1682032 - Assertion failure: mFlags.mBSizeIsSetByAspectRatio (This flag should have been set because nsIFrame::ComputeSize() returns AspectRatioUsage::ToComputeBSize unintentionally), at /builds/worker/checkouts/gecko/layout/generic/ReflowInput.cpp:1544

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 91a89ecd1d3a (built with --enable-debug).

Assertion failure: mFlags.mBSizeIsSetByAspectRatio (This flag should have been set because nsIFrame::ComputeSize() returns AspectRatioUsage::ToComputeBSize unintentionally), at /builds/worker/checkouts/gecko/layout/generic/ReflowInput.cpp:1544

    #0 0x7f2d06b2b726 in mozilla::ReflowInput::CalculateAbsoluteSizeWithResolvedAutoBlockSize(int, bool, mozilla::LogicalSize const&) /builds/worker/checkouts/gecko/layout/generic/ReflowInput.cpp:1542:3
    #1 0x7f2d06b2d28d in mozilla::ReflowInput::InitAbsoluteConstraints(nsPresContext*, mozilla::ReflowInput const*, mozilla::LogicalSize const&, mozilla::LayoutFrameType) /builds/worker/checkouts/gecko/layout/generic/ReflowInput.cpp:1887:11
    #2 0x7f2d06b27e88 in mozilla::ReflowInput::InitConstraints(nsPresContext*, mozilla::Maybe<mozilla::LogicalSize> const&, mozilla::Maybe<mozilla::LogicalMargin> const&, mozilla::Maybe<mozilla::LogicalMargin> const&, mozilla::LayoutFrameType) /builds/worker/checkouts/gecko/layout/generic/ReflowInput.cpp:2358:7
    #3 0x7f2d06b2568f in mozilla::ReflowInput::Init(nsPresContext*, mozilla::Maybe<mozilla::LogicalSize> const&, mozilla::Maybe<mozilla::LogicalMargin> const&, mozilla::Maybe<mozilla::LogicalMargin> const&) /builds/worker/checkouts/gecko/layout/generic/ReflowInput.cpp:357:3
    #4 0x7f2d06b25e6a in mozilla::ReflowInput::ReflowInput(nsPresContext*, mozilla::ReflowInput const&, nsIFrame*, mozilla::LogicalSize const&, mozilla::Maybe<mozilla::LogicalSize> const&, mozilla::EnumSet<mozilla::ReflowInput::InitFlag, unsigned char>, mozilla::EnumSet<mozilla::ComputeSizeFlag, unsigned char>) /builds/worker/checkouts/gecko/layout/generic/ReflowInput.cpp:216:5
    #5 0x7f2d06b42de5 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, mozilla::OverflowAreas*) /builds/worker/checkouts/gecko/layout/generic/nsAbsoluteContainingBlock.cpp:744:15
    #6 0x7f2d06b41724 in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, mozilla::OverflowAreas*) /builds/worker/checkouts/gecko/layout/generic/nsAbsoluteContainingBlock.cpp:220:7
    #7 0x7f2d06b411c4 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:380:35
    #8 0x7f2d06a497f6 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9668:11
    #9 0x7f2d06a52eee in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9841:24
    #10 0x7f2d06a524b4 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4247:11
    #11 0x7f2d06a1bb09 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1412:5
    #12 0x7f2d06a1bb09 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2205:20
    #13 0x7f2d06a23591 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:357:13
    #14 0x7f2d06a23591 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:336:7
    #15 0x7f2d06a2347c in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:351:5
    #16 0x7f2d06a22a28 in RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:799:5
    #17 0x7f2d06a22a28 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:722:16
    #18 0x7f2d06a22340 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:624:7
    #19 0x7f2d06a21db9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:545:9
    #20 0x7f2d062300a6 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncChild.cpp:69:15
    #21 0x7f2d0302e500 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
    #22 0x7f2d02dd8b9c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6286:32
    #23 0x7f2d02a9cd4e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2153:25
    #24 0x7f2d02a9934d in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2077:9
    #25 0x7f2d02a9a7f6 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1925:3
    #26 0x7f2d02a9b53b in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1956:13
    #27 0x7f2d0218532f in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:452:16
    #28 0x7f2d0218397a in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:732:26
    #29 0x7f2d02182a24 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:591:15
    #30 0x7f2d02182bd7 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:375:36
    #31 0x7f2d02188c16 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:122:37
    #32 0x7f2d02188c16 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
    #33 0x7f2d0219a1c5 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1200:14
    #34 0x7f2d021a027a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #35 0x7f2d02aa2626 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #36 0x7f2d02a0eb43 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #37 0x7f2d02a0ea5d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #38 0x7f2d02a0ea5d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #39 0x7f2d06776e18 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #40 0x7f2d07f72f23 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:902:20
    #41 0x7f2d02aa3509 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #42 0x7f2d02a0eb43 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #43 0x7f2d02a0ea5d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #44 0x7f2d02a0ea5d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #45 0x7f2d07f72b08 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:733:34
    #46 0x5593cb60ad87 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #47 0x5593cb60ad87 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:305:18
    #48 0x7f2d167400b2 in __libc_start_main /build/glibc-ZN95T4/glibc-2.31/csu/../csu/libc-start.c:308:16

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201215213427-914398229db8.
The bug appears to have been introduced in the following build range:

Start: fd1683e51ec5eae6a5c5b516492d6a81eb06e7ea (20201120163152)
End: 8d8561344299516728989604a0c7a14d2bff91e7 (20201121092754)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=fd1683e51ec5eae6a5c5b516492d6a81eb06e7ea&tochange=8d8561344299516728989604a0c7a14d2bff91e7

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

:boris, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 3

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/e8ryoHbkdVehaDV5CB8TUw/index.html

Comment 4

[Boris Chiou [:boris]]

Attachment: Bug 1682032 - aspect-ratio should be applied for auto block-size by default.

Based on the discussion in
https://github.com/w3c/csswg-drafts/issues/5721#issuecomment-781702159,
the default ratio-dependent axis is block axis (though the spec issue is
for replaced elements, but I think the behavior should be consistent).
So we should apply aspect-ratio not matter what the inline size is (e.g.
nscoord_MAX, auto or other values).

In the test case, the min-block-size is 1073741823, and its transferred
min-inline-size is also 1073741823, so we get a 1073741823 (i.e. nscoord_MAX)
preferred inline size (i.e. result.ISize(aWM) == NS_UNCONSTRAINEDSIZE).
However, we still have to apply aspect-ratio because the style of block-size is
auto, and so mFlags.mBSizeIsSetByAspectRatio should be set unconditionally here.

I still keep this assertion because it helps me catch this potential
issue. (Just reword it anyway.)

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c6732dd81399
aspect-ratio should be applied for auto block-size by default. r=emilio

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/c6732dd81399

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20210311093001-bd8121e747b5.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.