Closed Bug 1833523 Opened 2 years ago Closed 1 month ago

Assertion failure: aNewStyle.GetPseudoType() == mComputedStyle->GetPseudoType() || (mComputedStyle->GetPseudoType() == PseudoStyleType::firstLine ... at /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:1471

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1927270
Milestone:
136 Branch
Tracking Flags:
Tracking Status
firefox-esr102 --- unaffected
firefox-esr115 --- wontfix
firefox-esr128 --- wontfix
firefox113 --- wontfix
firefox114 --- wontfix
firefox115 --- wontfix
firefox116 --- wontfix
firefox117 --- wontfix
firefox118 --- wontfix
firefox134 --- wontfix
firefox135 --- wontfix
firefox136 --- fixed

People

(Reporter: tsmith, Assigned: TYLin)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files, 1 obsolete file)

testcase.html
279 bytes, text/html
Details
MOZ_LOG-ColumnSet-5-stderr.txt
1023.97 KB, text/plain
Details
Attached file testcase.html —

Found while fuzzing m-c 20230502-5bcc01abc23d (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: aNewStyle.GetPseudoType() == mComputedStyle->GetPseudoType() || (mComputedStyle->GetPseudoType() == PseudoStyleType::firstLine && aNewStyle.GetPseudoType() == PseudoStyleType::mozLineFrame) || (mComputedStyle->GetPseudoType() == PseudoStyleType::mozText && aNewStyle.GetPseudoType() == PseudoStyleType::firstLetterContinuation) || (mComputedStyle->GetPseudoType() == PseudoStyleType::firstLetterContinuation && aNewStyle.GetPseudoType() == PseudoStyleType::mozText), at /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:1471

#0 0x7f6fdd7fbebc in nsIFrame::AssertNewStyleIsSane(mozilla::ComputedStyle&) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:1458:3
#1 0x7f6fdd682156 in SetComputedStyle /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h:810:7
#2 0x7f6fdd682156 in nsFirstLetterFrame::DrainOverflowFrames(nsPresContext*) /builds/worker/checkouts/gecko/layout/generic/nsFirstLetterFrame.cpp:422:12
#3 0x7f6fdd67fce0 in nsFirstLetterFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsFirstLetterFrame.cpp:194:3
#4 0x7f6fdd8f0079 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:869:13
#5 0x7f6fdd63ca23 in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4753:15
#6 0x7f6fdd63af44 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4588:9
#7 0x7f6fdd632b2d in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4429:9
#8 0x7f6fdd62aee2 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3413:5
#9 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#10 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#11 0x7f6fdd6637c2 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#12 0x7f6fdd668f4f in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:695:7
#13 0x7f6fdd66eac4 in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1240:37
#14 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#15 0x7f6fdd62e3f2 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4066:11
#16 0x7f6fdd62b046 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3410:5
#17 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#18 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#19 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#20 0x7f6fdd64aedf in nsBlockFrame::ReflowFloat(mozilla::BlockReflowState&, mozilla::ReflowInput&, nsIFrame*, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:6797:9
#21 0x7f6fdd592fe2 in mozilla::BlockReflowState::FlowAndPlaceFloat(nsIFrame*, mozilla::Maybe<int>) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:851:13
#22 0x7f6fdd5904c9 in mozilla::BlockReflowState::AddFloat(nsLineLayout*, nsIFrame*, int) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:582:9
#23 0x7f6fdd8f06dd in AddFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.h:156:22
#24 0x7f6fdd8f06dd in TryToPlaceFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:1459:36
#25 0x7f6fdd8f06dd in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:911:23
#26 0x7f6fdd63ca23 in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4753:15
#27 0x7f6fdd63a78a in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4555:5
#28 0x7f6fdd632b2d in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4429:9
#29 0x7f6fdd62aee2 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3413:5
#30 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#31 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#32 0x7f6fdd6637c2 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#33 0x7f6fdd668f4f in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:695:7
#34 0x7f6fdd66eac4 in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1240:37
#35 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#36 0x7f6fdd62e3f2 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4066:11
#37 0x7f6fdd62b046 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3410:5
#38 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#39 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#40 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#41 0x7f6fdd64aedf in nsBlockFrame::ReflowFloat(mozilla::BlockReflowState&, mozilla::ReflowInput&, nsIFrame*, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:6797:9
#42 0x7f6fdd592fe2 in mozilla::BlockReflowState::FlowAndPlaceFloat(nsIFrame*, mozilla::Maybe<int>) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:851:13
#43 0x7f6fdd5904c9 in mozilla::BlockReflowState::AddFloat(nsLineLayout*, nsIFrame*, int) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:582:9
#44 0x7f6fdd8f06dd in AddFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.h:156:22
#45 0x7f6fdd8f06dd in TryToPlaceFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:1459:36
#46 0x7f6fdd8f06dd in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:911:23
#47 0x7f6fdd63ca23 in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4753:15
#48 0x7f6fdd63a78a in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4555:5
#49 0x7f6fdd632b2d in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4429:9
#50 0x7f6fdd62aee2 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3413:5
#51 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#52 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#53 0x7f6fdd6637c2 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#54 0x7f6fdd668f4f in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:695:7
#55 0x7f6fdd66eac4 in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1240:37
#56 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#57 0x7f6fdd62e3f2 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4066:11
#58 0x7f6fdd62b046 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3410:5
#59 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#60 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#61 0x7f6fdd6637c2 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#62 0x7f6fdd9ebcac in nsFieldSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/forms/nsFieldSetFrame.cpp:616:5
#63 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#64 0x7f6fdd64aedf in nsBlockFrame::ReflowFloat(mozilla::BlockReflowState&, mozilla::ReflowInput&, nsIFrame*, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:6797:9
#65 0x7f6fdd592fe2 in mozilla::BlockReflowState::FlowAndPlaceFloat(nsIFrame*, mozilla::Maybe<int>) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:851:13
#66 0x7f6fdd5904c9 in mozilla::BlockReflowState::AddFloat(nsLineLayout*, nsIFrame*, int) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:582:9
#67 0x7f6fdd8f06dd in AddFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.h:156:22
#68 0x7f6fdd8f06dd in TryToPlaceFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:1459:36
#69 0x7f6fdd8f06dd in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:911:23
#70 0x7f6fdd63ca23 in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4753:15
#71 0x7f6fdd63a78a in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4555:5
#72 0x7f6fdd632b2d in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4429:9
#73 0x7f6fdd62aee2 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3413:5
#74 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#75 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#76 0x7f6fdd6637c2 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#77 0x7f6fdd668f4f in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:695:7
#78 0x7f6fdd66eac4 in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1240:37
#79 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#80 0x7f6fdd62e3f2 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4066:11
#81 0x7f6fdd62b046 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3410:5
#82 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#83 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#84 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#85 0x7f6fdd64aedf in nsBlockFrame::ReflowFloat(mozilla::BlockReflowState&, mozilla::ReflowInput&, nsIFrame*, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:6797:9
#86 0x7f6fdd592fe2 in mozilla::BlockReflowState::FlowAndPlaceFloat(nsIFrame*, mozilla::Maybe<int>) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:851:13
#87 0x7f6fdd5904c9 in mozilla::BlockReflowState::AddFloat(nsLineLayout*, nsIFrame*, int) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:582:9
#88 0x7f6fdd8f06dd in AddFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.h:156:22
#89 0x7f6fdd8f06dd in TryToPlaceFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:1459:36
#90 0x7f6fdd8f06dd in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:911:23
#91 0x7f6fdd63ca23 in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4753:15
#92 0x7f6fdd63a78a in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4555:5
#93 0x7f6fdd632b2d in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4429:9
#94 0x7f6fdd62aee2 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3413:5
#95 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#96 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#97 0x7f6fdd6637c2 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#98 0x7f6fdd668f4f in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:695:7
#99 0x7f6fdd66eac4 in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1240:37
#100 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#101 0x7f6fdd62e3f2 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4066:11
#102 0x7f6fdd62b046 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3410:5
#103 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#104 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#105 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#106 0x7f6fdd64aedf in nsBlockFrame::ReflowFloat(mozilla::BlockReflowState&, mozilla::ReflowInput&, nsIFrame*, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:6797:9
#107 0x7f6fdd592fe2 in mozilla::BlockReflowState::FlowAndPlaceFloat(nsIFrame*, mozilla::Maybe<int>) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:851:13
#108 0x7f6fdd5904c9 in mozilla::BlockReflowState::AddFloat(nsLineLayout*, nsIFrame*, int) /builds/worker/checkouts/gecko/layout/generic/BlockReflowState.cpp:582:9
#109 0x7f6fdd8f06dd in AddFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.h:156:22
#110 0x7f6fdd8f06dd in TryToPlaceFloat /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:1459:36
#111 0x7f6fdd8f06dd in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:911:23
#112 0x7f6fdd63ca23 in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4753:15
#113 0x7f6fdd63a78a in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4555:5
#114 0x7f6fdd632b2d in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4429:9
#115 0x7f6fdd62aee2 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3413:5
#116 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#117 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#118 0x7f6fdd6637c2 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#119 0x7f6fdd668f4f in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:695:7
#120 0x7f6fdd66eac4 in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1240:37
#121 0x7f6fdd638814 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#122 0x7f6fdd62e3f2 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4066:11
#123 0x7f6fdd62b046 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3410:5
#124 0x7f6fdd61d5ba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#125 0x7f6fdd61331c in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#126 0x7f6fdd6637c2 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#127 0x7f6fdd661ae8 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:755:7
#128 0x7f6fdd6637c2 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#129 0x7f6fdd71a694 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:937:3
#130 0x7f6fdd71d42d in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:1070:3
#131 0x7f6fdd728795 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:1504:3
#132 0x7f6fdd5fa7ed in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:933:14
#133 0x7f6fdd5f95da in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:385:7
#134 0x7f6fdd39b271 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9643:11
#135 0x7f6fdd3ea4e7 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9821:22
#136 0x7f6fdd3b1e21 in DoFlushLayout /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9892:10
#137 0x7f6fdd3b1e21 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4360:11
#138 0x7f6fd541b228 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1470:5
#139 0x7f6fd541b228 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:10871:16
#140 0x7f6fdd352594 in MaybeFlush /builds/worker/checkouts/gecko/layout/base/AccessibleCaretManager.cpp:1044:12
#141 0x7f6fdd352594 in mozilla::AccessibleCaretManager::MaybeFlushLayout() /builds/worker/checkouts/gecko/layout/base/AccessibleCaretManager.cpp:189:20
#142 0x7f6fdd352064 in mozilla::AccessibleCaretManager::UpdateCarets(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&) /builds/worker/checkouts/gecko/layout/base/AccessibleCaretManager.cpp:196:7
#143 0x7f6fdd351d77 in mozilla::AccessibleCaretManager::OnSelectionChanged(mozilla::dom::Document*, mozilla::dom::Selection*, short) /builds/worker/checkouts/gecko/layout/base/AccessibleCaretManager.cpp:171:3
#144 0x7f6fd569e5a2 in mozilla::dom::Selection::NotifySelectionListeners() /builds/worker/checkouts/gecko/dom/base/Selection.cpp:3546:10
#145 0x7f6fdd6f88de in NotifySelectionListeners /builds/worker/checkouts/gecko/layout/generic/nsFrameSelection.cpp:2259:16
#146 0x7f6fdd6f88de in nsFrameSelection::EndBatchChanges(char const*, short) /builds/worker/checkouts/gecko/layout/generic/nsFrameSelection.cpp:2250:5
#147 0x7f6fd56b28df in mozilla::dom::Selection::EndBatchChanges(char const*, short) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:3575:21
#148 0x7f6fd56ac20e in ~SelectionBatcher /builds/worker/checkouts/gecko/dom/base/Selection.h:1025:19
#149 0x7f6fd56ac20e in mozilla::dom::Selection::SetStartAndEndInternal(mozilla::dom::Selection::InLimiter, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, nsDirection, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:3944:1
#150 0x7f6fd56ab699 in mozilla::dom::Selection::SelectAllChildren(nsINode&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:3040:3
#151 0x7f6fdd4c1b84 in nsDocumentViewer::SelectAll() /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:2452:14
#152 0x7f6fd5882915 in nsSelectionCommand::DoCommand(char const*, nsISupports*) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowCommands.cpp:653:10
#153 0x7f6fd8cc9719 in DoCommand /builds/worker/checkouts/gecko/dom/commandhandler/nsControllerCommandTable.cpp:138:26
#154 0x7f6fd8cc9719 in nsBaseCommandController::DoCommand(char const*) /builds/worker/checkouts/gecko/dom/commandhandler/nsBaseCommandController.cpp:114:24
#155 0x7f6fd8cce944 in nsCommandManager::DoCommand(char const*, nsICommandParams*, mozIDOMWindowProxy*) /builds/worker/checkouts/gecko/dom/commandhandler/nsCommandManager.cpp:193:22
#156 0x7f6fd53ce6ec in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:5504:25
#157 0x7f6fd797f370 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/DocumentBinding.cpp:4126:36
#158 0x7f6fd80d12b7 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3335:13
#159 0x7f6fe2e20d13 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
#160 0x7f6fe2e20d13 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:12
#161 0x7f6fe2e45eb6 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
#162 0x7f6fe2e45eb6 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:652:10
#163 0x7f6fe2e45eb6 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3395:16
#164 0x7f6fe2e1fa65 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:400:10
#165 0x7f6fe2e1fa65 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:458:13
#166 0x7f6fe2e20ecc in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:612:13
#167 0x7f6fe2e22e46 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
#168 0x7f6fe2e22e46 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
#169 0x7f6fe2f8f78b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
#170 0x7f6fd7a6c570 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:65:37
#171 0x7f6fd8f396f6 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#172 0x7f6fd8f375e9 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:199:12
#173 0x7f6fd8ee5c7c in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1298:22
#174 0x7f6fd8ee7900 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1467:17
#175 0x7f6fd8ecfdb4 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:342:17
#176 0x7f6fd8ece206 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:544:16
#177 0x7f6fd8ed37e9 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1132:11
#178 0x7f6fdd4b7af1 in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1082:7
#179 0x7f6fe16d736e in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6393:20
#180 0x7f6fe16d5f3c in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5786:7
#181 0x7f6fe16d8b26 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
#182 0x7f6fd38b5528 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1380:3
#183 0x7f6fd38b3d6d in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:978:14
#184 0x7f6fd38af55e in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:797:9
#185 0x7f6fd38b2553 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:680:5
#186 0x7f6fe172b6ca in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:13847:23
#187 0x7f6fd1a7bb13 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:631:22
#188 0x7f6fd1a7ee44 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:535:10
#189 0x7f6fd4cc6f3b in imgRequestProxy::RemoveFromLoadGroup() /builds/worker/checkouts/gecko/image/imgRequestProxy.cpp:394:15
#190 0x7f6fd4cd3fce in imgRequestProxy::OnLoadComplete(bool) /builds/worker/checkouts/gecko/image/imgRequestProxy.cpp:1075:7
#191 0x7f6fd4c81ca7 in operator() /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:356:13
#192 0x7f6fd4c81ca7 in void mozilla::image::ImageObserverNotifier<mozilla::image::ObserverTable const*>::operator()<void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)>(mozilla::image::ObserverTable const*) /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:286:9
#193 0x7f6fd4c7f174 in void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:355:5
#194 0x7f6fd4c119e1 in operator() /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:374:5
#195 0x7f6fd4c119e1 in Read<(lambda at /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:373:19)> /builds/worker/checkouts/gecko/image/CopyOnWrite.h:155:12
#196 0x7f6fd4c119e1 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:373:14
#197 0x7f6fd4c613b4 in mozilla::image::VectorImage::OnSVGDocumentLoaded() /builds/worker/checkouts/gecko/image/VectorImage.cpp:1491:23
#198 0x7f6fd4c67574 in mozilla::image::SVGLoadEventListener::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/image/VectorImage.cpp:213:13
#199 0x7f6fd8ee5c7c in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1298:22
#200 0x7f6fd8ee7962 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1467:17
#201 0x7f6fd8ecfdb4 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:342:17
#202 0x7f6fd8ece206 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:544:16
#203 0x7f6fd8ed37e9 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1132:11
#204 0x7f6fd8edad91 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp
#205 0x7f6fd58a0023 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:1399:17
#206 0x7f6fd8ef9313 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /builds/worker/checkouts/gecko/dom/events/EventTarget.cpp:180:13
#207 0x7f6fd8e266a1 in DispatchEventOnTarget /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:89:12
#208 0x7f6fd8e266a1 in mozilla::AsyncEventDispatcher::DispatchEventOnTarget(mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::ChromeOnlyDispatch, mozilla::Composed) /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:75:3
#209 0x7f6fd8e26226 in mozilla::AsyncEventDispatcher::Run() /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:62:5
#210 0x7f6fd1646cfa in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
#211 0x7f6fd1637a4a in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:879:26
#212 0x7f6fd1634947 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:702:15
#213 0x7f6fd163522f in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
#214 0x7f6fd164c421 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
#215 0x7f6fd164c421 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#216 0x7f6fd16780ab in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1239:16
#217 0x7f6fd1685b44 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#218 0x7f6fd327eb6e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#219 0x7f6fd30a884a in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10
#220 0x7f6fd30a884a in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#221 0x7f6fd30a884a in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#222 0x7f6fdc9eba59 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#223 0x7f6fe29c6fa8 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:738:20
#224 0x7f6fd30a884a in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10
#225 0x7f6fd30a884a in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#226 0x7f6fd30a884a in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#227 0x7f6fe29c666e in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:673:34
#228 0x55deefa2e73e in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#229 0x55deefa2e73e in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#230 0x7f6ff8029d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#231 0x7f6ff8029e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#232 0x55deef957d58 in _start (/home/user/workspace/browsers/m-c-20230516123447-fuzzing-asan-opt/firefox+0x107d58) (BuildId: 76e6ea0920de4a527af5f3a69612d42efe98a25b)
Flags: in-testsuite?

Debug build has a different assertion:

Assertion failure: aTextNode && aTextNode->IsText(), at /builds/worker/checkouts/gecko/layout/style/ServoStyleSet.cpp:413

#0 0x7f6c846a1c8c in mozilla::ServoStyleSet::ResolveStyleForText(nsIContent*, mozilla::ComputedStyle*) /builds/worker/checkouts/gecko/layout/style/ServoStyleSet.cpp:413:3
#1 0x7f6c84872cfd in nsFirstLetterFrame::DrainOverflowFrames(nsPresContext*) /builds/worker/checkouts/gecko/layout/generic/nsFirstLetterFrame.cpp:421:37
#2 0x7f6c848718fa in nsFirstLetterFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsFirstLetterFrame.cpp:194:3
#3 0x7f6c8495f851 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:869:13
#4 0x7f6c84853bef in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4753:15
#5 0x7f6c84852fc7 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4588:9
#6 0x7f6c8484f049 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4429:9
#7 0x7f6c8484b4ed in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3413:5
#8 0x7f6c848459ea in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2927:9
#9 0x7f6c84840ca9 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1483:3
#10 0x7f6c84864ef9 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#11 0x7f6c84866f58 in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:695:7
#12 0x7f6c848690a1 in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1240:37
#13 0x7f6c84851b44 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#14 0x7f6c8484de47 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4066:11
#15 0x7f6c8484b59f in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3410:5

Verified bug as reproducible on mozilla-central 20230517033250-08207806be4c.
The bug appears to have been introduced in the following build range:

Start: 4096c0b1871e729512114be7190b465fc013dfd5 (20230207041506)
End: fc3ab5ee8ef31f037e2b78feb07262f5b70f1cb3 (20230207082407)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=4096c0b1871e729512114be7190b465fc013dfd5&tochange=fc3ab5ee8ef31f037e2b78feb07262f5b70f1cb3

Keywords: regression
Whiteboard: [bugmon:bisected,confirmed]

:TYLin does Bug 1809764 look like the regressor?
(mentioned in the pushlog in Comment 2)

Flags: needinfo?(aethanyc)

Yes, bug 1809764 should be the regressor since it fixed float elements in the multi-column layout, and the call stack in comment 0 contains functions handling float elements.

Yes, bug 1809764 is likely to be the regressor since it changes multi-column layout.

Severity: -- → S3
Regressed by: 1809764

Set release status flags based on info from the regressing bug 1809764

status-firefox113: --- → affected
status-firefox114: --- → affected
status-firefox-esr102: --- → unaffected

Hi Tyson,

I failed to reproduce this either using my local debug build nor with commands in comment 0 (fuzzfetch and grizzely). Could you attached another testcase if the fuzzer still hits this bug?

Flags: needinfo?(aethanyc) → needinfo?(twsmith)

(In reply to Ting-Yu Lin [:TYLin] (UTC-8) from comment #6)

I failed to reproduce this either using my local debug build nor with commands in comment 0 (fuzzfetch and grizzely).

I have no issues locally (Ubuntu 22.04), bugmon and the reducer both seem fine, hmm... You could try adding --xvfb to the grizzly command. That might help reduce some environment variations. I'm not sure if that will help but worth a shot.

