1751828 - nsCoord.h:303:62: runtime error: 7.40593e+09 is outside the range of representable values of type 'int'

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect, P3)

Description

[Tyson Smith [:tsmith]]

This was found by enabling the float-cast-overflow check in UBSan and running existing tests. This type of issue can create inconsistencies across platforms, architectures and optimization levels.

Found with m-c 20220112-38711fbec2b.

To enable this check add the following to your mozconfig:

ac_add_options --enable-undefined-sanitizer="float-cast-overflow"

This issue is found by the existing test: widget/tests/browser/browser_test_clipboardcache.js

INFO - TEST-START | widget/tests/browser/browser_test_clipboardcache.js
INFO - GECKO(7486) | /builds/worker/workspace/obj-build/dist/include/nsCoord.h:303:62: runtime error: 7.40593e+09 is outside the range of representable values of type 'int'
INFO - GECKO(7486) |     #0 0x7fb8c10c2eb1 in nsTextFrame::ReflowText(nsLineLayout&, int, mozilla::gfx::DrawTarget*, mozilla::ReflowOutput&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsTextFrame.cpp
INFO - GECKO(7486) |     #1 0x7fb8c10bca7a in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:878:40
INFO - GECKO(7486) |     #2 0x7fb8c0eab9c1 in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4565:15
INFO - GECKO(7486) |     #3 0x7fb8c0eaa9cd in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4367:5
INFO - GECKO(7486) |     #4 0x7fb8c0ea3c4e in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4252:9
INFO - GECKO(7486) |     #5 0x7fb8c0e9d3f9 in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3229:5
INFO - GECKO(7486) |     #6 0x7fb8c0e94dbe in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2763:7
INFO - GECKO(7486) |     #7 0x7fb8c0e8e069 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1394:3
INFO - GECKO(7486) |     #8 0x7fb8c0ea8532 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:288:11
INFO - GECKO(7486) |     #9 0x7fb8c0ea056c in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3886:11
INFO - GECKO(7486) |     #10 0x7fb8c0e9d546 in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3226:5
INFO - GECKO(7486) |     #11 0x7fb8c0e94dbe in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2763:7
INFO - GECKO(7486) |     #12 0x7fb8c0e8e069 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1394:3
INFO - GECKO(7486) |     #13 0x7fb8c0ec6cbd in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1000:14
INFO - GECKO(7486) |     #14 0x7fb8c0ec5497 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:787:7
INFO - GECKO(7486) |     #15 0x7fb8c0ec6cbd in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1000:14
INFO - GECKO(7486) |     #16 0x7fb8c0f51e56 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:839:3
INFO - GECKO(7486) |     #17 0x7fb8c0f53459 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:974:3
INFO - GECKO(7486) |     #18 0x7fb8c0f59e24 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:1396:3
INFO - GECKO(7486) |     #19 0x7fb8c0e7dc2b in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1040:14
INFO - GECKO(7486) |     #20 0x7fb8c0e7d259 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:374:7
INFO - GECKO(7486) |     #21 0x7fb8c0cc0099 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9636:11
INFO - GECKO(7486) |     #22 0x7fb8c0cd1d97 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9807:24
INFO - GECKO(7486) |     #23 0x7fb8c0cd02a5 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4299:11
INFO - GECKO(7486) |     #24 0x7fb8bc2d6ede in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1452:5
INFO - GECKO(7486) |     #25 0x7fb8bc2d6ede in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:10746:16
INFO - GECKO(7486) |     #26 0x7fb8be654bc0 in InitBasic /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:247:16
INFO - GECKO(7486) |     #27 0x7fb8be654bc0 in mozilla::ContentEventHandler::InitCommon(mozilla::SelectionType, bool) /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:317:17
INFO - GECKO(7486) |     #28 0x7fb8be655606 in mozilla::ContentEventHandler::Init(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:388:17
INFO - GECKO(7486) |     #29 0x7fb8be65bff5 in mozilla::ContentEventHandler::OnQueryTextContent(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:1413:17
INFO - GECKO(7486) |     #30 0x7fb8be65b573 in mozilla::ContentEventHandler::HandleQueryContentEvent(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:1262:12
INFO - GECKO(7486) |     #31 0x7fb8be6e019d in mozilla::IMEContentObserver::HandleQueryContentEvent(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:654:25
INFO - GECKO(7486) |     #32 0x7fb8be61876e in mozilla::EventStateManager::HandleQueryContentEvent(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:1043:22
INFO - GECKO(7486) |     #33 0x7fb8be616e7b in mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:614:5
INFO - GECKO(7486) |     #34 0x7fb8c0cef70d in mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager*, mozilla::WidgetEvent*, bool, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8246:39
INFO - GECKO(7486) |     #35 0x7fb8c0ce9631 in mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8215:17
INFO - GECKO(7486) |     #36 0x7fb8c0ce9ddb in mozilla::PresShell::EventHandler::HandleEventAtFocusedContent(mozilla::WidgetGUIEvent*, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7944:7
INFO - GECKO(7486) |     #37 0x7fb8c0ce7276 in mozilla::PresShell::EventHandler::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6961:12
INFO - GECKO(7486) |     #38 0x7fb8c0ce5e39 in mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6879:23
INFO - GECKO(7486) |     #39 0x7fb8c0675e9d in nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:685:18
INFO - GECKO(7486) |     #40 0x7fb8c0675ad5 in nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) /builds/worker/checkouts/gecko/view/nsView.cpp:1129:9
INFO - GECKO(7486) |     #41 0x7fb8c06f2e61 in mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) /builds/worker/checkouts/gecko/widget/PuppetWidget.cpp:353:37
INFO - GECKO(7486) |     #42 0x7fb8c06a2393 in mozilla::ContentCacheInChild::CacheText(nsIWidget*, mozilla::widget::IMENotification const*) /builds/worker/checkouts/gecko/widget/ContentCache.cpp:222:12
INFO - GECKO(7486) |     #43 0x7fb8c06f7941 in mozilla::widget::PuppetWidget::NotifyIMEOfTextChange(mozilla::widget::IMENotification const&) /builds/worker/checkouts/gecko/widget/PuppetWidget.cpp:813:7
INFO - GECKO(7486) |     #44 0x7fb8c0720809 in mozilla::widget::TextEventDispatcher::NotifyIME(mozilla::widget::IMENotification const&) /builds/worker/checkouts/gecko/widget/TextEventDispatcher.cpp:475:40
INFO - GECKO(7486) |     #45 0x7fb8c069703f in nsBaseWidget::NotifyIME(mozilla::widget::IMENotification const&) /builds/worker/checkouts/gecko/widget/nsBaseWidget.cpp:1714:43
INFO - GECKO(7486) |     #46 0x7fb8be6ddad0 in mozilla::IMEStateManager::NotifyIME(mozilla::widget::IMENotification const&, nsIWidget*, mozilla::dom::BrowserParent*) /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:1894:22
INFO - GECKO(7486) |     #47 0x7fb8be6e900b in mozilla::IMEContentObserver::IMENotificationSender::SendTextChange() /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:1871:3
INFO - GECKO(7486) |     #48 0x7fb8be6e7dac in mozilla::IMEContentObserver::IMENotificationSender::Run() /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:1613:5
INFO - GECKO(7486) |     #49 0x7fb8c0c5c1d2 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2292:13
INFO - GECKO(7486) |     #50 0x7fb8c0c69f77 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:348:13
INFO - GECKO(7486) |     #51 0x7fb8c0c69f77 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:326:7
INFO - GECKO(7486) |     #52 0x7fb8c0c69cdd in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:342:5
INFO - GECKO(7486) |     #53 0x7fb8c0c69a65 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:780:5
INFO - GECKO(7486) |     #54 0x7fb8c0c690a5 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:703:16
INFO - GECKO(7486) |     #55 0x7fb8c0c68381 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:620:7
INFO - GECKO(7486) |     #56 0x7fb8c0c67e41 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:541:9
INFO - GECKO(7486) |     #57 0x7fb8bfe8eef3 in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:68:15
INFO - GECKO(7486) |     #58 0x7fb8bada1d66 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:208:54
INFO - GECKO(7486) |     #59 0x7fb8baafb599 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6187:32
INFO - GECKO(7486) |     #60 0x7fb8ba6e2c0c in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2039:25
INFO - GECKO(7486) |     #61 0x7fb8ba6e062c in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1964:9
INFO - GECKO(7486) |     #62 0x7fb8ba6e191d in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1823:3
INFO - GECKO(7486) |     #63 0x7fb8ba6e1fe8 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1851:14
INFO - GECKO(7486) |     #64 0x7fb8b9555fa2 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:468:16
INFO - GECKO(7486) |     #65 0x7fb8b951d01d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:771:26
INFO - GECKO(7486) |     #66 0x7fb8b951a8d8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:607:15
INFO - GECKO(7486) |     #67 0x7fb8b951afe9 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:391:36
INFO - GECKO(7486) |     #68 0x7fb8b955e461 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:124:37
INFO - GECKO(7486) |     #69 0x7fb8b955e461 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:531:5
INFO - GECKO(7486) |     #70 0x7fb8b953c9fb in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1195:16
INFO - GECKO(7486) |     #71 0x7fb8b9547b5c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
INFO - GECKO(7486) |     #72 0x7fb8ba6e9848 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
INFO - GECKO(7486) |     #73 0x7fb8ba5f7171 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
INFO - GECKO(7486) |     #74 0x7fb8ba5f7171 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
INFO - GECKO(7486) |     #75 0x7fb8ba5f7171 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
INFO - GECKO(7486) |     #76 0x7fb8c073f8e7 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
INFO - GECKO(7486) |     #77 0x7fb8c4a2d4cf in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:864:20
INFO - GECKO(7486) |     #78 0x7fb8ba5f7171 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
INFO - GECKO(7486) |     #79 0x7fb8ba5f7171 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
INFO - GECKO(7486) |     #80 0x7fb8ba5f7171 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
INFO - GECKO(7486) |     #81 0x7fb8c4a2cef6 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:701:34
INFO - GECKO(7486) |     #82 0x5592fe3666dd in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
INFO - GECKO(7486) |     #83 0x5592fe366afd in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:327:18
INFO - GECKO(7486) |     #84 0x7fb8dbe17b96 in __libc_start_main /tmp/glibc/csu/../csu/libc-start.c:310
INFO - GECKO(7486) |     #85 0x5592fe2b57cc in _start (/builds/worker/workspace/build/application/firefox/firefox+0x577cc)

Comment 1

[Daniel Holbert [:dholbert]]

The huge size here presumably comes from this string, which I think gets pasted into the document:

// Create over 1 MB of sample garbage text. JavaScript strings are represented
// by UTF16 strings, so the size is twice as much as the actual string length.
// This value is chosen such that the size of the memory for the string exceeds
// the kLargeDatasetSize threshold in nsTransferable.h.
// It is also not a round number to reduce the odds of having an accidental
// collisions with another file (since the test below looks at the file size
// to identify the file).
var Ipsum = "0123456789".repeat(1234321);

Ipsum here is 12,343,210 characters long, with no linebreaking opportunities, so it probably gets laid out as a single inline frame after it gets pasted into the document by this testcase.

Ballpark math: assuming each character is ~10px wide, i.e. 600 nscoord app-units wide, then that frame is on the order of 12,343,210 * 600 = 7,405,926,000 app units wide (which looks like it's almost-exactly the 7.40593e+09 value that's reported as not-fitting-in-a-nscoord here).

That is indeed beyond the representable range of a 32-bit signed integer (which caps out at 2^31 which is ~2 billion, less than 7.4 billion).

So this is just a case of ridiculous-huge-content which we indeed can't lay out properly. Per comment 0, "This type of issue can create inconsistencies across platforms, architectures and optimization levels" -- in this case, this is a known limitation of Gecko and not something we're looking to fix.

Comment 2

[Tyson Smith [:tsmith]]

Let's add a suppression since this is failing in CI and we want to enable this check by default.

Comment 3

[Daniel Holbert [:dholbert]]

Sounds good! Reclassifying to match component of bug 1749864 (I assume that's the component whose umbrella the suppression would fall under), to take this out of the Layout triage queue.

Comment 4

[Mathew Hodson]

Attachment: Bug 1751828 - Clamp the inline size when reflowing text. r?dholbert

Comment 5

[Daniel Holbert [:dholbert]]

(In reply to Daniel Holbert [:dholbert] from comment #3)

Sounds good! Reclassifying to match component of bug 1749864 (I assume that's the component whose umbrella the suppression would fall under), to take this out of the Layout triage queue.

--> Reclassifying back to Layout|Text, since we ended up with a fix in layout code after all.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d161da1543bc
Clamp the inline size when reflowing text. r=dholbert

Comment 7

[Marian-Vasile Laza]

Backed out changeset d161da1543bc (Bug 1751828) for causing crashtest failures on 459968.html.
Backout link
Push with failures
Failure Log

Comment 8

[Daniel Holbert [:dholbert]]

Aha, it looks like this patch's clamping causes a change to our assertion counts on some reftests.

Here's a link to a slightly-less-filtered version of one of the pushes, from while this was still in-tree (filtered to show debug crashtest runs on all platforms:
https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&searchStr=debug%2Ccrashtest&revision=2badefb067b2950db2eec1d502559d141fcf8764
(Ignore the green "Wc" runs; those are web-platform-test crashtest runs, which is a different set of tests)

Based on that run, it looks like this patch has these effects on test assertion counts:

• It apparently avoids an assertion on 459968.html and 798020-1.html
• And it causes 3581 assertions on 478185-1.html, on Windows (vs. 1591 assertions on Linux, Mac, and Android). That 1591 / 3581 count seems to be precise, from clicking around the logs - it doesn't seem to ever be higher or lower than that.

The new assertions are unsurprising; they're Unconstrained inline line size in bidi frame reordering (which is about unexpectedly encountering the sentinel value nscoord_MAX which is what we happen to be clamping to here). And there are probably so many of them because this testcase has a multicol element with bogus huge styling on its contents, which probably triggers lots of columns to be generated (each of which probably triggers a handful of copies of this assertion).

So I think we just need to update the assertion annotations in these tests' associated crashtest.list files; we need to remove the annotations for the two tests whose assertion-counts have gone to 0, and adding an asserts(1591-3581) annotation for 478185-1.html.

Comment 9

[Daniel Holbert [:dholbert]]

And that should happen atomically as part of this patch. Mathew, would you mind updating the patch to do that? Might be worth doing a try run to be on the safe side, e.g. I think this should work:

./mach try fuzzy -q "'debug-crashtest | 'debug-geckoview-crashtest"

And then we should be good to re-land.

Comment 10

[Mathew Hodson]

I updated the asserts, but I don't have push access to do a try run.

Comment 11

[Daniel Holbert [:dholbert]]

Ah, I see -- we can fix that, if you like! Pushing to try just requires Level 1 commit access, and you just need one person to vouch for you (which I'll gladly do). See https://www.mozilla.org/en-US/about/governance/policies/commit/ for the process -- essentially just file a bug, provide your SSH public key for push authentication, agree to abide by the policies, and get a comment from a voucher.

No pressure, though. For now, I pushed this and bug 1751107 to Try here (with a handful of debug-mode testruns):
https://treeherder.mozilla.org/#/jobs?repo=try&revision=f37290bbf4d2dabf37772ec306fd0a17352dee7d

If that looks good, I'll go ahead and land these within the next day. (Ticking needinfo to remind myself.)

Comment 12

[Daniel Holbert [:dholbert]]

(In reply to Daniel Holbert [:dholbert] from comment #11)

For now, I pushed this and bug 1751107 to Try here (with a handful of debug-mode testruns):
https://treeherder.mozilla.org/#/jobs?repo=try&revision=f37290bbf4d2dabf37772ec306fd0a17352dee7d

er, sorry, I got mixed up when rebasing - that Try push only included bug 1751107's patch, and didn't have this one. Here's a try push with this bug's patch, using the command from comment 9 to exercise the crashtest runs that failed in the first landing:
https://treeherder.mozilla.org/jobs?repo=try&revision=2f7fc24efc20734f1337f948877d4c8e640b53ea

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/492c67e71faf
Clamp the inline size when reflowing text. r=dholbert

Comment 14

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/492c67e71faf

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.