1693616 - Hang during reflow, with multi-column and "box-decoration-break: clone"

Status: RESOLVED FIXED

(Core :: Layout: Columns, defect)

Description

[Tyson Smith [:tsmith]]

Hang/Slow Test

The attached test case causes the browser to become unresponsive for more than a short period of time.

Why is this a problem?

Temporary unresponsiveness or complete hangs have a negative impact on the user experience. These issues also have a negative impact on the efficiency and effectiveness of test suites and fuzzers.

False Positive?

Fuzzers can generate unrealistic test cases which for example may pass large values to APIs leading to slow downs or hangs. Please review the code in question to verify no further optimizations can be made and reasonable limits are in place.

Details

This test case only reproduces the issue consistently when run with Xvfb. This is how most of our fuzzers are run.

To reproduce the issue with Grizzly:
python3 -m grizzly.replay <browser-bin> testcase.html --ignore memory -t 60 --xvfb

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/s0090rv3PN-AtOXwl78i_g/index.html

In this trace SIGABRT is sent to the busiest process after 90 seconds.

Comment 2

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Comment 3

[Daniel Holbert [:dholbert]]

mozregression says the hang (for this testcase at least) started with bug 1656004's patch.

Regression range is:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5be393d34bbdcbb4a45d3000a32a6eb3f3d51fef&tochange=4dd764090184ab677567b39dd8805742368d2f5e

Comment 4

[Daniel Holbert [:dholbert]]

Never mind, that didn't really regress this. bug 1656004 changed the default padding for option elements; and I can reproduce the hang in much older builds (e.g. Nightly 2016-01-01) if I simply specify some padding on the option element in the testcase.

Nightly 2015-01-01 is fine, though, so this does still seem to be an (old) regression.

Comment 5

[Daniel Holbert [:dholbert]]

Attachment: testcase 2 (manually specified some padding, and added moz-prefixed column syntax for the benefit of older builds)

Comment 6

[Daniel Holbert [:dholbert]]

Regression range for testcase 2:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2cb22c058add&tochange=3094601af679

...but if I add an additional 1px of border-padding (coming up as testcase 3), then this hang goes back further, to when we enabled the box-decoration:break pref by default. And if I run mozregression with that pref manually set to true, then this goes back to bug 998535.

Basically, this seems to be multicol column-height-balancing getting confused with box-decoration-break:clone.

Comment 7

[Daniel Holbert [:dholbert]]

Attachment: testcase 3 (added a border on #b which makes the hang go a bit further back)

Comment 8

[Daniel Holbert [:dholbert]]

Attachment: testcase 4 (just divs, no option element)

(one last testcase which reproduces the issue in current Nightly without needing any option elements; just div.)

Comment 9

[Daniel Holbert [:dholbert]]

TYLin, maybe you could take a look if you get a chance?

Comment 10

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: testcase 5 (give #a and #b definite height)

Thanks Daniel. You reduced the testcase further so that the issue is very easy identified.

The problem is that with box-decoration-break: clone, we need to replicate border and padding in every column. However, the available block-size is too short, and the block-size of the border and padding is already saturated the available block-size. We end up not consuming any content block-size of the block to be fragmented, trapping in nsColumnSetFrame::ReflowChildren and creating the column contents forever.

We have an incomplete attempt here, but it's not helpful regardless of the box-decoration-break value with a large border and padding.

Comment 11

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1693616 - Add wpt reftest and crashtests for box-decoration-break:clone.

The hang during reflow is fixed by bug 1754598.

firefox-bug1693616-001-crash.html and firefox-bug1693616-002-crash.html are
adapted from bug 1693616 testcase 4 and 5, respectively.

WARNING: All the tests added in patch can hang the Firefox builds without the
patch in bug 1754598.

Depends on D138967

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8f076bbafd0b
Add wpt reftest and crashtests for box-decoration-break:clone. r=dholbert

Comment 13

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/32913 for changes under testing/web-platform/tests

Comment 14

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/8f076bbafd0b

Comment 15

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot