1649541 - Assertion failure: !HasAnyStateBits(NS_FRAME_IS_DIRTY) (Must only be called on reflowed lines), at src/layout/generic/nsFrame.cpp:7827

Status: RESOLVED DUPLICATE of bug 1721262

(Core :: Layout: Block and Inline, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Assertion failure: !HasAnyStateBits(NS_FRAME_IS_DIRTY) (Must only be called on reflowed lines), at /builds/worker/checkouts/gecko/layout/generic/nsFrame.cpp:7827

0|0|libxul.so|nsIFrame::CachedIsEmpty()|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|7826|0x29
0|1|libxul.so|nsLineBox::CachedIsEmpty()|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineBox.cpp:992822684324869697f7ed47b042aeef5aff7ab5|346|0xd
0|2|libxul.so|nsBlockFrame::CheckForCollapsedBEndMarginFromClearanceLine()|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1678|0x14
0|3|libxul.so|nsBlockFrame::ComputeFinalSize(mozilla::ReflowInput const&, mozilla::BlockReflowInput&, mozilla::ReflowOutput&, int*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1825|0x8
0|4|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1488|0x11
0|5|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:992822684324869697f7ed47b042aeef5aff7ab5|293|0x1e
0|6|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|3771|0x43
0|7|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|3120|0x16
0|8|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|2658|0x24
0|9|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1375|0xb
0|10|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:992822684324869697f7ed47b042aeef5aff7ab5|293|0x1e
0|11|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|3771|0x43
0|12|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|3120|0x16
0|13|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|2658|0x24
0|14|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1375|0xb
0|15|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1074|0x1a
0|16|libxul.so|nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|703|0x45
0|17|libxul.so|nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig&, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|414|0x5
0|18|libxul.so|nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsColumnSetFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1235|0x3f
0|19|libxul.so|nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockReflowContext.cpp:992822684324869697f7ed47b042aeef5aff7ab5|293|0x1e
0|20|libxul.so|nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|3771|0x43
0|21|libxul.so|nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|3120|0x16
0|22|libxul.so|nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|2658|0x24
0|23|libxul.so|nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1375|0xb
0|24|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1074|0x1a
0|25|libxul.so|nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|750|0x22
0|26|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1074|0x1a
0|27|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|686|0x3a
0|28|libxul.so|nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|800|0x15
0|29|libxul.so|nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1195|0x15
0|30|libxul.so|nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1114|0x18
0|31|libxul.so|mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:992822684324869697f7ed47b042aeef5aff7ab5|297|0x2b
0|32|libxul.so|mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:992822684324869697f7ed47b042aeef5aff7ab5|9616|0x1c
0|33|libxul.so|mozilla::PresShell::ProcessReflowCommands(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:992822684324869697f7ed47b042aeef5aff7ab5|9789|0x12
0|34|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:992822684324869697f7ed47b042aeef5aff7ab5|4251|0x12
0|35|libxul.so|nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.h:992822684324869697f7ed47b042aeef5aff7ab5|1443|0xb
0|36|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:992822684324869697f7ed47b042aeef5aff7ab5|373|0xb
0|37|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:992822684324869697f7ed47b042aeef5aff7ab5|367|0x12
0|38|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:992822684324869697f7ed47b042aeef5aff7ab5|737|0x17
0|39|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync()|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:992822684324869697f7ed47b042aeef5aff7ab5|639|0x10
0|40|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run()|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:992822684324869697f7ed47b042aeef5aff7ab5|538|0x14
0|41|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:992822684324869697f7ed47b042aeef5aff7ab5|1234|0xe
0|42|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:992822684324869697f7ed47b042aeef5aff7ab5|501|0xc
0|43|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:992822684324869697f7ed47b042aeef5aff7ab5|87|0x7
0|44|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:992822684324869697f7ed47b042aeef5aff7ab5|315|0x17
0|45|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:992822684324869697f7ed47b042aeef5aff7ab5|290|0x8
0|46|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:992822684324869697f7ed47b042aeef5aff7ab5|137|0xd
0|47|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:992822684324869697f7ed47b042aeef5aff7ab5|913|0xe
0|48|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:992822684324869697f7ed47b042aeef5aff7ab5|237|0x5
0|49|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:992822684324869697f7ed47b042aeef5aff7ab5|315|0x17
0|50|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:992822684324869697f7ed47b042aeef5aff7ab5|290|0x8
0|51|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:992822684324869697f7ed47b042aeef5aff7ab5|744|0x5
0|52|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:992822684324869697f7ed47b042aeef5aff7ab5|56|0x11
0|53|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:992822684324869697f7ed47b042aeef5aff7ab5|303|0x20

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/HGjKk-rogAly75TitRbRYw/index.html

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200702152109-2d709e60c76e.
Failed to bisect testcase (Start build crashes!):
> Start: 8ad5fbc5b9358fc84aa43d9a1b19c851056b1f39 (20190704033117)
> End: 79d69f36a2202fadd572b0243b618e100d29b525 (20200630020930)
> BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 3

[Emily McDonough [:alaskanemily]]

@saschanaz, can you take a look at this?

I only picked you because of the commit history, feel free to ask someone else if you think someone else should take a look.

Comment 4

[Kagami Rosylight [:saschanaz] (they/them) (OOO until 2024-10-06)]

Frankly have no idea. Emilio, do you happen to have some?

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Testcase uses multicol, may have been introduced by TYLin's recent multicol improvements. Other than that no, I'd have to debug it on rr to figure out.

Comment 6

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

I can reproduce this by using mozregression on the oldest debug build available, which is 2019-07-04 (build id 20190704033117).

Multicol balancing is a useful way to exploit the weakness of our frame fragmentation implementation. So yeah, bug 1647332 can changed the number of reflows needed to get the best column height, so I'm not surprise bugs may surface because of it.

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20201212092303-8491ac4866e8) but not with tip (mozilla-central 20211210215852-9eb74149f75b.)
The bug appears to have been fixed in the following build range:

Start: 4aa3a54f7d7202bf6868a76b10e4669b56ed3c35 (20210805165711)
End: 3d765b0e8cfb3f899437686c283cb497b1550684 (20210806002100)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=4aa3a54f7d7202bf6868a76b10e4669b56ed3c35&tochange=3d765b0e8cfb3f899437686c283cb497b1550684
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

It's possible that bug 1721262 fixed this.