1945272 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Fell off frame tree looking for ancestor block!), at /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:8674

Status: RESOLVED FIXED

(Core :: Layout: Block and Inline, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20250117-4f1775f4e145 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Fell off frame tree looking for ancestor block!), at /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:8674

#0 0x7862eaf940a3 in nsBlockFrame::GetNearestAncestorBlock(nsIFrame*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:8674:3
#1 0x7862eaf14c53 in mozilla::BRFrame::AccessibleType() /builds/worker/checkouts/gecko/layout/generic/BRFrame.cpp:285:7
#2 0x7862eb44bb62 in nsAccessibilityService::CreateAccessible(nsINode*, mozilla::a11y::LocalAccessible*, bool*) /builds/worker/checkouts/gecko/accessible/base/nsAccessibilityService.cpp:1360:25
#3 0x7862eb44a7eb in AccessibleFor /builds/worker/checkouts/gecko/accessible/base/TreeWalker.cpp:328:29
#4 0x7862eb44a7eb in mozilla::a11y::TreeWalker::Next() /builds/worker/checkouts/gecko/accessible/base/TreeWalker.cpp:185:32
#5 0x7862eb47c18c in mozilla::a11y::DocAccessible::CacheChildrenInSubtree(mozilla::a11y::LocalAccessible*, mozilla::a11y::LocalAccessible**) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:2824:44
#6 0x7862eb47c1ce in mozilla::a11y::DocAccessible::CacheChildrenInSubtree(mozilla::a11y::LocalAccessible*, mozilla::a11y::LocalAccessible**) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:2833:7
#7 0x7862eb47c1ce in mozilla::a11y::DocAccessible::CacheChildrenInSubtree(mozilla::a11y::LocalAccessible*, mozilla::a11y::LocalAccessible**) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:2833:7
#8 0x7862eb47c1ce in mozilla::a11y::DocAccessible::CacheChildrenInSubtree(mozilla::a11y::LocalAccessible*, mozilla::a11y::LocalAccessible**) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:2833:7
#9 0x7862eb47c1ce in mozilla::a11y::DocAccessible::CacheChildrenInSubtree(mozilla::a11y::LocalAccessible*, mozilla::a11y::LocalAccessible**) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:2833:7
#10 0x7862eb47bc87 in mozilla::a11y::DocAccessible::DoInitialUpdate() /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:1736:3
#11 0x7862eb43a804 in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:745:16
#12 0x7862eae07445 in nsRefreshDriver::TickObserverArray(unsigned int, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2568:10
#13 0x7862eae03c13 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2835:8
#14 0x7862eae0ccd1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:13
#15 0x7862eae0ccd1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:346:7
#16 0x7862eae0cbd0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:362:5
#17 0x7862eae0ca6d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:948:5
#18 0x7862eae0bd9c in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:858:5
#19 0x7862eae0b129 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:593:14
#20 0x7862ea210e0b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#21 0x7862ea49f2cd in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:235:78
#22 0x7862ea3cc9b0 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8677:32
#23 0x7862e5c3edab in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1790:25
#24 0x7862e5c3bc94 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1717:9
#25 0x7862e5c3c912 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1508:3
#26 0x7862e5c3daaf in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1608:14
#27 0x7862e5077527 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:714:16
#28 0x7862e506d9cd in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1143:20
#29 0x7862e506c647 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:966:15
#30 0x7862e506cac5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:650:36
#31 0x7862e507fd79 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:354:37
#32 0x7862e507fd79 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#33 0x7862e5093484 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#34 0x7862e509a11f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#35 0x7862e5c44b43 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5
#36 0x7862e5b95321 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#37 0x7862e5b95321 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#38 0x7862eaa4b1e8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#39 0x7862eab0f214 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:470:33
#40 0x7862eba4176b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:646:20
#41 0x7862e5c45a34 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#42 0x7862e5b95321 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#43 0x7862e5b95321 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#44 0x7862eba40b9a in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:584:34
#45 0x600f484d49fe in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

Comment 1

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1945272 using build mozilla-central 20250117215754-4f1775f4e145. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1937696

:masayuki, since you are the author of the regressor, bug 1937696, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(sick)]

If <br style="position:fixed">, its parent frame is the viewport frame and no block.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(sick)]

Attachment: Bug 1945272 - Make `BRFrame::AccessibleType()` treat its content as normal `<br>` if parent is a viewport frame r=emilio!

If position of <br> is fixed, its parent frame is only the viewport
frame, thus, no block frame ancestors causing
nsBlockFrame::GetNearestAncestorBlock runs the unreachable case.
Therefore, if the parent frame of the BRFrame is a viewport frame, it should
return a11y::eHTMLBRType as treating itself as a normal <br> rather than
a padding <br> element.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/83fa760f6466
Make `BRFrame::AccessibleType()` treat its content as normal `<br>` if parent is a viewport frame r=emilio

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/83fa760f6466

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:masayuki, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox136 to wontfix.

For more information, please visit BugBot documentation.

Comment 8

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(sick)]

The method containing the assertion returns nullptr in opt builds as my code expected. Therefore, we don't need to uplift this to beta.