1958995 - Assertion failure: !aCmp(*(aBegin + b), *(aBegin + a)) (Your comparator is not a valid strict-weak ordering), at /builds/worker/workspace/obj-build/dist/include/nsTArray.h:321

Status: RESOLVED DUPLICATE of bug 1958131

(Core :: Layout: Flexbox, defect)

Description

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: testcase.html

Found while fuzzing m-c 20250405-c27e68d60e42 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !aCmp(*(aBegin + b), *(aBegin + a)) (Your comparator is not a valid strict-weak ordering), at /builds/worker/workspace/obj-build/dist/include/nsTArray.h:321

#0 0x70b6e4126ae1 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
#1 0x70b6e4126ae1 in void detail::AssertStrictWeakOrder<nsIFrame**, void nsTArray_Impl<nsIFrame*, nsTArrayInfallibleAllocator>::StableSort<int (*)(nsIFrame* const&, nsIFrame* const&)>(int (* const&)(nsIFrame* const&, nsIFrame* const&))::'lambda'(int (* const&)(nsIFrame* const&, nsIFrame* const&), auto const&)>(int (*)(nsIFrame* const&, nsIFrame* const&), int (*)(nsIFrame* const&, nsIFrame* const&), auto const&) /builds/worker/workspace/obj-build/dist/include/nsTArray.h:320:9
#2 0x70b6e412670d in void nsTArray_Impl<nsIFrame*, nsTArrayInfallibleAllocator>::StableSort<int (*)(nsIFrame* const&, nsIFrame* const&)>(int (* const&)(nsIFrame* const&, nsIFrame* const&)) /builds/worker/workspace/obj-build/dist/include/nsTArray.h:2415:5
#3 0x70b6e409745e in mozilla::CSSOrderAwareFrameIteratorT<nsFrameList::Iterator<nsFrameList::ForwardFrameTraversal>>::CSSOrderAwareFrameIteratorT(nsIFrame*, mozilla::FrameChildListID, mozilla::CSSOrderAwareFrameIteratorT<nsFrameList::Iterator<nsFrameList::ForwardFrameTraversal>>::ChildFilter, mozilla::CSSOrderAwareFrameIteratorT<nsFrameList::Iterator<nsFrameList::ForwardFrameTraversal>>::OrderState, mozilla::CSSOrderAwareFrameIteratorT<nsFrameList::Iterator<nsFrameList::ForwardFrameTraversal>>::OrderingProperty) /builds/worker/workspace/obj-build/dist/include/mozilla/CSSOrderAwareFrameIterator.h:110:15
#4 0x70b6e409a2a9 in nsFlexContainerFrame::GenerateFlexLines(mozilla::ReflowInput const&, int, int, nsTArray<nsFlexContainerFrame::StrutInfo> const&, nsFlexContainerFrame::FlexboxAxisTracker const&, int, nsTArray<nsIFrame*>&, nsTArray<nsFlexContainerFrame::FlexLine>&, bool&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:4214:30
#5 0x70b6e409d8d6 in nsFlexContainerFrame::DoFlexLayout(mozilla::ReflowInput const&, int, int, nsFlexContainerFrame::FlexboxAxisTracker const&, int, int, nsTArray<nsFlexContainerFrame::StrutInfo>&, ComputedFlexContainerInfo*) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:5291:3
#6 0x70b6e409c35c in nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:4700:11
#7 0x70b6e4076464 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:905:14
#8 0x70b6e40cf841 in MeasuringReflow(nsIFrame*, mozilla::ReflowInput const*, gfxContext*, mozilla::LogicalSize const&, mozilla::LogicalSize const&, int, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5603:11
#9 0x70b6e40d3a10 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, mozilla::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5839:12
#10 0x70b6e40ce6ef in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5889:15
#11 0x70b6e40ce076 in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeForNonSpanningItems(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
#12 0x70b6e40cbc41 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6823:7
#13 0x70b6e40c0cc3 in CalculateSizes /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6012:3
#14 0x70b6e40c0cc3 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:4137:12
#15 0x70b6e40dbe40 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:9122:12
#16 0x70b6e4056bd4 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, mozilla::CollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:290:11
#17 0x70b6e4052850 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4535:11
#18 0x70b6e404ff72 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3860:5
#19 0x70b6e404902d in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3367:29
#20 0x70b6e4045322 in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1939:35
#21 0x70b6e40436be in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1575:9
#22 0x70b6e4076464 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:905:14
#23 0x70b6e4069596 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:678:7
#24 0x70b6e4076464 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:905:14
#25 0x70b6e400bb6d in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:914:3
#26 0x70b6e400c194 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1030:3
#27 0x70b6e400e6d3 in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1490:3
#28 0x70b6e40810c4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:946:14
#29 0x70b6e40383e5 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:371:7
#30 0x70b6e3f0dfaa in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10262:11
#31 0x70b6e3f35b0e in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10432:22
#32 0x70b6e3f18554 in DoFlushLayout /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10482:10
#33 0x70b6e3f18554 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4619:9
#34 0x70b6e0123327 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1476:5
#35 0x70b6e0123327 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:11421:16
#36 0x70b6df104a80 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:728:14
#37 0x70b6df105e79 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:666:5
#38 0x70b6e4421d5f in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:13861:23
#39 0x70b6de4e874f in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:636:22
#40 0x70b6de4e98d6 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:532:10
#41 0x70b6e012873c in mozilla::dom::Document::DoUnblockOnload() /builds/worker/checkouts/gecko/dom/base/Document.cpp:12215:18
#42 0x70b6e010efbe in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:8527:3
#43 0x70b6e01cfc35 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
#44 0x70b6e01cfc35 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#45 0x70b6e01cfc35 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#46 0x70b6e01cfc35 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#47 0x70b6e01cfc35 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#48 0x70b6e01cfc35 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
#49 0x70b6e01cfc35 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
#50 0x70b6de281e17 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#51 0x70b6de27b19e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1252:20
#52 0x70b6de279ed7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1075:15
#53 0x70b6de27a355 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#54 0x70b6de288ee6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
#55 0x70b6de288ee6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#56 0x70b6de29af43 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#57 0x70b6de2a17bf in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#58 0x70b6dee32b37 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#59 0x70b6ded8d0c1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#60 0x70b6ded8d0c1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#61 0x70b6e3b06948 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#62 0x70b6e3bcc764 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:539:33
#63 0x70b6e4aecddb in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:646:20
#64 0x70b6dee339e4 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#65 0x70b6ded8d0c1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#66 0x70b6ded8d0c1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#67 0x70b6e4aec219 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:584:34
#68 0x571e9da7119e in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250407212917-de204898c52a.
The bug appears to have been introduced in the following build range:

Start: 931a44705ab388cc72fd492e051ceda0a2827743 (20250327164403)
End: 9a82ba2065505026e26c67a7bf58bfdce0a16b89 (20250327134432)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=931a44705ab388cc72fd492e051ceda0a2827743&tochange=9a82ba2065505026e26c67a7bf58bfdce0a16b89

Comment 2

[BugBot [:suhaib / :marco]]

:tsmith, since this bug is a regression, could you fill (if possible) the regressed_by field?
For more information, please visit BugBot documentation.

Comment 3

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1956780

Comment 4

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Bug 1956780 only added the check that is failing not the actual issue.

Comment 5

[Greg Hess]

:dholbert This bug does not have priority/severity set and and is identified as a Fx138 regression. Are you able to help triage to asses impact on 138 please.

Comment 6

[Andrew McCreight [:mccr8]]

It isn't really a regression. We just added a new check that found a pre-existing problem.

Comment 7

[Jonathan Kew [:jfkthame]]

This is about the CSSOrderAwareFrameIterator comparators, which were just fixed in bug 1958131.

Comment 8

[Bugmon [:jkratzer for issues]]

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.