Open Bug 1845212 Opened 11 months ago Updated 4 months ago

Assertion failure: !HasAnyStateBits(NS_FRAME_IS_DIRTY) || IsHiddenByContentVisibilityOfInFlowParentForLayout() (Must only be called on reflowed lines or those hidden by content-visibility.), at /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:83

Categories

(Core :: Layout, defect, P3)

defect

Tracking

()

Tracking Status
firefox117 --- wontfix
firefox118 --- wontfix
firefox119 --- wontfix
firefox120 --- wontfix
firefox123 --- wontfix
firefox124 --- affected
firefox125 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 2 open bugs)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file, 1 obsolete file)

Attached file testcase.html (obsolete) —

Found while fuzzing m-c 20230721-09025d4def55 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !HasAnyStateBits(NS_FRAME_IS_DIRTY) || IsHiddenByContentVisibilityOfInFlowParentForLayout() (Must only be called on reflowed lines or those hidden by content-visibility.), at /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:8363

#0 0x7f9a744d2e06 in nsIFrame::CachedIsEmpty() /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:8360:3
#1 0x7f9a7451952e in nsLineBox::CachedIsEmpty() /builds/worker/checkouts/gecko/layout/generic/nsLineBox.cpp:335:17
#2 0x7f9a7440a0f7 in nsBlockFrame::PlaceLine(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFloatManager::SavedState*, nsFlowAreaRect&, int&, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:5226:15
#3 0x7f9a744089ea in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4706:12
#4 0x7f9a744042c9 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4453:9
#5 0x7f9a744005a4 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3437:5
#6 0x7f9a743fa69a in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2947:9
#7 0x7f9a743f5919 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1505:3
#8 0x7f9a74407044 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#9 0x7f9a74402f37 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4090:11
#10 0x7f9a74400656 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3434:5
#11 0x7f9a743fa69a in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2947:9
#12 0x7f9a743f5919 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1505:3
#13 0x7f9a7441b1b9 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#14 0x7f9a7441a605 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:761:7
#15 0x7f9a7441b1b9 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:893:14
#16 0x7f9a7446734e in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:938:3
#17 0x7f9a7446815e in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:1071:3
#18 0x7f9a7446ce1c in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:1508:3
#19 0x7f9a743e9557 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:933:14
#20 0x7f9a743e8cff in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:385:7
#21 0x7f9a742d4512 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9612:11
#22 0x7f9a742fcd7f in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9790:22
#23 0x7f9a742de584 in DoFlushLayout /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9861:10
#24 0x7f9a742de584 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4348:11
#25 0x7f9a7221ef30 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1455:5
#26 0x7f9a7221ef30 in mozilla::EventStateManager::FlushLayout(nsPresContext*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:6038:16
#27 0x7f9a7221b1e1 in mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:849:7
#28 0x7f9a742f52ad in mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager*, mozilla::WidgetEvent*, bool, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8205:39
#29 0x7f9a742eedc7 in mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8174:17
#30 0x7f9a742ee652 in mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7123:30
#31 0x7f9a742ed057 in mozilla::PresShell::EventHandler::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6921:12
#32 0x7f9a742ec634 in mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6864:23
#33 0x7f9a73e883de in nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:653:18
#34 0x7f9a73e88139 in nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) /builds/worker/checkouts/gecko/view/nsView.cpp:1149:9
#35 0x7f9a73ec2f03 in mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) /builds/worker/checkouts/gecko/widget/PuppetWidget.cpp:348:37
#36 0x7f9a6fd2ff0b in mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&) /builds/worker/checkouts/gecko/gfx/layers/apz/util/APZCCallbackHelper.cpp:506:21
#37 0x7f9a73607647 in DispatchWidgetEventViaAPZ /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1698:10
#38 0x7f9a73607647 in mozilla::dom::BrowserChild::HandleRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1661:3
#39 0x7f9a73608d9b in mozilla::dom::BrowserChild::RecvRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1628:3
#40 0x7f9a73608f08 in mozilla::dom::BrowserChild::RecvSynthMouseMoveEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1593:8
#41 0x7f9a7373c56c in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBrowserChild.cpp:5483:80
#42 0x7f9a737c9310 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8671:32
#43 0x7f9a6f59d59f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1811:25
#44 0x7f9a6f59a2f2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1736:9
#45 0x7f9a6f59af72 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1536:3
#46 0x7f9a6f59c0bf in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1634:14
#47 0x7f9a6e8d9cd7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
#48 0x7f9a6e8d1863 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:880:26
#49 0x7f9a6e8d00b7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:704:15
#50 0x7f9a6e8d0515 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
#51 0x7f9a6e8dd9f6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
#52 0x7f9a6e8dd9f6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#53 0x7f9a6e8f420a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#54 0x7f9a6e8fb06d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#55 0x7f9a6f5a3505 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#56 0x7f9a6f4be3d1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#57 0x7f9a6f4be3d1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#58 0x7f9a73ef5188 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#59 0x7f9a762259ab in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:717:20
#60 0x7f9a6f5a43e6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#61 0x7f9a6f4be3d1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#62 0x7f9a6f4be3d1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#63 0x7f9a762251fc in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:34
#64 0x55c551ccc566 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#65 0x55c551ccc566 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#66 0x7f9a84629d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#67 0x7f9a84629e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#68 0x55c551ca3808 in _start (/home/user/workspace/browsers/m-c-20230724160807-fuzzing-debug/firefox-bin+0x58808) (BuildId: eb265df4a615b60c9ab0623b656a711ed09203ed)
Flags: in-testsuite?

Verified bug as reproducible on mozilla-central 20230724215726-12931a93e28c.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 9f93a246366f29cbf76c350ab1d5e4bca9b8d630 (20220726041349)
End: 09025d4def551715279580cdb8fab353287aae62 (20230721040926)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Whiteboard: [bugmon:bisected,confirmed]
Severity: -- → S3
Flags: needinfo?(zsun)
Keywords: pernosco-wanted
Priority: -- → P3

Err sorry thought it was content-visibility related but it's not.

Flags: needinfo?(zsun)

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

A pernosco session for this bug can be found here.

A pernosco session for this bug can be found here.

Testcase crashes using the initial build (mozilla-central 20230721040926-09025d4def55) but not with tip (mozilla-central 20230825213228-059b77df2394.)

The bug appears to have been fixed in the following build range:

Start: bee27401511bf375891968a9ca78d7ef74d19962 (20230817082455)
End: 78e7cb2837e7dec0ef55a2f5f383625335ad2520 (20230817100955)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=bee27401511bf375891968a9ca78d7ef74d19962&tochange=78e7cb2837e7dec0ef55a2f5f383625335ad2520

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Flags: needinfo?(twsmith)
Keywords: bugmon
Attached file testcase.html
Attachment #9345472 - Attachment is obsolete: true
Flags: needinfo?(twsmith)

With the attached testcase, I can still reproduce with Dec 4 2023 debug build.

Yes, so the IsHiddenByContentVisibilityOfInFlowParentForLayout() of the assertion can only return true if parent->HidesContentForLayout(), which in turn can only return true if parent->HidesContent() returns true, which in turn can only return true if the parent has content-visibility set to hidden or auto. But this does not happen in the attached reduced testcase...

So the assertion failure is really about HasAnyStateBits(NS_FRAME_IS_DIRTY) being true and that's unrelated to content-visibility.

FWIW, placing a watchpoint on the frame hitting the assertion (which is the SVGOuterSVGFrame) and doing a reverse execution I get the folowing backtrace:

#0  0x00007f1c1c3b3177 in operator|=(nsFrameState&, nsFrameState) (aLeft=@0x7f1c09691b90: 36035394089320448, aRight=NS_FRAME_IS_DIRTY) at /home/fred/src-obj/mozilla-unified/layout/generic/nsFrameState.h:40
#1  0x00007f1c1c3b2a41 in nsIFrame::AddStateBits(nsFrameState) (this=0x7f1c09691b38, aBits=NS_FRAME_IS_DIRTY) at /home/fred/src-obj/mozilla-unified/layout/generic/nsIFrame.h:2369
#2  0x00007f1c21d215f8 in mozilla::PresShell::FrameNeedsReflow(nsIFrame*, mozilla::IntrinsicDirty, nsFrameState, mozilla::ReflowRootHandling)
    (this=0x7f1c09680000, aFrame=0x7f1c09691b38, aIntrinsicDirty=mozilla::IntrinsicDirty::FrameAncestorsAndDescendants, aBitToAdd=NS_FRAME_IS_DIRTY, aRootHandling=mozilla::ReflowRootHandling::InferFromBitToAdd) at /home/fred/src-obj/mozilla-unified/layout/base/PresShell.cpp:2651
#3  0x00007f1c221c58e3 in mozilla::SVGTextFrame::ScheduleReflowSVGNonDisplayText(mozilla::IntrinsicDirty) (this=0x7f1c09691d48, aReason=mozilla::IntrinsicDirty::FrameAncestorsAndDescendants) at /home/fred/src-obj/mozilla-unified/layout/svg/SVGTextFrame.cpp:2823
#4  0x00007f1c221b30de in mozilla::SVGTextFrame::ScheduleReflowSVG() (this=0x7f1c09691d48) at /home/fred/src-obj/mozilla-unified/layout/svg/SVGTextFrame.cpp:4936
#5  0x00007f1c221b2967 in mozilla::SVGTextPathObserver::OnRenderingChange() (this=0x7f1c09627e20) at /home/fred/src-obj/mozilla-unified/layout/svg/SVGObserverUtils.cpp:550
#6  0x00007f1c221b2029 in mozilla::SVGRenderingObserver::OnNonDOMMutationRenderingChange() (this=0x7f1c09627e20) at /home/fred/src-obj/mozilla-unified/layout/svg/SVGObserverUtils.cpp:253
#7  0x00007f1c221b5968 in mozilla::SVGRenderingObserverSet::InvalidateAll() (this=0x7f1c096900d0) at /home/fred/src-obj/mozilla-unified/layout/svg/SVGObserverUtils.cpp:1145
#8  0x00007f1c221b81e0 in mozilla::SVGObserverUtils::InvalidateDirectRenderingObservers(mozilla::dom::Element*, unsigned int) (aElement=0x7f1c07d0f100, aFlags=0) at /home/fred/src-obj/mozilla-unified/layout/svg/SVGObserverUtils.cpp:1843
#9  0x00007f1c221b8239 in mozilla::SVGObserverUtils::InvalidateDirectRenderingObservers(nsIFrame*, unsigned int) (aFrame=0x7f1c09692330, aFlags=0) at /home/fred/src-obj/mozilla-unified/layout/svg/SVGObserverUtils.cpp:1852
#10 0x00007f1c21f5da56 in nsIFrame::FinishAndStoreOverflow(mozilla::OverflowAreas&, nsSize, nsSize*, nsStyleDisplay const*) (this=0x7f1c09692330, aOverflowAreas=..., aNewSize=..., aOldSize=0x0, aStyleDisplay=0x0) at /home/fred/src-obj/mozilla-unified/layout/generic/nsIFrame.cpp:10218
#11 0x00007f1c221a291f in mozilla::SVGGeometryFrame::ReflowSVG() (this=0x7f1c09692330) at /home/fred/src-obj/mozilla-unified/layout/svg/SVGGeometryFrame.cpp:291
#12 0x00007f1c221914d7 in mozilla::SVGDisplayContainerFrame::ReflowSVG() (this=0x7f1c09692280) at /home/fred/src-obj/mozilla-unified/layout/svg/SVGContainerFrame.cpp:338
#13 0x00007f1c221ba01b in mozilla::SVGOuterSVGFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x7f1c096921c0, aPresContext=0x7f1c09635e00, aDesiredSize=..., aReflowInput=..., aStatus=...)
    at /home/fred/src-obj/mozilla-unified/layout/svg/SVGOuterSVGFrame.cpp:417
#14 0x00007f1c22073d56 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) (this=0x7fff5f649300, aFrame=0x7f1c096921c0, aReflowStatus=..., aMetrics=0x0, aPushedFrame=@0x7fff5f648fe3: false) at /home/fred/src-obj/mozilla-unified/layout/generic/nsLineLayout.cpp:891
#15 0x00007f1c21ed25bc in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) (this=0x7f1c09691a20, aState=..., aLineLayout=..., aLine=..., aFrame=0x7f1c096921c0, aLineReflowStatus=0x7fff5f6491ec)
