1690163 - Assertion failure: found (should have found our rendered legend), at src/layout/base/nsCSSFrameConstructor.cpp:9358

Status: VERIFIED FIXED

(Core :: Layout, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

#0 0x7fbc1a5f7da8 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:9358:5
#1 0x7fbc1a601f26 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:3723:9
#2 0x7fbc1a60669d in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:5587:3
#3 0x7fbc1a5f7f06 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:9385:5
#4 0x7fbc1a5f79c4 in nsCSSFrameConstructor::ConstructTable(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:1894:5
#5 0x7fbc1a60186d in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:3577:16
#6 0x7fbc1a60669d in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:5587:3
#7 0x7fbc1a5f7f06 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:9385:5
#8 0x7fbc1a5f8c9b in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameList&, bool, nsIFrame*) src/layout/base/nsCSSFrameConstructor.cpp:9550:3
#9 0x7fbc1a5ff6ac in nsCSSFrameConstructor::ConstructFieldSetFrame(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:3059:5
#10 0x7fbc1a60186d in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:3577:16
#11 0x7fbc1a60669d in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:5587:3
#12 0x7fbc1a5f7f06 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) src/layout/base/nsCSSFrameConstructor.cpp:9385:5
#13 0x7fbc1a5f8c9b in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameList&, bool, nsIFrame*) src/layout/base/nsCSSFrameConstructor.cpp:9550:3
#14 0x7fbc1a5fc79e in nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameList&, nsIFrame*) src/layout/base/nsCSSFrameConstructor.cpp:10430:3
#15 0x7fbc1a5fae9f in nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*) src/layout/base/nsCSSFrameConstructor.cpp:2357:5
#16 0x7fbc1a609d27 in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:6879:9
#17 0x7fbc1a5cfe74 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) src/layout/base/RestyleManager.cpp:1488:25
#18 0x7fbc1a5d6c3b in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) src/layout/base/RestyleManager.cpp:3032:9
#19 0x7fbc1a5b0907 in ProcessPendingRestyles src/layout/base/RestyleManager.cpp:3111:3
#20 0x7fbc1a5b0907 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4209:39
#21 0x7fbc1780ecab in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1422:5
#22 0x7fbc1780ecab in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) src/dom/base/Document.cpp:10355:16
#23 0x7fbc178d492d in mozilla::dom::Selection::Modify(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) src/dom/base/Selection.cpp:3276:10
#24 0x7fbc18223f22 in mozilla::dom::Selection_Binding::modify(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/SelectionBinding.cpp:1112:24
#25 0x7fbc18ba5aba in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3233:13
#26 0x7fbc1bc4e391 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:503:13
#27 0x7fbc1bc4dc24 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:594:12
#28 0x7fbc1bc4f343 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:647:10
#29 0x7fbc1c689ffd in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) src/js/src/jit/BaselineIC.cpp:1841:10
#30 0x3738c0ac6ba2  (<unknown module>)

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/Y2RwTJDI4ZUIrjB5SSl-ig/index.html

Comment 2

[Mats Palmgren (inactive)]

Attachment: frame tree

Comment 3

[Mats Palmgren (inactive)]

Here's the resulting frame tree (from a non-debug build to avoid the assertion):

              FieldSet(fieldset)(0)@7f4f64790cb0 parent=7f4f64790b98 (x=120, y=0, w=60240, h=1176) [content=7f4f63d07020] [cs=7f4f65e6e3d8] <
                Block(legend)(1)@7f4f64790e30 parent=7f4f64790cb0 next=7f4f64790d68 (x=840, y=60, w=240, h=0) [content=7f4f63d02670] [cs=7f4f65e6e4c8] <
                >
                Block(fieldset)(0)@7f4f64790d68 parent=7f4f64790cb0 (x=120, y=120, w=60000, h=936) [content=7f4f63d07020] [cs=7f4f65e6e5b8:-moz-fieldset-content] <
                  line@7f4f64790ef8 count=1 state=block,clean,prevmarginclean,not-impacted,not-wrapped,before:nobr,after:nobr[0x108] (x=720, y=336, w=0, h=0) <
                    TableWrapper(fieldset)(0)@7f4f64790f58 parent=7f4f64790d68 (x=720, y=336, w=0, h=0) [content=7f4f63d07020] [cs=7f4f7cc88c58:-moz-table-wrapper] <
                      Table(fieldset)(0)@7f4f64791008 parent=7f4f64790f58 (x=0, y=0, w=0, h=0) [content=7f4f63d07020] [cs=7f4f7cc88988:-moz-table] <
                        ColGroupList@7f4f64791140 <
                          TableColGroup(fieldset)(0)@7f4f64791150 parent=7f4f64791008 (x=0, y=0, w=0, h=0) [content=7f4f63d07020] [cs=7f4f7cc88e38:-moz-table-column-group] <
                            TableCol(col)(2)@7f4f64791200 parent=7f4f64791150 (x=0, y=0, w=0, h=0) [content=7f4f63d02700] [cs=7f4f65e6ef18]
                          >
                        >
                      >
                    >
                  >
                >
              >

which looks correct to me at first glance.

The assertion happens when aParentFrame is TableColGroup(fieldset).
We do pickup the <legend> construction item correctly when aParentFrame is Block(fieldset).

Hmm, I thought aParentIsWrapperAnonBox would be true for all the other frames...

Comment 4

[Mats Palmgren (inactive)]

Interesting:
https://searchfox.org/mozilla-central/rev/fd853f4aea89186efdb368e759a71b7a90c2b89c/layout/base/nsCSSFrameConstructor.cpp#8600-8601,8604
I need to sleep on this... :-)

Comment 5

[Mats Palmgren (inactive)]

Attachment: Bug 1690163 - Account for pseudo TableColGroupFrame not being marked as anon wrapper boxes. r=emilio

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/619a535e62ef
Account for pseudo TableColGroupFrame not being marked as anon wrapper boxes.  r=emilio

Comment 7

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/619a535e62ef

Comment 8

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20210204093834-32690d048b75.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.