Closed Bug 1800907 Opened 2 years ago Closed 2 years ago

`OverflowAreas::UnionAllWith` Can Be Erroneously Overwritten When Default-Constructed OverflowAreas supplied

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
110 Branch
Tracking Flags:
Tracking Status
firefox110 --- fixed

People

(Reporter: dshin, Assigned: dshin)

References

Details

Attachments

(1 file)

Bug 1800907 - Do not `UnionRect` empty rects in `OverflowAreas::Union*`. r=#layout-reviewers
48 bytes, text/x-phabricator-request
Details | Review

Found while investigating assertions that got triggered as part of bug 1800719.

  1. Have OverflowAreas with one axis' length set to 0.
  2. Call OverflowAreas::UnionWith(OverflowAreas())

Expected: Nonzero axis is preserved
Actual: The resulting OverflowAreas has both axes length at 0.

See Also: → 1800719

(Specifically caught here where ocBounds was constructed but not touched)

Assignee: nobody → dshin

Previously, when current overflow area has one axis at zero size, calling
OverflowAreas::Union* with a rect with both axes at zero would overwrite
the axis with non-zero size.

Component: Layout: Scrolling and Overflow → Layout
Severity: -- → S3
Pushed by dshin@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/911f05c487a6 Do not `UnionRect` empty rects in `OverflowAreas::Union*`. r=jwatt
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/37388 for changes under testing/web-platform/tests

Backed out changeset 911f05c487a6 (Bug 1800907) for causing assertions on 266445-1.html.

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=911f05c487a66b853d6c3564fbe55c707c728361&selectedTaskRun=c4KD0SfRTceOdWbWXlApVw.0

Backout link: https://hg.mozilla.org/integration/autoland/rev/58f36d1b73c53785b92ce1c96598826ce536099c

Failure log: https://treeherder.mozilla.org/logviewer?job_id=398975841&repo=autoland

ASSERTION: Illegal width for an overflow area!: 'aOverflowAreas.Overflow(otype).width >= 0', file /builds/worker/checkouts/gecko/layout/generic/nsLineBox.cpp:509

12-07 23:25:12.066  3449  3464 I Gecko   : REFTEST TEST-LOAD | http://10.0.2.2:8854/tests/layout/base/crashtests/266445-1.html | 1543 / 3908 (39%)
12-07 23:25:12.066  3449  3464 I Gecko   : 
12-07 23:25:12.066  3449  3464 I Gecko   : {"action":"log","time":1670455512066,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"START http://10.0.2.2:8854/tests/layout/base/crashtests/266445-1.html"}
12-07 23:25:12.127  3475  3491 D GeckoViewClipboardPermissionChild[C]: handleEvent: pagehide
12-07 23:25:12.129  3449  3464 D GeckoViewClipboardPermissionParent: receiveMessage: DispatcherMessage
12-07 23:25:12.129  3449  3449 D GeckoSession: handleMessage: GeckoView:DismissClipboardPermissionRequest
12-07 23:25:12.138  3475  3491 W Web Content: [JavaScript Warning: "This page is in Quirks Mode. Page layout may be impacted. For Standards Mode use “<!DOCTYPE html>”." {file: "http://10.0.2.2:8854/tests/layout/base/crashtests/266445-1.html" line: 0}]
12-07 23:25:12.157  3449  3464 D GeckoViewContent: handleEvent: pagetitlechanged
12-07 23:25:12.159  3475  3491 I Gecko   : [Child 3475, Main Thread] ###!!! ASSERTION: Illegal width for an overflow area!: 'aOverflowAreas.Overflow(otype).width >= 0', file /builds/worker/checkouts/gecko/layout/generic/nsLineBox.cpp:509
12-07 23:25:12.165  3475  3491 I Gecko   : [Child 3475, Main Thread] ###!!! ASSERTION: Illegal height for an overflow area!: 'aOverflowAreas.Overflow(otype).height >= 0', file /builds/worker/checkouts/gecko/layout/generic/nsLineBox.cpp:511
12-07 23:25:12.169  3475  3491 I Gecko   : [Child 3475, Main Thread] ###!!! ASSERTION: Illegal width for an overflow area!: 'aOverflowAreas.Overflow(otype).width >= 0', file /builds/worker/checkouts/gecko/layout/generic/nsLineBox.cpp:509
12-07 23:25:12.174  3475  3491 I Gecko   : [Child 3475, Main Thread] ###!!! ASSERTION: Illegal height for an overflow area!: 'aOverflowAreas.Overflow(otype).height >= 0', file /builds/worker/checkouts/gecko/layout/generic/nsLineBox.cpp:511
12-07 23:25:12.190  3449  3464 I Gecko   : 
12-07 23:25:12.190  3449  3464 I Gecko   : {"action":"log","time":1670455512190,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] OnDocumentLoad triggering AfterOnLoadScripts"}
12-07 23:25:12.230  3449  3464 I Gecko   : 
12-07 23:25:12.230  3449  3464 I Gecko   : {"action":"log","time":1670455512230,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"Initializing canvas snapshot"}
12-07 23:25:12.233  3475  3491 W Web Content: [JavaScript Warning: "Use of Mutation Events is deprecated. Use MutationObserver instead." {file: "resource://reftest/reftest-content.js" line: 899}]
12-07 23:25:12.233  3449  3464 I Gecko   : 
12-07 23:25:12.233  3449  3464 I Gecko   : {"action":"log","time":1670455512233,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] AfterOnLoadScripts belatedly entering WaitForTestEnd"}
12-07 23:25:12.234  3449  3464 I Gecko   : 
12-07 23:25:12.234  3449  3464 I Gecko   : {"action":"log","time":1670455512234,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] WaitForTestEnd: Adding listeners"}
12-07 23:25:12.235  3449  3464 I Gecko   : 
12-07 23:25:12.235  3449  3464 I Gecko   : {"action":"log","time":1670455512235,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"Initializing canvas snapshot"}
12-07 23:25:12.238  3449  3464 I Gecko   : 
12-07 23:25:12.238  3449  3464 I Gecko   : {"action":"log","time":1670455512238,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress"}
12-07 23:25:12.246  3449  3464 I Gecko   : 
12-07 23:25:12.246  3449  3464 I Gecko   : {"action":"log","time":1670455512246,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress: STATE_WAITING_TO_FIRE_INVALIDATE_EVENT"}
12-07 23:25:12.247  3449  3464 I Gecko   : 
12-07 23:25:12.247  3449  3464 I Gecko   : {"action":"log","time":1670455512247,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress: dispatching MozReftestInvalidate"}
12-07 23:25:12.248  3449  3464 I Gecko   : 
12-07 23:25:12.248  3449  3464 I Gecko   : {"action":"log","time":1670455512248,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress"}
12-07 23:25:12.257  3449  3464 I Gecko   : 
12-07 23:25:12.257  3449  3464 I Gecko   : {"action":"log","time":1670455512257,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress: STATE_WAITING_FOR_REFTEST_WAIT_REMOVAL"}
12-07 23:25:12.259  3449  3464 I Gecko   : 
12-07 23:25:12.259  3449  3464 I Gecko   : {"action":"log","time":1670455512258,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress"}
12-07 23:25:12.265  3449  3464 I Gecko   : 
12-07 23:25:12.265  3449  3464 I Gecko   : {"action":"log","time":1670455512265,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress: STATE_WAITING_FOR_SPELL_CHECKS"}
12-07 23:25:12.267  3449  3464 I Gecko   : 
12-07 23:25:12.267  3449  3464 I Gecko   : {"action":"log","time":1670455512266,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress: STATE_WAITING_FOR_APZ_FLUSH"}
12-07 23:25:12.268  3449  3464 I Gecko   : 
12-07 23:25:12.268  3449  3464 I Gecko   : {"action":"log","time":1670455512268,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress: APZ flush not required"}
12-07 23:25:12.269  3449  3464 I Gecko   : 
12-07 23:25:12.269  3449  3464 I Gecko   : {"action":"log","time":1670455512269,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress"}
12-07 23:25:12.270  3449  3464 I Gecko   : 
12-07 23:25:12.270  3449  3464 I Gecko   : {"action":"log","time":1670455512270,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress: STATE_WAITING_TO_FINISH"}
12-07 23:25:12.271  3449  3464 I Gecko   : 
12-07 23:25:12.271  3449  3464 I Gecko   : {"action":"log","time":1670455512271,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress: Doing sync flush to compositor"}
12-07 23:25:12.272  3449  3464 I Gecko   : 
12-07 23:25:12.272  3449  3464 I Gecko   : {"action":"log","time":1670455512272,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] MakeProgress: Completed"}
12-07 23:25:12.273  3449  3464 I Gecko   : 
12-07 23:25:12.273  3449  3464 I Gecko   : {"action":"log","time":1670455512273,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"[CONTENT] RecordResult fired"}
12-07 23:25:12.275  3449  3464 I Gecko   : 
12-07 23:25:12.275  3449  3464 I Gecko   : {"action":"log","time":1670455512274,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"RecordResult fired"}
12-07 23:25:12.275  3449  3464 I Gecko   : 
12-07 23:25:12.275  3449  3464 I Gecko   : {"action":"test_status","time":1670455512275,"thread":null,"pid":null,"source":"reftest","test":"layout/base/crashtests/266445-1.html","subtest":"(LOAD ONLY)","status":"PASS"}
12-07 23:25:12.275  3449  3464 I Gecko   : 
12-07 23:25:12.275  3449  3464 I Gecko   : {"action":"test_end","time":1670455512275,"thread":null,"pid":null,"source":"reftest","test":"layout/base/crashtests/266445-1.html","status":"OK"}
12-07 23:25:12.275  3449  3464 I Gecko   : 
12-07 23:25:12.275  3449  3464 I Gecko   : {"action":"log","time":1670455512275,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"Loading a blank page"}
12-07 23:25:12.297  3475  3491 D GeckoViewClipboardPermissionChild[C]: handleEvent: pagehide
12-07 23:25:12.300  3449  3464 D GeckoViewClipboardPermissionParent: receiveMessage: DispatcherMessage
12-07 23:25:12.301  3449  3449 D GeckoSession: handleMessage: GeckoView:DismissClipboardPermissionRequest
12-07 23:25:12.317  3475  3491 W Web Content: [JavaScript Warning: "This page is in Quirks Mode. Page layout may be impacted. For Standards Mode use “<!DOCTYPE html>”." {file: "data:text/html;charset=UTF-8,%3C%21%2D%2DCLEAR%2D%2D%3E" line: 0}]
12-07 23:25:12.341  3449  3464 D GeckoViewContent: handleEvent: pagetitlechanged
12-07 23:25:12.357  3449  3464 I Gecko   : 
12-07 23:25:12.357  3449  3464 I Gecko   : {"action":"assertion_count","time":1670455512357,"thread":null,"pid":null,"source":"reftest","test":"layout/base/crashtests/266445-1.html","min_expected":0,"max_expected":0,"count":4}
12-07 23:25:12.357  3449  3464 I Gecko   : 
12-07 23:25:12.357  3449  3464 I Gecko   : {"action":"test_start","time":1670455512357,"thread":null,"pid":null,"source":"reftest","test":"layout/base/crashtests/266445-2.html"}
12-07 23:25:12.358  3449  3464 I Gecko   : REFTEST TEST-LOAD | http://10.0.2.2:8854/tests/layout/base/crashtests/266445-2.html | 1544 / 3908 (39%)
12-07 23:25:12.358  3449  3464 I Gecko   : 
12-07 23:25:12.358  3449  3464 I Gecko   : {"action":"log","time":1670455512358,"thread":null,"pid":null,"source":"reftest","level":"DEBUG","message":"START http://10.0.2.2:8854/tests/layout/base/crashtests/266445-2.html"}
12-07 23:25:12.418  3475  3491 D GeckoViewClipboardPermissionChild[C]: handleEvent: pagehide
12-07 23:25:12.421  3449  3464 D GeckoViewClipboardPermissionParent: receiveMessage: DispatcherMessage
12-07 23:25:12.421  3449  3449 D GeckoSession: handleMessage: GeckoView:DismissClipboardPermissionRequest
Flags: needinfo?(dshin)
Upstream PR was closed without merging
Pushed by dshin@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/2967a2f9684a Do not `UnionRect` empty rects in `OverflowAreas::Union*`. r=jwatt
Flags: needinfo?(dshin)

https://hg.mozilla.org/mozilla-central/rev/2967a2f9684a

Status: NEW → RESOLVED
Closed: 2 years ago
status-firefox110: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 110 Branch
Upstream PR merged by moz-wptsync-bot
Regressions: 1990786
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: