2031808 - Assertion failure: nextInline (There is always a trailing inline in an IB split), at /builds/worker/checkouts/gecko/layout/generic/nsInlineFrame.cpp:928

Status: RESOLVED DUPLICATE of bug 2028537

(Core :: Layout: Block and Inline, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260414-cab7490156a4 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: nextInline (There is always a trailing inline in an IB split), at /builds/worker/checkouts/gecko/layout/generic/nsInlineFrame.cpp:928

#0 0x75aead4c3f35 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:235:3
#1 0x75aead4c3f35 in nsInlineFrame::UpdateStyleOfOwnedAnonBoxesForIBSplit(mozilla::ServoRestyleState&) /builds/worker/checkouts/gecko/layout/generic/nsInlineFrame.cpp:928:5
#2 0x75aead21af9f in UpdateStyleOfOwnedAnonBoxes /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h:4268:7
#3 0x75aead21af9f in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:3002:19
#4 0x75aead21aed7 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:2984:32
#5 0x75aead21aed7 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:2984:32
#6 0x75aead21aed7 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:2984:32
#7 0x75aead21c53d in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:3200:28
#8 0x75aead21cf91 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:3318:3
#9 0x75aead2d0465 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4490:37
#10 0x75aea90f6165 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1528:5
#11 0x75aea90f6165 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:11632:16
#12 0x75aea913f373 in FlushPendingNotifications /builds/worker/checkouts/gecko/dom/base/Document.cpp:11564:3
#13 0x75aea913f373 in nsIContent::GetPrimaryFrame(mozilla::FlushType) /builds/worker/checkouts/gecko/dom/base/Element.cpp:275:10
#14 0x75aea9142ba5 in mozilla::dom::Element::GetScrollContainerFrame(nsIFrame**, mozilla::FlushType) /builds/worker/checkouts/gecko/dom/base/Element.cpp:777:21
#15 0x75aea9144bce in mozilla::dom::Element::GetClientAreaRect() /builds/worker/checkouts/gecko/dom/base/Element.cpp:1125:34
#16 0x75aeaa43a0a2 in ClientLeft /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:1769:35
#17 0x75aeaa43a0a2 in mozilla::dom::Element_Binding::get_clientLeft(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./ElementBinding.cpp:4671:39
#18 0x75aeaa5d0ca4 in bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3245:13
#19 0x75aeaf26e954 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:488:13
#20 0x75aeaf26e1ff in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:584:12
#21 0x75aeaf26f5fc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:683:8
#22 0x75aeaf270763 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:805:10
#23 0x75aeaf5fe91c in CallGetter /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2161:12
#24 0x75aeaf5fe91c in bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, js::PropertyInfoBase<unsigned int>, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2189:12
#25 0x75aeaf5ff062 in bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2332:14
#26 0x75aeae095ff3 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:118:10
#27 0x75aeaf28f3d0 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:4628:10
#28 0x75aeae866653 in js::jit::DoGetPropFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1319:8
#29 0x2b5380ee7c6a  ([anon:js-executable-memory]+0xcc6a)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260414211344-facf11f6cdea.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 5570068aefc3e969c647dd96a2fbc323ec4b09d0 (20250416214320)
End: cab7490156a4d2f390fb958ad79426f3126fd993 (20260414085455)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 2

[Mayank Bansal]

Got a crash from the testcase on Nightly: https://crash-stats.mozilla.org/report/index/fc89b78d-ba73-4116-a111-4cf800260415

Comment 3

[David Shin[:dshin]]

S3 - Debug assertion, no crash in release, and the case involves IB split in fragmentation that will never fit the content.

Comment 4

[Daniel Holbert [:dholbert]]

(In reply to David Shin[:dshin] from comment #3)

S3 - Debug assertion, no crash in release

Minor correction... per comment 2, this does actually crash in release (might require a reload -- it did for me).
My crash: bp-d7ec7c97-04f1-48b2-8590-9969a0260416

The crash looks like it might be a wild-pointer access, too; and it's happening while we're doing comparisons inside the frame property table, not after we return a nullptr and walk past the assertion that fails in debug builds. So there might be something sec-sensitive here. Let's mark this as hidden out of an abundance of caution...

Comment 5

[Daniel Holbert [:dholbert]]

This turned out to be a dupe of a bug that I was previously investigating, bug 2028537. I'll be posting a fix over there shortly.

Comment 6

[Bugmon [:jkratzer for issues]]

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.