput&, RepeatTrackSizingInput const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGridContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4436|0x14
0|3|libxul.so|nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGridContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|8634|0x5
0|4|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|927|0x1a
0|5|libxul.so|nsHTMLButtonControlFrame::ReflowButtonContents(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/forms/nsHTMLButtonControlFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|238|0x38
0|6|libxul.so|nsHTMLButtonControlFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/forms/nsHTMLButtonControlFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|184|0x15
0|7|libxul.so|nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.cpp:a99c73301874690830624ae0a98c7940bc754c7d|878|0x31
0|8|libxul.so|nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4467|0x10
0|9|libxul.so|nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4269|0x2a
0|10|libxul.so|nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4154|0x51
0|11|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|3135|0x15
0|12|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|2671|0x24
0|13|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1383|0xb
0|14|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:a99c73301874690830624ae0a98c7940bc754c7d|293|0x1e
0|15|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|3785|0x43
0|16|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|3132|0x16
0|17|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|2671|0x24
0|18|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1383|0xb
0|19|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|927|0x1a
0|20|libxul.so|nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|750|0x2a
0|21|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|927|0x1a
0|22|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|654|0x3a
0|23|libxul.so|nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|768|0x15
0|24|libxul.so|nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1155|0x15
0|25|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|967|0x18
0|26|libxul.so|mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:a99c73301874690830624ae0a98c7940bc754c7d|298|0x2b
0|27|libxul.so|mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:a99c73301874690830624ae0a98c7940bc754c7d|9356|0x1c
0|28|libxul.so|mozilla::PresShell::ProcessReflowCommands(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:a99c73301874690830624ae0a98c7940bc754c7d|9529|0x12
0|29|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:a99c73301874690830624ae0a98c7940bc754c7d|4221|0x12
0|30|libxul.so|nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.h:a99c73301874690830624ae0a98c7940bc754c7d|1443|0xb
0|31|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:a99c73301874690830624ae0a98c7940bc754c7d|374|0xb
0|32|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:a99c73301874690830624ae0a98c7940bc754c7d|368|0x12
0|33|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:a99c73301874690830624ae0a98c7940bc754c7d|746|0x17
0|34|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:a99c73301874690830624ae0a98c7940bc754c7d|645|0xf
0|35|libxul.so|mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:a99c73301874690830624ae0a98c7940bc754c7d|55|0x13
0|36|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:40b57a5f11db1f2975fc13c74f20fea3c72418dd5cc7be16b1724f135b6995163d22588c816f1fb7f6cdadad80e8ed2fcea1ccf234f0788643e6a5e4e1859c1e/ipc/ipdl/PVsyncChild.cpp:|187|0x8
0|37|libxul.so|mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:1521fe5e4880bb37ab5dc5a7d9fd40ef3a119c31da52fb7b7c6fde229e424452545f0ee11c662cc0893995c6cf7b7b67f7e85bd7436ee2a85bbacc42d5a5a789/ipc/ipdl/PBackgroundChild.cpp:|5970|0x24
0|38|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:a99c73301874690830624ae0a98c7940bc754c7d|2186|0x1c
0|39|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:a99c73301874690830624ae0a98c7940bc754c7d|2110|0x12
0|40|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1958|0xb
0|41|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1989|0x12
0|42|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:a99c73301874690830624ae0a98c7940bc754c7d|1200|0x11
0|43|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:a99c73301874690830624ae0a98c7940bc754c7d|481|0xc
0|44|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:a99c73301874690830624ae0a98c7940bc754c7d|87|0x7
0|45|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:a99c73301874690830624ae0a98c7940bc754c7d|315|0x17
0|46|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:a99c73301874690830624ae0a98c7940bc754c7d|290|0x8
0|47|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:a99c73301874690830624ae0a98c7940bc754c7d|137|0xd
0|48|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:a99c73301874690830624ae0a98c7940bc754c7d|909|0xe
0|49|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:a99c73301874690830624ae0a98c7940bc754c7d|237|0x5
0|50|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:a99c73301874690830624ae0a98c7940bc754c7d|315|0x17
0|51|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:a99c73301874690830624ae0a98c7940bc754c7d|290|0x8
0|52|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:a99c73301874690830624ae0a98c7940bc754c7d|740|0x5
0|53|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:a99c73301874690830624ae0a98c7940bc754c7d|56|0x11
0|54|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:a99c73301874690830624ae0a98c7940bc754c7d|303|0x20
0|55|libc.so.6||||0x21b97
0|56|firefox-bin|<name omitted>|hg:hg.mozilla.org/mozilla-central:mfbt/UniquePtr.h:a99c73301874690830624ae0a98c7940bc754c7d|253|0x17
Flags: in-testsuite?
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Bugmon Analysis: Verified bug as reproducible on mozilla-central 20200428163011-5797e768d878. The bug appears to have been introduced in the following build range: > Start: cb87343d4976405a9d9eece15fc1afca7eb7b81d (20200331043143) > End: e1672b3231e9e612465168f16190a1392b422517 (20200331093527) > Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=cb87343d4976405a9d9eece15fc1afca7eb7b81d&tochange=e1672b3231e9e612465168f16190a1392b422517

Because this bug's Severity has not been changed from the default since it was filed, and it's Priority is -- (non,) indicating it has has not been previously triaged, the bug's Severity is being updated to -- (default, untriaged.)

Severity: normal → --

The priority flag is not set for this bug.
:svoisen, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(svoisen)

Emily: Can you take a look? The pushlog seems to indicate your patch for bug 1625051.

Severity: -- → S4
Flags: needinfo?(svoisen) → needinfo?(emcdonough)

Also add the test which triggered the assert.

This weakens the assert's check, but since it is asserting that an integer
underflow does not occur this should still only fire on a logic error.

Assignee: nobody → emcdonough
Status: NEW → ASSIGNED
Flags: needinfo?(emcdonough)
Attached file Testcase #2

This is the same test with one added track in the auto-fill list. It still asserts with the proposed fix.

Attachment #9143983 - Attachment is obsolete: true
Attachment #9150524 - Attachment description: Bug 1633737 - Fix assert in grid repetition calculation → Bug 1633737 - Handle grid track lists that are too large explicitly in CalculateRepeatFillCount.
Attached file Testcase #3

This testcase asserts:

Assertion failure: numSizes >= numLeadingImplicitTracks + numExplicitTracks, at layout/style/nsComputedDOMStyle.cpp:1579

with or without the suggested fix. Could you look into that please to see if it's related?

Flags: needinfo?(emcdonough)
Attached file Testcase #4

And this asserts:

Assertion failure: !mHasRepeatAuto || (mExpandedTracks.Length() >= 1 && mRepeatAutoStart < mExpandedTracks.Length()), at layout/generic/nsGridContainerFrame.cpp:1029

with or without the suggested fix...

If these are unrelated issues then please file separate bug(s) as needed and mark them as blocking this bug.
I'll postpone reviewing this bug until that's sorted out because I want to be able to test what the actual behavior is with the suggested fix.

I've got a patch which should fix the two new testcases, as well as a few auto-fit testcases I found to crash. I will update the review soon.

Flags: needinfo?(emcdonough)
Attachment #9150524 - Attachment description: Bug 1633737 - Handle grid track lists that are too large explicitly in CalculateRepeatFillCount. → Bug 1633737 - Fix asserts and array accesses for oversized grid tracks with repeat-auto
Pushed by emcdonough@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/a59280f412c0 Fix asserts and array accesses for oversized grid tracks with repeat-auto r=emilio
Pushed by emcdonough@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/e738e5bbcfc0 Fix asserts and array accesses for oversized grid tracks with repeat-auto r=emilio
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla79

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.

Flags: needinfo?(emcdonough)
Flags: in-testsuite? → in-testsuite+

:alaskanemily, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Flags: needinfo?(emcdonough)
Flags: needinfo?(emcdonough)
Regressed by: 1625051
Has Regression Range: --- → yes

Bugmon Analysis:
Unable to reproduce bug using mozilla-central 2020-04-28.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: