1924239 - Assertion failure: aReflowInput.ComputedLogicalBorderPadding(wm).IsAllZero(), at /builds/worker/checkouts/gecko/layout/forms/nsCheckboxRadioFrame.cpp:114

Status: NEW

(Core :: Layout: Grid, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20241001-0546d4eb6429 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: aReflowInput.ComputedLogicalBorderPadding(wm).IsAllZero(), at /builds/worker/checkouts/gecko/layout/forms/nsCheckboxRadioFrame.cpp:114

#0 0x711ef8fb31a3 in nsCheckboxRadioFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/forms/nsCheckboxRadioFrame.cpp:114:3
#1 0x711ef8e8b3c4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#2 0x711ef8ee7960 in nsGridContainerFrame::ReflowInFlowChild(nsIFrame*, nsGridContainerFrame::GridItemInfo const*, nsSize, mozilla::Maybe<int> const&, nsGridContainerFrame::Fragmentainer const*, nsGridContainerFrame::GridReflowInput const&, mozilla::LogicalRect const&, mozilla::ReflowOutput&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:7696:3
#3 0x711ef8eedbf9 in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsSize const&, mozilla::ReflowOutput&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:8788:7
#4 0x711ef8eeef61 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:9031:11
#5 0x711ef8e8b3c4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#6 0x711ef8ee18e8 in MeasuringReflow(nsIFrame*, mozilla::ReflowInput const*, gfxContext*, mozilla::LogicalSize const&, mozilla::LogicalSize const&, int, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5533:11
#7 0x711ef8edd2c5 in nsGridContainerFrame::Tracks::InitializeItemBaselines(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6250:7
#8 0x711ef8ed25e7 in CalculateSizes /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5931:3
#9 0x711ef8ed25e7 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:4069:12
#10 0x711ef8eee955 in CalculateTrackSizes /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:4132:3
#11 0x711ef8eee955 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:8931:21
#12 0x711ef8e8b3c4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#13 0x711ef8e7e99f in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:710:7
#14 0x711ef8e8b3c4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#15 0x711ef8e23de7 in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:914:3
#16 0x711ef8e24890 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1049:3
#17 0x711ef8e26d3d in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1509:3
#18 0x711ef8e951f1 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:933:14
#19 0x711ef8e50b40 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:358:7
#20 0x711ef8d228e4 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9954:11
#21 0x711ef8d4b63f in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10124:22
#22 0x711ef8d2c37f in DoFlushLayout /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10171:10
#23 0x711ef8d2c37f in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4394:9
#24 0x711ef512eadb in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1455:5
#25 0x711ef512eadb in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:11277:16
#26 0x711ef512ea14 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:11273:22
#27 0x711ef8e7aacb in InsertAnonymousContentInContainer(mozilla::dom::Document&, mozilla::dom::Element&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:99:8
#28 0x711ef8e86b3d in operator() /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:149:11
#29 0x711ef8e86b3d in mozilla::detail::RunnableFunction<nsCanvasFrame::CreateAnonymousContent(nsTArray<nsIAnonymousContentCreator::ContentInfo>&)::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:548:5
#30 0x711ef4eb3525 in nsContentUtils::RemoveScriptBlocker() /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:6205:17
#31 0x711ef8dabc35 in ~nsAutoScriptBlocker /builds/worker/workspace/obj-build/dist/include/nsContentUtils.h:3767:28
#32 0x711ef8dabc35 in nsDocumentViewer::Show() /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:2116:3
#33 0x711ef9202c06 in nsDocShell::SetVisibility(bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
#34 0x711ef539d161 in nsFrameLoader::Show(nsSubDocumentFrame*) /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:1008:15
#35 0x711ef8f6f665 in nsSubDocumentFrame::ShowViewer() /builds/worker/checkouts/gecko/layout/generic/nsSubDocumentFrame.cpp:199:38
#36 0x711ef8fa99f4 in AsyncFrameInit::Run() /builds/worker/checkouts/gecko/layout/generic/nsSubDocumentFrame.cpp:111:60
#37 0x711ef4eb3525 in nsContentUtils::RemoveScriptBlocker() /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:6205:17
#38 0x711ef8d2c301 in ~nsAutoScriptBlocker /builds/worker/checkouts/gecko/dom/base/nsContentUtils.h:3767:28
#39 0x711ef8d2c301 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4386:3
#40 0x711ef512eadb in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1455:5
#41 0x711ef512eadb in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:11277:16
#42 0x711ef512ea14 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:11273:22
#43 0x711ef411b4cd in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:728:14
#44 0x711ef411c914 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:666:5
#45 0x711ef9241f1f in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:13740:23
#46 0x711ef34d97ff in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:633:22
#47 0x711ef34dab1e in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:536:10
#48 0x711ef5133d6c in mozilla::dom::Document::DoUnblockOnload() /builds/worker/checkouts/gecko/dom/base/Document.cpp:12067:18
#49 0x711ef5119bf9 in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:8429:3
#50 0x711ef51d6a79 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
#51 0x711ef51d6a79 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#52 0x711ef51d6a79 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#53 0x711ef51d6a79 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#54 0x711ef51d6a79 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#55 0x711ef51d6a79 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
#56 0x711ef51d6a79 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
#57 0x711ef32ac287 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:618:16
#58 0x711ef32a1d16 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:945:26
#59 0x711ef32a0727 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:768:15
#60 0x711ef32a0ba5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:554:36
#61 0x711ef32afbf6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:268:37
#62 0x711ef32afbf6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#63 0x711ef32c330b in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1155:16
#64 0x711ef32c9fef in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#65 0x711ef3e3a895 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#66 0x711ef3d8da51 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#67 0x711ef3d8da51 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#68 0x711ef8965dc8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#69 0x711ef8a13818 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33
#70 0x711ef98df6bb in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:684:20
#71 0x711ef3e3b6e6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#72 0x711ef3d8da51 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#73 0x711ef3d8da51 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#74 0x711ef98deab7 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:619:34
#75 0x60c7f4fa03ae in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:403:22

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20241012094524-75d81c21a6ae.
The bug appears to have been introduced in the following build range:

Start: 62bf09a8866f3a4495bd1a283c9a1e7004dfe8a5 (20240619112011)
End: b7b177fc1cce5246e668785ea6f6388da7442aeb (20240619133903)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=62bf09a8866f3a4495bd1a283c9a1e7004dfe8a5&tochange=b7b177fc1cce5246e668785ea6f6388da7442aeb

Comment 2

[Emilio Cobos Álvarez (:emilio)]

This is relatively low severity, need to dig into it but have other more pressing things... let me know if it blocks fuzzing and I can reprioritize.

Comment 3

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 4

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

So this is grid basically enforcing some padding on frames: https://searchfox.org/mozilla-central/rev/aecbd5cdd28a09e11872bc829d9e6e4b943e6e49/layout/generic/nsGridContainerFrame.cpp#7602-7633

Daniel / others: Do you know what that code is doing? Should it work on replaced elements?

Comment 6

[Daniel Holbert [:dholbert]]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #5)

Daniel / others: Do you know what that code is doing? Should it work on replaced elements?

We discussed this on slack, but I forgot to update the bug.

tl;dr: this is for align-content:baseline which is indeed specced as inflating the padding -- it adds space between the border and the content-box of a grid item (we only implement it in grid; bug 1480850 is filed on implementing in flexbox). See https://bugzilla.mozilla.org/show_bug.cgi?id=1256429#c1 and https://drafts.csswg.org/css-align-3/#baseline-align-content for more on this.

align-content:baseline is a pretty niche behavior and I'm pretty sure we're still the only browser to implement it (we're alone in passing https://wpt.fyi/results/css/css-grid/alignment/grid-item-mixed-baseline-001.html?label=master&label=experimental for example), so it'd probably fine to turn off this behavior for themed-widgets-that-don't-support-padding, if we have a way to do that.