Open Bug 1855121 Opened 2 years ago Updated 1 year ago

Assertion failure: !reflowStatus.IsInlineBreak() && !pushedFrame (Any line break inside ruby box should has been suppressed),at /home/wuyue/browser/mozilla-unified/layout/generic/nsRubyBaseContainerFrame.cpp:826

Categories

(Core :: Layout: Ruby, defect)

Product:
Core
Component:
Layout: Ruby
Version:
Firefox 119
Type:
defect

Tracking

()

People

(Reporter: 1319794503, Unassigned)

Details

Attachments

(3 files)

2023-09-11-15-36-39-10316319-2023-09-17-23-29-05-9026444-2023-09-20-10-27-19-9268154.html
41.78 KB, text/html
Details
2023-09-11-15-36-39-10316319.html
7.10 MB, text/html
Details
Screenshot for mozregression
1.01 MB, image/png
Details

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15

Steps to reproduce:

open the html file(attached below) with Firefox 119.0a1 debug version

Actual results:

the browser crashed, crash log:

Assertion failure: !reflowStatus.IsInlineBreak() && !pushedFrame (Any line break inside ruby box should has been suppressed), at /home/wuyue/browser/mozilla-unified/layout/generic/nsRubyBaseContainerFrame.cpp:826
#01: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1675fe39]
#02: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1675d9aa]
#03: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16725b4c]
#04: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16766cd5]
#05: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16765b6b]
#06: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16725b4c]
#07: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16489e77]
#08: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16488139]
#09: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1647ed60]
#10: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16474ac0]
#11: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16467df2]
#12: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645d8dc]
#13: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16725b4c]
#14: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16489e77]
#15: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16488139]
#16: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1647ed60]
#17: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16474ac0]
#18: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16467df2]
#19: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645d8dc]
#20: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1648448b]
#21: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1647a7c1]
#22: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16474e6f]
#23: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16467df2]
#24: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645d8dc]
#25: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1648448b]
#26: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1647a7c1]
#27: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16474e6f]
#28: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16467df2]
#29: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645d8dc]
#30: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1648448b]
#31: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1647a7c1]
#32: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16474e6f]
#33: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16467df2]
#34: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645d8dc]
#35: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1648448b]
#36: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1647a7c1]
#37: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16474e6f]
#38: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16467df2]
#39: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645d8dc]
#40: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164ad317]
#41: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164ab465]
#42: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164ad317]
#43: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16563d8e]
#44: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16565321]
#45: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1656df68]
#46: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16446d48]
#47: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16445ef0]
#48: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x161ea712]
#49: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1623048d]
#50: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x161ff24d]
#51: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1617ff65]
#52: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1619476a]
#53: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x161944e4]
#54: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1619414e]
#55: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16192ca5]
#56: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16191863]
#57: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16190c5d]
#58: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x161907a4]
#59: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x14958b63]
#60: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x14df95f8]
#61: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd55c531]
#62: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c8e05]
#63: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c6c39]
#64: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c75a3]
#65: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c8122]
#66: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcf35ed]
#67: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcdad50]
#68: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcd857b]
#69: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcd8bcc]
#70: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcdf1b5]
#71: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbd247bf]
#72: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbd2f14b]
#73: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4ce7a1]
#74: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd341319]
#75: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd34109b]
#76: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x15a1bb43]
#77: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1a30ecc6]
#78: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4cf5be]
#79: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd341319]
#80: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd34109b]
#81: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1a30e0da]
#82: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/firefox +0x1b35e2]
#83: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/firefox +0x1b4014]
#84: __libc_start_main[/lib/x86_64-linux-gnu/libc.so.6 +0x24083]
#85: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/firefox +0xdd9b9]
#86: ??? (???:???)
[Parent 156696, IPC I/O Parent] WARNING: [1.1]: Ignoring message 'EVENT_MESSAGE' to unknown peer FB75BE90C4250F69.F7EFFEAC421591DB: file /home/wuyue/browser/mozilla-unified/ipc/glue/NodeController.cpp:344
[Parent 156696, IPC I/O Parent] WARNING: [1.1]: Ignoring message 'EVENT_MESSAGE' to unknown peer FB75BE90C4250F69.F7EFFEAC421591DB: file /home/wuyue/browser/mozilla-unified/ipc/glue/NodeController.cpp:344
[Parent 156696, IPC I/O Parent] WARNING: [1.1]: Ignoring message 'EVENT_MESSAGE' to unknown peer FB75BE90C4250F69.F7EFFEAC421591DB: file /home/wuyue/browser/mozilla-unified/ipc/glue/NodeController.cpp:344

Program /home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/firefox (pid = 156789) received signal 11.

Expected results:

browser didn't crash, running good.

The Bugbug bot thinks this bug should belong to the 'Core::Layout' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Component: Untriaged → Layout
Product: Firefox → Core

I can't reproduce this one on trunk. I can't repro on 119.0 either:

mozregression -B debug --launch 119 -a https://bugzilla.mozilla.org/attachment.cgi?id=9355000

Do you need any specific configuration to reproduce this?

Component: Layout → Layout: Ruby
Flags: needinfo?(1319794503)

Sorry, there is something wrong in the trimmed testcase, so I upload the original one. I will fix the minimized testcase as soon as possible.

Flags: needinfo?(1319794503)

#01: nsRubyBaseContainerFrame::ReflowSpans(nsRubyBaseContainerFrame::RubyReflowInput const&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsRubyBaseContainerFrame.cpp:825)
#02: nsRubyBaseContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsRubyBaseContainerFrame.cpp:393)
#03: nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsLineLayout.cpp:0)
#04: nsRubyFrame::ReflowSegment(nsPresContext*, mozilla::ReflowInput const&, int, int, nsRubyBaseContainerFrame*, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsRubyFrame.cpp:200)
#05: nsRubyFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsRubyFrame.cpp:0)
#06: nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsLineLayout.cpp:0)
#07: nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#08: nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:4586)
#09: nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:4460)
#10: nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:3435)
#11: nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#12: nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:1511)
#13: nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsLineLayout.cpp:0)
#14: nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#15: nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:4586)
#16: nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:4460)
#17: nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:3435)
#18: nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#19: nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:1511)
#20: nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockReflowContext.cpp:291)
#21: nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#22: nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:3454)
#23: nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#24: nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:1511)
#25: nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockReflowContext.cpp:291)
#26: nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#27: nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:3454)
#28: nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#29: nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:1511)
#30: nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockReflowContext.cpp:291)
#31: nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#32: nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:3454)
#33: nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#34: nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:1511)
#35: nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockReflowContext.cpp:291)
#36: nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#37: nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:3454)
#38: nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:0)
#39: nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsBlockFrame.cpp:1511)
#40: nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsContainerFrame.cpp:893)
#41: nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsCanvasFrame.cpp:760)
#42: nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsContainerFrame.cpp:893)
#43: nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsGfxScrollFrame.cpp:939)
#44: nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsGfxScrollFrame.cpp:1094)
#45: nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/nsGfxScrollFrame.cpp:0)
#46: nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) (/home/wuyue/browser/mozilla-unified/layout/generic/nsContainerFrame.cpp:934)
#47: mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (/home/wuyue/browser/mozilla-unified/layout/generic/ViewportFrame.cpp:386)
#48: mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) (/home/wuyue/browser/mozilla-unified/layout/base/PresShell.cpp:9686)
#49: mozilla::PresShell::ProcessReflowCommands(bool) (/home/wuyue/browser/mozilla-unified/layout/base/PresShell.cpp:9858)
#50: mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) (/home/wuyue/browser/mozilla-unified/layout/base/PresShell.cpp:4367)
#51: nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) (/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/include/mozilla/PresShell.h:0)
#52: mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) (/home/wuyue/browser/mozilla-unified/layout/base/nsRefreshDriver.cpp:336)
#53: mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) (/home/wuyue/browser/mozilla-unified/layout/base/nsRefreshDriver.cpp:354)
#54: mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) (/home/wuyue/browser/mozilla-unified/layout/base/nsRefreshDriver.cpp:966)
#55: mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) (/home/wuyue/browser/mozilla-unified/layout/base/nsRefreshDriver.cpp:829)
#56: mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) (/home/wuyue/browser/mozilla-unified/layout/base/nsRefreshDriver.cpp:736)
#57: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() (/home/wuyue/browser/mozilla-unified/layout/base/nsRefreshDriver.cpp:578)
#58: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) (/home/wuyue/browser/mozilla-unified/layout/base/nsRefreshDriver.cpp:0)
#59: mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) (/home/wuyue/browser/mozilla-unified/dom/ipc/VsyncMainChild.cpp:67)
#60: mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) (/home/wuyue/browser/mozilla-unified/objdir-ff-asan/ipc/ipdl/PVsyncChild.cpp:0)
#61: mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) (/home/wuyue/browser/mozilla-unified/objdir-ff-asan/ipc/ipdl/PBackgroundChild.cpp:5538)
#62: mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) (/home/wuyue/browser/mozilla-unified/ipc/glue/MessageChannel.cpp:1800)
#63: mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) (/home/wuyue/browser/mozilla-unified/ipc/glue/MessageChannel.cpp:1728)
#64: mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) (/home/wuyue/browser/mozilla-unified/ipc/glue/MessageChannel.cpp:1525)
#65: mozilla::ipc::MessageChannel::MessageTask::Run() (/home/wuyue/browser/mozilla-unified/ipc/glue/MessageChannel.cpp:0)
#66: mozilla::RunnableTask::Run() (/home/wuyue/browser/mozilla-unified/xpcom/threads/TaskController.cpp:560)
#67: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (/home/wuyue/browser/mozilla-unified/xpcom/threads/TaskController.cpp:0)
#68: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (/home/wuyue/browser/mozilla-unified/xpcom/threads/TaskController.cpp:0)
#69: mozilla::TaskController::ProcessPendingMTTask(bool) (/home/wuyue/browser/mozilla-unified/xpcom/threads/TaskController.cpp:495)
#70: mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() (/home/wuyue/browser/mozilla-unified/xpcom/threads/nsThreadUtils.h:549)
#71: nsThread::ProcessNextEvent(bool, bool*) (/home/wuyue/browser/mozilla-unified/xpcom/threads/nsThread.cpp:1203)
#72: NS_ProcessNextEvent(nsIThread*, bool) (/home/wuyue/browser/mozilla-unified/xpcom/threads/nsThreadUtils.cpp:480)
#73: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (/home/wuyue/browser/mozilla-unified/ipc/glue/MessagePump.cpp:85)
#74: MessageLoop::RunInternal() (/home/wuyue/browser/mozilla-unified/ipc/chromium/src/base/message_loop.cc:371)
#75: MessageLoop::Run() (/home/wuyue/browser/mozilla-unified/ipc/chromium/src/base/message_loop.cc:346)
#76: nsBaseAppShell::Run() (/home/wuyue/browser/mozilla-unified/widget/nsBaseAppShell.cpp:150)
#77: XRE_RunAppShell() (/home/wuyue/browser/mozilla-unified/toolkit/xre/nsEmbedFunctions.cpp:721)
#78: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) (/home/wuyue/browser/mozilla-unified/ipc/glue/MessagePump.cpp:235)
#79: MessageLoop::RunInternal() (/home/wuyue/browser/mozilla-unified/ipc/chromium/src/base/message_loop.cc:371)
#80: MessageLoop::Run() (/home/wuyue/browser/mozilla-unified/ipc/chromium/src/base/message_loop.cc:346)
#81: XRE_InitChildProcess(int, char**, XREChildData const*) (/home/wuyue/browser/mozilla-unified/toolkit/xre/nsEmbedFunctions.cpp:660)
#82: content_process_main(mozilla::Bootstrap*, int, char**) (/home/wuyue/browser/mozilla-unified/ipc/contentproc/plugin-container.cpp:58)
#83: main (/home/wuyue/browser/mozilla-unified/browser/app/nsBrowserApp.cpp:375)
#84: __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6 + 0x24083)
#85: ??? (/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/firefox + 0xdd9b9)
#86: ??? (???:???)

The severity field is not set for this bug.
:tlouw, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(tlouw)

Can't repro this on a debug build from today.

djinn would it be possible to run a mozregression on your side? Maybe we can pin this down to a specific commit?

mozregression -B debug --launch 119 -a https://bugzilla.mozilla.org/attachment.cgi?id=9356392
Flags: needinfo?(tlouw) → needinfo?(1319794503)
Flags: needinfo?(1319794503)

Sorry for replying late. I've tried the command you mentioned.
./mach mozregression -B debug --launch 119 -a https://bugzilla.mozilla.org/attachment.cgi?id=9356392
And I upload the result with the screenshot.

I'm able to reproduce this assertion on Firefox 116 debug build via

./mach mozregression -B debug --launch 116 -a https://bugzilla.mozilla.org/attachment.cgi?id=9356392

It didn't crash immediately, and I waited 30 seconds before it crashed. Firefox 116 is the earliest version where we have the debug build on CI. On Firefox 116 release build, it didn't crash.

The test might trigger some integer overflows, or some sizes might be hit the layout sentinel value NS_UNCONSTRAINEDSIZE because I see a lot of warnings in the debug output such as

 0:50.04 INFO: b'nsLineLayout: Block(span id=node_170)(1)@7fccde7a9928 metrics=1073813739,1073741823!'
 0:50.04 INFO: b"[Child 22231, Main Thread] WARNING: have unconstrained inline-size; this should only result from very large sizes, not attempts at intrinsic inline-size calculation: 'NS_UNCONSTRAINEDSIZE != aReflowInput.AvailableISize()', file /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:1113"
 0:50.04 INFO: b"\x07[Child 22231, Main Thread] ###!!! ASSERTION: should no longer use available widths: 'availableISize != NS_UNCONSTRAINEDSIZE', file /builds/worker/checkouts/gecko/layout/generic/nsInlineFrame.cpp:470"
 0:50.04 INFO: b"\x07[Child 22231, Main Thread] ###!!! ASSERTION: should no longer be using unconstrained sizes: 'aIEnd != NS_UNCONSTRAINEDSIZE', file /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:389"
 0:50.04 INFO: b"[Child 22231, Main Thread] WARNING: have unconstrained inline-size; this should only result from very large sizes, not attempts at intrinsic inline-size calculation: 'NS_UNCONSTRAINEDSIZE != aReflowInput.AvailableISize()', file /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:1113"
 0:50.04 INFO: b"\x07[Child 22231, Main Thread] ###!!! ASSERTION: should no longer use available widths: 'availableISize != NS_UNCONSTRAINEDSIZE', file /builds/worker/checkouts/gecko/layout/generic/nsInlineFrame.cpp:470"
 0:50.04 INFO: b"\x07[Child 22231, Main Thread] ###!!! ASSERTION: should no longer be using unconstrained sizes: 'aIEnd != NS_UNCONSTRAINEDSIZE', file /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:389"
 0:50.04 INFO: b"\x07[Child 22231, Main Thread] ###!!! ASSERTION: bad inline size: 'reflowOutput.ISize(lineWM) >= 0', file /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:941"
 0:50.04 INFO: b"\x07[Child 22231, Main Thread] ###!!! ASSERTION: bad block size: 'reflowOutput.BSize(lineWM) >= 0', file /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:942"
 0:50.04 INFO: b"[Child 22231, Main Thread] WARNING: Negative deltawidth, something odd is happening: 'result.mDeltaWidth >= 0', file /builds/worker/checkouts/gecko/layout/generic/nsTextFrame.cpp:9789"
 0:50.04 INFO: b'[Child 22231, Main Thread] WARNING: bad value: file /builds/worker/checkouts/gecko/layout/generic/nsFloatManager.cpp:117'
 0:50.04 INFO: b'[Child 22231, Main Thread] WARNING: bad value: file /builds/worker/checkouts/gecko/layout/generic/nsFloatManager.cpp:117'
Severity: -- → S3
Status: UNCONFIRMED → NEW
Ever confirmed: true
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: