2010353 - Assertion failure: !mFinishedBuildingColumns (Should only call once!), at /builds/worker/checkouts/gecko/layout/generic/ColumnSetWrapperFrame.cpp:107

Status: VERIFIED FIXED

(Core :: Layout: Columns, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260109-13aa00007318 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !mFinishedBuildingColumns (Should only call once!), at /builds/worker/checkouts/gecko/layout/generic/ColumnSetWrapperFrame.cpp:107

#0 0x726b800ca5b0 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
#1 0x726b800ca5b0 in mozilla::ColumnSetWrapperFrame::AppendFrames(mozilla::FrameChildListID, nsFrameList&&) /builds/worker/checkouts/gecko/layout/generic/ColumnSetWrapperFrame.cpp:107:3
#2 0x726b8004a556 in nsCSSFrameConstructor::FinishBuildingColumns(nsFrameConstructorState&, nsContainerFrame*, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:10222:22
#3 0x726b8004fff8 in nsCSSFrameConstructor::AppendFramesToParent(nsFrameConstructorState&, nsContainerFrame*, nsFrameList&, nsIFrame*, bool) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:5653:5
#4 0x726b80053233 in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:6601:7
#5 0x726b7ff42f65 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:1620:27
#6 0x726b7ff4a45d in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:3250:7
#7 0x726b7ff4b6d1 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:3340:3
#8 0x726b7fffa2f7 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4471:37
#9 0x726b7bf207a5 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1526:5
#10 0x726b7bf207a5 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:11624:16
#11 0x726b7bf6b42a in FlushPendingNotifications /builds/worker/checkouts/gecko/dom/base/Document.cpp:11556:3
#12 0x726b7bf6b42a in nsIContent::GetPrimaryFrame(mozilla::FlushType) /builds/worker/checkouts/gecko/dom/base/Element.cpp:275:10
#13 0x726b7bf6e695 in mozilla::dom::Element::GetScrollContainerFrame(nsIFrame**, mozilla::FlushType) /builds/worker/checkouts/gecko/dom/base/Element.cpp:718:21
#14 0x726b7bf6f857 in GetScrollOrigin /builds/worker/checkouts/gecko/dom/base/Element.cpp:1035:30
#15 0x726b7bf6f857 in mozilla::dom::Element::ScrollLeft() /builds/worker/checkouts/gecko/dom/base/Element.cpp:946:33
#16 0x726b7d2197ec in mozilla::dom::Element_Binding::get_scrollLeft(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./ElementBinding.cpp:4258:38
#17 0x726b7d3ca6b4 in bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3178:13
#18 0x726b81f78c44 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:490:13
#19 0x726b81f784ef in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:586:12
#20 0x726b81f798ec in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:685:8
#21 0x726b81f7aa53 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:807:10
#22 0x726b82305a2f in CallGetter /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2139:12
#23 0x726b82305a2f in bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, js::PropertyInfoBase<unsigned int>, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2167:12
#24 0x726b823061b2 in bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2310:14
#25 0x726b80dc9973 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:120:10
#26 0x726b81f994b0 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:4617:10
#27 0x726b81f863d7 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:2927:12
#28 0x726b81f77b3a in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:460:13
#29 0x726b81f78515 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:618:13
#30 0x726b81f798ec in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:685:8
#31 0x726b821c295b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#32 0x726b7d273f35 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
#33 0x726b7dd098fb in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#34 0x726b7dd08442 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:201:12
#35 0x726b7dce3511 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1288:22
#36 0x726b7dce4669 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1594:12
#37 0x726b7dce3f51 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1499:35
#38 0x726b7dcd880e in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:465:5
#39 0x726b7dcd880e in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:364:17
#40 0x726b7dcd7edc in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:605:16
#41 0x726b7dcda692 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1260:11
#42 0x726b7dcdd22a in mozilla::EventDispatcher::DispatchDOMEvent(mozilla::dom::EventTarget*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:0:0
#43 0x726b7c1dbdf6 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:1549:17
#44 0x726b7dceb047 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/events/EventTarget.cpp:215:9
#45 0x726b7dc934fd in mozilla::AsyncEventDispatcher::DispatchEventOnTarget(mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::ChromeOnlyDispatch, mozilla::Composed) /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:76:3
#46 0x726b7dc93199 in mozilla::AsyncEventDispatcher::Run() /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:63:5
#47 0x726b79effd67 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:705:16
#48 0x726b79efa6e4 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1325:20
#49 0x726b79ef9367 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1148:15
#50 0x726b79ef97e5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:641:36
#51 0x726b79f06be6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
#52 0x726b79f06be6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:549:5
#53 0x726b79f18cc3 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1164:16
#54 0x726b79f1f5bf in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:461:10
#55 0x726b7ab0fd87 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#56 0x726b7aa690b1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:361:3
#57 0x726b7aa690b1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:343:3
#58 0x726b7fbba858 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:152:27
#59 0x726b7fc87194 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:555:33
#60 0x726b80cd075b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:20
#61 0x726b7ab10c34 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#62 0x726b7aa690b1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:361:3
#63 0x726b7aa690b1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:343:3
#64 0x726b80ccfeb1 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:594:34
#65 0x598eb1b7609c in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:465:22

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260114211245-a6d1d264718a.
The bug appears to have been introduced in the following build range:

Start: 791d47406d61d6ee6e99e1e84b896b227a775c8b (20260103085132)
End: 4dc50e8367a1d9082bc8f8fa8296481ec97a2ba4 (20260103093014)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=791d47406d61d6ee6e99e1e84b896b227a775c8b&tochange=4dc50e8367a1d9082bc8f8fa8296481ec97a2ba4

Comment 2

[BugBot [:suhaib / :marco]]

Setting Regressed by field after analyzing regression range found by bugmon in comment #1.

Comment 3

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2008148

:emilio, since you are the author of the regressor, bug 2008148, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 5

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 6

[Emilio Cobos Álvarez [:emilio]]

Ting-Yu, this seems like another hit of that assert which I don't quite get. We're doing two separate appends to the end of the column-content, and we seem to deal with that specially to avoid reframing. So to me this assert still looks finshy but I want to confirm my understanding with you :)

Comment 7

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

I'll debug this bug once I finish bug 1994346. Thanks for waiting.

Comment 8

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

(In reply to Emilio Cobos Álvarez [:emilio] from comment #6)

Ting-Yu, this seems like another hit of that assert which I don't quite get. We're doing two separate appends to the end of the column-content, and we seem to deal with that specially to avoid reframing. So to me this assert still looks finshy but I want to confirm my understanding with you :)

I crafted a testcase that triggers the assertion, examined the frame tree, and confirmed that we can handle appending elements into a multicol container correctly, even when the element contains column-span descendants. The old code assumes that we must reframe in this scenario, but that turns out to be unnecessary.

Comment 9

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Bug 2010353 - Remove overly restrictive assertion in ColumnSetWrapperFrame::AppendFrames(). r?#layout

We can correctly append elements into a multicol container even when they have
column-span descendants, so remove the assertion to allow this operation.

The WPT added in this patch triggers the assertion in the old code.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/12231d6eabe8
https://hg.mozilla.org/integration/autoland/rev/ca85711042f0
Remove overly restrictive assertion in ColumnSetWrapperFrame::AppendFrames(). r=layout-reviewers,emilio

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/57538 for changes under testing/web-platform/tests

Comment 12

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/ca85711042f0

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 14

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260203210813-62b991cbf350.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.