    at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:4998
#16 0x00007f1c21ed13e9 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)
    (this=0x7f1c09691a20, aState=..., aLineLayout=..., aLine=..., aFloatAvailableSpace=..., aAvailableSpaceBSize=@0x7fff5f6492d0: 0, aFloatStateBeforeLine=0x7fff5f6492b8, aKeepReflowGoing=0x7fff5f649a27, aLineReflowStatus=0x7fff5f6492d4, aAllowPullUp=true)
    at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:4800
#17 0x00007f1c21ecdcd2 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (this=0x7f1c09691a20, aState=..., aLine=..., aKeepReflowGoing=0x7fff5f649a27) at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:4674
#18 0x00007f1c21ec9681 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (this=0x7f1c09691a20, aState=..., aLine=..., aKeepReflowGoing=0x7fff5f649a27) at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:3646
#19 0x00007f1c21ec3e16 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) (this=0x7f1c09691a20, aState=...) at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:3156
#20 0x00007f1c21ebef6f in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) (this=0x7f1c09691a20, aPresContext=0x7f1c09635e00, aMetrics=..., aReflowInput=..., aTrialState=...)
    at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:1906
#21 0x00007f1c21ebd92e in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x7f1c09691a20, aPresContext=0x7f1c09635e00, aMetrics=..., aReflowInput=..., aStatus=...) at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:1552
#22 0x00007f1c21ed0280 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&)
    (this=0x7fff5f64b170, aSpace=..., aApplyBStartMargin=true, aPrevMargin=..., aClearance=0, aLine=0x7f1c09691ae8, aFrameRI=..., aFrameReflowStatus=..., aState=...) at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockReflowContext.cpp:290
#23 0x00007f1c21ecc6fc in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (this=0x7f1c09691958, aState=..., aLine=..., aKeepReflowGoing=0x7fff5f64b827) at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:4311
#24 0x00007f1c21ec963a in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (this=0x7f1c09691958, aState=..., aLine=..., aKeepReflowGoing=0x7fff5f64b827) at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:3643
#25 0x00007f1c21ec3e16 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) (this=0x7f1c09691958, aState=...) at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:3156
#26 0x00007f1c21ebef6f in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) (this=0x7f1c09691958, aPresContext=0x7f1c09635e00, aMetrics=..., aReflowInput=..., aTrialState=...)
    at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:1906
#27 0x00007f1c21ebd92e in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x7f1c09691958, aPresContext=0x7f1c09635e00, aMetrics=..., aReflowInput=..., aStatus=...) at /home/fred/src-obj/mozilla-unified/layout/generic/nsBlockFrame.cpp:1552
#28 0x00007f1c21ee38e4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)
    (this=0x7f1c096910c8, aKidFrame=0x7f1c09691958, aPresContext=0x7f1c09635e00, aDesiredSize=..., aReflowInput=..., aWM=..., aPos=..., aContainerSize=..., aFlags=nsIFrame::ReflowChildFlags::Default, aStatus=..., aTracker=0x0) at /home/fred/src-obj/mozilla-unified/layout/generic/nsContainerFrame.cpp:887
#29 0x00007f1c21ee2cc3 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x7f1c096910c8, aPresContext=0x7f1c09635e00, aDesiredSize=..., aReflowInput=..., aStatus=...) at /home/fred/src-obj/mozilla-unified/layout/generic/nsCanvasFrame.cpp:760
#30 0x00007f1c21ee38e4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)
    (this=0x7f1c09691198, aKidFrame=0x7f1c096910c8, aPresContext=0x7f1c09635e00, aDesiredSize=..., aReflowInput=..., aWM=..., aPos=..., aContainerSize=..., aFlags=nsIFrame::ReflowChildFlags::NoMoveFrame, aStatus=..., aTracker=0x0) at /home/fred/src-obj/mozilla-unified/layout/generic/nsContainerFrame.cpp:887
#31 0x00007f1c21f5b369 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) (this=0x7f1c09691198, aState=..., aAssumeHScroll=false, aAssumeVScroll=true, aMetrics=0x7fff5f64d528) at /home/fred/src-obj/mozilla-unified/layout/generic/nsGfxScrollFrame.cpp:938
#32 0x00007f1c21f5bc8c in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) (this=0x7f1c09691198, aState=..., aDesiredSize=...) at /home/fred/src-obj/mozilla-unified/layout/generic/nsGfxScrollFrame.cpp:1071
#33 0x00007f1c21f5f1c9 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x7f1c09691198, aPresContext=0x7f1c09635e00, aDesiredSize=..., aReflowInput=..., aStatus=...) at /home/fred/src-obj/mozilla-unified/layout/generic/nsGfxScrollFrame.cpp:1508
#34 0x00007f1c21eb2b29 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*)
    (this=0x7f1c09691020, aKidFrame=0x7f1c09691198, aPresContext=0x7f1c09635e00, aDesiredSize=..., aReflowInput=..., aX=0, aY=0, aFlags=nsIFrame::ReflowChildFlags::Default, aStatus=..., aTracker=0x0) at /home/fred/src-obj/mozilla-unified/layout/generic/nsContainerFrame.cpp:928
#35 0x00007f1c21eb2457 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x7f1c09691020, aPresContext=0x7f1c09635e00, aDesiredSize=..., aReflowInput=..., aStatus=...) at /home/fred/src-obj/mozilla-unified/layout/generic/ViewportFrame.cpp:379
#36 0x00007f1c21d2349d in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) (this=0x7f1c09680000, target=0x7f1c09691020, aInterruptible=true, aOverflowTracker=0x7fff5f64e7f0) at /home/fred/src-obj/mozilla-unified/layout/base/PresShell.cpp:9651
#37 0x00007f1c21d4800c in mozilla::PresShell::ProcessReflowCommands(bool) (this=0x7f1c09680000, aInterruptible=true) at /home/fred/src-obj/mozilla-unified/layout/base/PresShell.cpp:9824
#38 0x00007f1c21d2d971 in mozilla::PresShell::DoFlushLayout(bool) (this=0x7f1c09680000, aInterruptible=true) at /home/fred/src-obj/mozilla-unified/layout/base/PresShell.cpp:9895
#39 0x00007f1c21d2d2fe in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) (this=0x7f1c09680000, aFlush=...) at /home/fred/src-obj/mozilla-unified/layout/base/PresShell.cpp:4334
#40 0x00007f1c1c943ea3 in mozilla::PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) (this=0x7f1c09680000, aType=...) at /home/fred/src-obj/mozilla-unified/obj-x86_64-pc-linux-gnu-debug/dist/include/mozilla/PresShell.h:1474
#41 0x00007f1c21cdd8b9 in nsRefreshDriver::TickObserverArray(unsigned int, mozilla::TimeStamp) (this=0x7f1c0efe1800, aIdx=2, aNowTime=...) at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:2528
#42 0x00007f1c21cdadd3 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) (this=0x7f1c0efe1800, aId=..., aNowTime=..., aIsExtraTick=nsRefreshDriver::IsExtraTick::No)
    at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:2732
#43 0x00007f1c21ceb5e4 in mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) (driver=0x7f1c0efe1800, aId=..., now=...) at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:366
#44 0x00007f1c21ceb4fb in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) (this=0x7f1c31b2e160, aId=..., aNow=..., aDrivers=...) at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:344
#45 0x00007f1c21ceb31c in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) (this=0x7f1c31b2e160, aId=..., now=...) at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:360
#46 0x00007f1c21ceaf0c in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) (this=0x7f1c31b2e160, aId=..., aTimeStamp=...) at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:949
#47 0x00007f1c21ce963e in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) (this=0x7f1c31b2e160, aId=..., aVsyncTimestamp=...) at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:859
#48 0x00007f1c21ce8ac9 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) (this=0x7f1c31b2e160, aVsyncEvent=...) at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:757
#49 0x00007f1c21ce8110 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() (this=0x7f1c0eff6400) at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:591
#50 0x00007f1c21ce7c22 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) (this=0x7f1c0eff6400, aVsync=...) at /home/fred/src-obj/mozilla-unified/layout/base/nsRefreshDriver.cpp:548
#51 0x00007f1c20b6aab5 in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) (this=0x7f1c31b2cdd0, aVsync=..., aVsyncRate=@0x7fff5f64fa7c: 13.3346729) at /home/fred/src-obj/mozilla-unified/dom/ipc/VsyncMainChild.cpp:66
#52 0x00007f1c20eb359e in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) (this=0x7f1c31b2cdd0, msg__=...) at /home/fred/src-obj/mozilla-unified/obj-x86_64-pc-linux-gnu-debug/ipc/ipdl/PVsyncChild.cpp:227
#53 0x00007f1c1b75fe2c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) (this=0x7f1c31b22d00, msg__=...) at /home/fred/src-obj/mozilla-unified/obj-x86_64-pc-linux-gnu-debug/ipc/ipdl/PBackgroundChild.cpp:5589
#54 0x00007f1c1b6f078b in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) (this=0x7f1c31b22d88, aProxy=0x7f1c0ef16c70, aMsg=...) at /home/fred/src-obj/mozilla-unified/ipc/glue/MessageChannel.cpp:1813
#55 0x00007f1c1b6ef2c8 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) (this=0x7f1c31b22d88, aProxy=0x7f1c0ef16c70, aMsg=...) at /home/fred/src-obj/mozilla-unified/ipc/glue/MessageChannel.cpp:1732
#56 0x00007f1c1b6ef775 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) (this=0x7f1c31b22d88, aProxy=0x7f1c0ef16c70, aTask=...) at /home/fred/src-obj/mozilla-unified/ipc/glue/MessageChannel.cpp:1525
#57 0x00007f1c1b6f000a in mozilla::ipc::MessageChannel::MessageTask::Run() (this=0x7f1c09658d80) at /home/fred/src-obj/mozilla-unified/ipc/glue/MessageChannel.cpp:1623
#58 0x00007f1c1a5525a6 in mozilla::RunnableTask::Run() (this=0x7f1c09658e00) at /home/fred/src-obj/mozilla-unified/xpcom/threads/TaskController.cpp:549
#59 0x00007f1c1a53cacc in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (this=0x7f1c31b20300, aProofOfLock=...) at /home/fred/src-obj/mozilla-unified/xpcom/threads/TaskController.cpp:876
#60 0x00007f1c1a53b13f in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (this=0x7f1c31b20300, aProofOfLock=...) at /home/fred/src-obj/mozilla-unified/xpcom/threads/TaskController.cpp:699
#61 0x00007f1c1a53b57a in mozilla::TaskController::ProcessPendingMTTask(bool) (this=0x7f1c31b20300, aMayWait=false) at /home/fred/src-obj/mozilla-unified/xpcom/threads/TaskController.cpp:485
#62 0x00007f1c1a54191b in mozilla::TaskController::TaskController()::$_0::operator()() const (this=0x7f1c31bad818) at /home/fred/src-obj/mozilla-unified/xpcom/threads/TaskController.cpp:211
--Type <RET> for more, q to quit, c to continue without paging--c
#63 0x00007f1c1a541899 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() (this=0x7f1c31bad7f0) at /home/fred/src-obj/mozilla-unified/xpcom/threads/nsThreadUtils.h:548
#64 0x00007f1c1a57c7a0 in nsThread::ProcessNextEvent(bool, bool*) (this=0x7f1c31b80200, aMayWait=false, aResult=0x7fff5f651977) at /home/fred/src-obj/mozilla-unified/xpcom/threads/nsThread.cpp:1198
#65 0x00007f1c1a5828d6 in NS_ProcessNextEvent(nsIThread*, bool) (aThread=0x7f1c31b80200, aMayWait=false) at /home/fred/src-obj/mozilla-unified/xpcom/threads/nsThreadUtils.cpp:480
#66 0x00007f1c1b6f3af5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (this=0x7f1c31bae240, aDelegate=0x7fff5f651d68) at /home/fred/src-obj/mozilla-unified/ipc/glue/MessagePump.cpp:85
#67 0x00007f1c1b6f4827 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) (this=0x7f1c31bae240, aDelegate=0x7fff5f651d68) at /home/fred/src-obj/mozilla-unified/ipc/glue/MessagePump.cpp:268
#68 0x00007f1c1b5bc698 in MessageLoop::RunInternal() (this=0x7fff5f651d68) at /home/fred/src-obj/mozilla-unified/ipc/chromium/src/base/message_loop.cc:370
#69 0x00007f1c1b5bc615 in MessageLoop::RunHandler() (this=0x7fff5f651d68) at /home/fred/src-obj/mozilla-unified/ipc/chromium/src/base/message_loop.cc:363
#70 0x00007f1c1b5bc5d0 in MessageLoop::Run() (this=0x7fff5f651d68) at /home/fred/src-obj/mozilla-unified/ipc/chromium/src/base/message_loop.cc:345
#71 0x00007f1c217b344c in nsBaseAppShell::Run() (this=0x7f1c11284180) at /home/fred/src-obj/mozilla-unified/widget/nsBaseAppShell.cpp:148
#72 0x00007f1c218d894b in nsAppShell::Run() (this=0x7f1c11284180) at /home/fred/src-obj/mozilla-unified/widget/gtk/nsAppShell.cpp:470
#73 0x00007f1c25fb7967 in XRE_RunAppShell() () at /home/fred/src-obj/mozilla-unified/toolkit/xre/nsEmbedFunctions.cpp:721
#74 0x00007f1c1b6f4669 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) (this=0x7f1c31bae240, aDelegate=0x7fff5f651d68) at /home/fred/src-obj/mozilla-unified/ipc/glue/MessagePump.cpp:235
#75 0x00007f1c1b5bc698 in MessageLoop::RunInternal() (this=0x7fff5f651d68) at /home/fred/src-obj/mozilla-unified/ipc/chromium/src/base/message_loop.cc:370
#76 0x00007f1c1b5bc615 in MessageLoop::RunHandler() (this=0x7fff5f651d68) at /home/fred/src-obj/mozilla-unified/ipc/chromium/src/base/message_loop.cc:363
#77 0x00007f1c1b5bc5d0 in MessageLoop::Run() (this=0x7fff5f651d68) at /home/fred/src-obj/mozilla-unified/ipc/chromium/src/base/message_loop.cc:345
#78 0x00007f1c25fb75b0 in XRE_InitChildProcess(int, char**, XREChildData const*) (aArgc=15, aArgv=0x7fff5f652208, aChildData=0x7fff5f652067) at /home/fred/src-obj/mozilla-unified/toolkit/xre/nsEmbedFunctions.cpp:656
#79 0x00007f1c25fcd557 in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) (this=0x7f1c31b036e0, argc=18, argv=0x7fff5f652208, aChildData=0x7fff5f652067) at /home/fred/src-obj/mozilla-unified/toolkit/xre/Bootstrap.cpp:67
#80 0x000055a53f1b5ed9 in content_process_main(mozilla::Bootstrap*, int, char**) (bootstrap=0x7f1c31b036e0, argc=18, argv=0x7fff5f652208) at /home/fred/src-obj/mozilla-unified/browser/app/../../ipc/contentproc/plugin-container.cpp:57
#81 0x000055a53f1b610a in main(int, char**, char**) (argc=19, argv=0x7fff5f652208, envp=0x7fff5f6522a8) at /home/fred/src-obj/mozilla-unified/browser/app/nsBrowserApp.cpp:375

This has been detected by live site testing.

You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: