1640275 - Assertion failure: !nifNeedPushedItem || mDidPushItemsBitMayLie (The state bit stored in didPushItemsBit lied!), at src/layout/generic/nsContainerFrame.cpp:1754

Status: VERIFIED FIXED

(Core :: Layout, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c 20200520-855249e545c3

Assertion failure: !nifNeedPushedItem || mDidPushItemsBitMayLie (The state bit stored in didPushItemsBit lied!), at /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1754

0|0|libxul.so|nsContainerFrame::NormalizeChildLists()|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1753|0x0
0|1|libxul.so|nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4158|0x8
0|2|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|293|0x1e
0|3|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|3788|0x43
0|4|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|3141|0x16
0|5|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2966|0x20
0|6|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1383|0xb
0|7|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|927|0x1a
0|8|libxul.so|nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|702|0x3b
0|9|libxul.so|nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig&, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|412|0x5
0|10|libxul.so|nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1213|0x38
0|11|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|293|0x1e
0|12|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|3788|0x43
0|13|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|3141|0x16
0|14|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2680|0xf
0|15|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1383|0xb
0|16|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|927|0x1a
0|17|libxul.so|nsFlexContainerFrame::MeasureAscentAndBSizeForFlexItem(nsFlexContainerFrame::FlexItem&, mozilla::ReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1803|0x22
0|18|libxul.so|nsFlexContainerFrame::SizeItemInCrossAxis(mozilla::ReflowInput&, nsFlexContainerFrame::FlexItem&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4107|0x8
0|19|libxul.so|nsFlexContainerFrame::DoFlexLayout(mozilla::ReflowInput const&, nsReflowStatus&, int&, int&, int&, int, int, nsTArray<nsFlexContainerFrame::FlexLine>&, nsTArray<nsFlexContainerFrame::StrutInfo>&, nsTArray<nsIFrame*>&, nsFlexContainerFrame::FlexboxAxisTracker const&, int, int, bool, ComputedFlexContainerInfo*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4815|0x12
0|20|libxul.so|nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4243|0x47
0|21|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|927|0x1a
0|22|libxul.so|nsFlexContainerFrame::MeasureAscentAndBSizeForFlexItem(nsFlexContainerFrame::FlexItem&, mozilla::ReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1803|0x22
0|23|libxul.so|nsFlexContainerFrame::SizeItemInCrossAxis(mozilla::ReflowInput&, nsFlexContainerFrame::FlexItem&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4107|0x8
0|24|libxul.so|nsFlexContainerFrame::DoFlexLayout(mozilla::ReflowInput const&, nsReflowStatus&, int&, int&, int&, int, int, nsTArray<nsFlexContainerFrame::FlexLine>&, nsTArray<nsFlexContainerFrame::StrutInfo>&, nsTArray<nsIFrame*>&, nsFlexContainerFrame::FlexboxAxisTracker const&, int, int, bool, ComputedFlexContainerInfo*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4815|0x12
0|25|libxul.so|nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFlexContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4243|0x47
0|26|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|927|0x1a
0|27|libxul.so|nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|750|0x2a
0|28|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|927|0x1a
0|29|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|661|0x3a
0|30|libxul.so|nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|775|0x15
0|31|libxul.so|nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1161|0x15
0|32|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|967|0x18
0|33|libxul.so|mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|296|0x2b
0|34|libxul.so|mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|9469|0x1c
0|35|libxul.so|mozilla::PresShell::ProcessReflowCommands(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|9642|0x12
0|36|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4204|0x12
0|37|libxul.so|nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.h:855249e545c361516a65bcba8f5bc6b423e2d131|1434|0xb
0|38|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|373|0xb
0|39|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|367|0x12
0|40|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|745|0x17
0|41|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|644|0xf
0|42|libxul.so|mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|55|0x13
0|43|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:27495909b8eb16a2f6224f9af7a0c052f58ac4a1f37ddd12d240b8b6a62795d131a51db23214bbde8ed61a33c6a97d727ae972f588d3f35141a1a66f3aadceeb/ipc/ipdl/PVsyncChild.cpp:|187|0x8
0|44|libxul.so|mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:75695bbbf1ec93aad4718f03c359901f1be9ae34cba79945a5c42f3e8a2da054cc4ed1a56d373be9953080b82b366a6cd792a7b5323cd7f0d62bfa3c3b040098/ipc/ipdl/PBackgroundChild.cpp:|6083|0x24
0|45|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2186|0x1c
0|46|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2110|0x18
0|47|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1958|0xb
0|48|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1989|0x12
0|49|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1211|0x11
0|50|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|501|0xc
0|51|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|87|0x7
0|52|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:855249e545c361516a65bcba8f5bc6b423e2d131|315|0x17
0|53|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:855249e545c361516a65bcba8f5bc6b423e2d131|290|0x8
0|54|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|137|0xd
0|55|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|909|0xe
0|56|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|237|0x5
0|57|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:855249e545c361516a65bcba8f5bc6b423e2d131|315|0x17
0|58|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:855249e545c361516a65bcba8f5bc6b423e2d131|290|0x8
0|59|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|740|0x5
0|60|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|56|0x11
0|61|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|303|0x20
0|62|libc.so.6|__libc_start_main|/build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c|291|0x1a

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Also flex fragmentation.

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200522213853-d6abd35b54ad.
The bug appears to have been introduced in the following build range:
> Start: 97855f04050aad83a2b4249edcffa282c9ad05ec (20200512181304)
> End: 76aa4bf4eabd44912cc33a4ccd4d5474fc0e2ca7 (20200512181502)
> Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=97855f04050aad83a2b4249edcffa282c9ad05ec&tochange=76aa4bf4eabd44912cc33a4ccd4d5474fc0e2ca7

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1622935

Comment 4

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1640275 Part 1 - Move some nsGridContainerFrame's helper methods to nsContainerFrame.

In the next part, I'll extend these helpers, and use them in
nsFlexContainerFrame.

Comment 5

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1640275 Part 2 - Override nsContainerFrame's methods for nsFlexContainerFrame.

Similar to nsGridContainerFrame, when appending, inserting, or removing
frames, the state bits NS_STATE_FLEX_DID_PUSH_ITEMS and
NS_STATE_FLEX_HAS_CHILD_NIFS need to be set so that
nsContainerFrame::NormalizeChildLists() can work correctly.

Depends on D77203

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/62d018469660
Part 1 - Move some nsGridContainerFrame's helper methods to nsContainerFrame. r=mats
https://hg.mozilla.org/integration/autoland/rev/54c3cc382023
Part 2 - Override nsContainerFrame's methods for nsFlexContainerFrame. r=mats

Comment 7

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/62d018469660
https://hg.mozilla.org/mozilla-central/rev/54c3cc382023

Comment 8

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20200529155909-60a406d3b53a.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.