If a Pernosco session is enough you can add the pernosco-wanted keyword and bugmon will open a Pernosco session automatically. If not ni? me again and I can reduce another test case.

Flags: needinfo?(twsmith) → needinfo?(aethanyc)
Keywords: pernosco-wanted

Oops I didn't mean to add the flag.

Keywords: pernosco-wanted

Turns out this is the only reported test case available. So I'll get a Pernosco session.

Flags: needinfo?(aethanyc)
Keywords: pernosco-wanted

You could try adding --xvfb to the grizzly command. That might help reduce some environment variations. I'm not sure if that will help but worth a shot.

Cool. I can reproduce this with grizzly with --xvfb.

However, the testcase trapped in an infinite loop when running as a crashtest via command MOZ_LOG="ColumnSet:5" ./mach crashtest --headless layout/generic/crashtests/1833523.html

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Keywords: pernosco-wanted → pernosco

A pernosco session for this bug can be found here.

I collected a log with MOZ_LOG="ColumnSet:5" and limited the output to 1MB. Let me know if there is anything else I can do to help.

Set release status flags based on info from the regressing bug 1809764

status-firefox116: --- → affected
Assignee: nobody → sfoster
Status: NEW → ASSIGNED

Comment on attachment 9343352 [details]
Bug 1833523 - Rename SessionStoreInternal. _closedTabs differentiate from other closedTabs collections. r?mconley!

Revision D183300 was moved to bug 1842895. Setting attachment 9343352 [details] to obsolete.

Attachment #9343352 - Attachment is obsolete: true

Apologies for the mixup, I must have got the wrong bug number on a patch.

Assignee: sfoster → nobody
Status: ASSIGNED → NEW

Testcase crashes using the initial build (mozilla-central 20240112173417-734e2e027196) but not with tip (mozilla-central 20250110214402-86f62a648ef0.)

The bug appears to have been fixed in the following build range:

Start: cfc6b506c47661d4a026d6b9e0c719472f2ffba9 (20250109214714)
End: 4d6c1680439a87293a76bbbc3e9d41eb0d1b85ec (20250109232636)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=cfc6b506c47661d4a026d6b9e0c719472f2ffba9&tochange=4d6c1680439a87293a76bbbc3e9d41eb0d1b85ec

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Flags: needinfo?(twsmith)
Keywords: bugmon
Status: NEW → RESOLVED
Closed: 1 month ago
Flags: needinfo?(twsmith)
Resolution: --- → FIXED

Is this testcase still worth landing or is the one from bug 1927270 sufficient for this bug too?

Assignee: nobody → aethanyc
status-firefox118: fix-optional → wontfix
status-firefox134: --- → wontfix
status-firefox135: --- → wontfix
status-firefox136: --- → fixed
status-firefox-esr128: --- → wontfix
Depends on: 1927270
Flags: needinfo?(aethanyc)
Target Milestone: --- → 136 Branch

The testcase here has an infinite loop, where go() calls itself, after some delay (forever):

<script>
function go() {
    a.append("A")
    setTimeout(go)
}
</script>

So the testcase here needs some manual tinkering/testing in order to morph it into a usable reftest-wait-style automated crashtest that calls go a finite number of times -- enough to have triggered the bug -- and then declares success. (Or simplify it; e.g. inserting a chunk of text all at once if that triggers the bug too, or just being a static testcase with that text already present if that works.)

That might be a useful exercise, but also probably isn't super critical given that the patch landed with a test for the other bug. Up to TYLin whether it feels worth spending some time on.

So the testcase here needs some manual tinkering/testing in order to morph it into a usable reftest-wait-style automated crashtest that calls go a finite number of times -- enough to have triggered the bug -- and then declares success. (Or simplify it; e.g. inserting a chunk of text all at once if that triggers the bug too, or just being a static testcase with that text already present if that works.)

I was unable to reproduce the assertion in either comment 0 or comment 1 in normal crashtest (non-headless-mode). Given that we have the test coverage in bug 1927270 (gallery mode) and bug bug 1764205 (printing), I feel it is sufficient to close this bug as a dup.

Duplicate of bug: 1927270
Flags: needinfo?(aethanyc)
Resolution: FIXED → DUPLICATE
Flags: in-testsuite? → in-testsuite-
No longer depends on: 1927270
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: