2036150 - Assertion failure: IsEmpty() (Nonempty list left over?), at /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.h:3146

Status: VERIFIED FIXED

(Core :: Web Painting, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260420-80bf65012815 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: IsEmpty() (Nonempty list left over?), at /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.h:3146

#0 0x7bffdc8d90a0 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:235:3
#1 0x7bffdc8d90a0 in mozilla::nsDisplayList::~nsDisplayList() /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.h:3146:7
#2 0x7bffdcac42cb in ~nsDisplayListCollection /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.h:3628:8
#3 0x7bffdcac42cb in mozilla::ScrollContainerFrame::AppendScrollPartsTo(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&, bool, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:3612:3
#4 0x7bffdcaccdb2 in mozilla::ScrollContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:4366:3
#5 0x7bffdcb75a1e in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4646:12
#6 0x7bffdcb72bc6 in nsContainerFrame::BuildDisplayListForNonBlockChildren(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:328:5
#7 0x7bffdccd667a in BuildDisplayListForInline /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.h:560:5
#8 0x7bffdccd667a in nsInlineFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsInlineFrame.cpp:234:3
#9 0x7bffdcb75c84 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4631:14
#10 0x7bffdcb72bc6 in nsContainerFrame::BuildDisplayListForNonBlockChildren(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:328:5
#11 0x7bffdccd667a in BuildDisplayListForInline /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.h:560:5
#12 0x7bffdccd667a in nsInlineFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsInlineFrame.cpp:234:3
#13 0x7bffdcb75c84 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4631:14
#14 0x7bffdcb72bc6 in nsContainerFrame::BuildDisplayListForNonBlockChildren(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:328:5
#15 0x7bffdccd667a in BuildDisplayListForInline /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.h:560:5
#16 0x7bffdccd667a in nsInlineFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsInlineFrame.cpp:234:3
#17 0x7bffdcb75c84 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4631:14
#18 0x7bffdcb41c05 in DisplayLine(mozilla::nsDisplayListBuilder*, GenericLineListIterator<nsLineLink, false>&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&, bool&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:7714:13
#19 0x7bffdcb3f9e0 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:7909:9
#20 0x7bffdcb75c84 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4631:14
#21 0x7bffdcb48928 in nsCanvasFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsCanvasFrame.cpp:391:5
#22 0x7bffdcb75c84 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4631:14
#23 0x7bffdcb01b9e in mozilla::ViewportFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ViewportFrame.cpp:78:3
#24 0x7bffdcd49b05 in nsPageContentFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsPageContentFrame.cpp:377:29
#25 0x7bffdcb75c84 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4631:14
#26 0x7bffdcb72bc6 in nsContainerFrame::BuildDisplayListForNonBlockChildren(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:328:5
#27 0x7bffdcd51caf in nsPageFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsPageFrame.cpp:930:25
#28 0x7bffdcb75c84 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:4631:14
#29 0x7bffdca705fe in mozilla::PrintedSheetFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/PrintedSheetFrame.cpp:42:7
#30 0x7bffdcc7a2d1 in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:3551:5
#31 0x7bffdc9dd9e2 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsLayoutUtils.cpp:3185:15
#32 0x7bffdcd59b3d in nsPageSequenceFrame::PrintNextSheet() /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsPageSequenceFrame.cpp:762:3
#33 0x7bffdd18efc1 in nsPrintJob::PrintSheet(nsPrintObject*) /builds/worker/workspace/obj-build/layout/printing/./../../../../checkouts/gecko/layout/printing/nsPrintJob.cpp:1777:31
#34 0x7bffdd18e764 in nsPagePrintTimer::Run() /builds/worker/workspace/obj-build/layout/printing/./../../../../checkouts/gecko/layout/printing/nsPagePrintTimer.cpp:87:43
#35 0x7bffd0732ffa in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:719:16
#36 0x7bffd0727e89 in mozilla::TaskController::RunTask(mozilla::Task*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:210:19
#37 0x7bffd072f34d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1358:20
#38 0x7bffd072ce28 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1181:15
#39 0x7bffd072d446 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:655:36
#40 0x7bffd0746834 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:350:37
#41 0x7bffd0746834 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:547:5
#42 0x7bffd076b36c in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1179:16
#43 0x7bffd0774799 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465:10
#44 0x7bffd4b6d282 in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, RefPtr<mozilla::dom::BrowsingContext>*, mozilla::ErrorResult&)::$_1>(nsTSubstring<char> const&, nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, RefPtr<mozilla::dom::BrowsingContext>*, mozilla::ErrorResult&)::$_1&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:174:25
#45 0x7bffd4b6993d in nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, RefPtr<mozilla::dom::BrowsingContext>*, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5279:5
#46 0x7bffd4b6798f in nsGlobalWindowOuter::PrintOuter(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5015:3
#47 0x7bffd4af95f2 in nsGlobalWindowInner::Print(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:4018:3
#48 0x7bffd6692714 in mozilla::dom::Window_Binding::print(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./WindowBinding.cpp:4089:24
#49 0x7bffd6e3d274 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./../../../../checkouts/gecko/dom/bindings/BindingUtils.cpp:3376:13
#50 0x7bffdff7982d in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:488:13
#51 0x7bffdff7982d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:584:12
#52 0x7bffdf1983b0 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/obj-build/js/src/jit/./../../../../../checkouts/gecko/js/src/jit/BaselineIC.cpp:1699:10
#53 0x2036015188f3  ([anon:js-executable-memory]+0x28f3)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260430212929-d0c43f211001.
The bug appears to have been introduced in the following build range:

Start: 1b7b4f3ff7d17978a362ba0ebfa3d27b7ff5e3e9 (20260416150540)
End: a77a08b9be8a059936afa68f259adb86823bb75f (20260416171041)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1b7b4f3ff7d17978a362ba0ebfa3d27b7ff5e3e9&tochange=a77a08b9be8a059936afa68f259adb86823bb75f

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 2031757

:emilio, since you are the author of the regressor, bug 2031757, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2036150 - Minor clean-up to ScrollContainerFrame::AppendScrollPartsTo. r=#layout

Comment 4

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2036150 - Don't assume that ForceStackingContext puts everything in PositionedDescendants(). r=tnikkel!

Bug 2031757 started treating the <input> button (like the number input
spinbox, or the reveal password button) as a scrollbar part.

Things like print linkifier and such uses the Content() lists, so this
assumption doesn't hold when printing:

https://searchfox.org/firefox-main/rev/8b6198f56d80ba962e0570e5ae8a3c257e2e7bce/layout/generic/nsIFrame.cpp#4270

I'm guessing we haven't hit this before because we suppress scrollbars
when printing.

I think this is probably the most straight-forward fix (just stop making
that assumption).

But LMK if you disagree and I can try something else (another potential
fix is checking the flag in the linking code to put it in the
PositionedDescendants() list, or so, same for the accessibility tree
reference).

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/622f896f88c7
https://hg.mozilla.org/integration/autoland/rev/7c213ea8666c
Minor clean-up to ScrollContainerFrame::AppendScrollPartsTo. r=layout-reviewers,hiro
https://github.com/mozilla-firefox/firefox/commit/237a75662c53
https://hg.mozilla.org/integration/autoland/rev/4e9809a92152
Don't assume that ForceStackingContext puts everything in PositionedDescendants(). r=tnikkel,layout-reviewers

Comment 6

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/7c213ea8666c
https://hg.mozilla.org/mozilla-central/rev/4e9809a92152

Comment 7

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260502213701-5711d5a36a41.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:emilio, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox151 to wontfix.

For more information, please visit BugBot documentation.

Comment 9

[Emilio Cobos Álvarez [:emilio]]

I think this is edge casey enough to not need uplift. You need a link, an input inside that link, and then printing it. And the consequence is that the spin buttons (which arguably should be hidden during print perhaps?) might not be there.

So I think it's fair to wontfix this.

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/59655 for changes under testing/web-platform/tests

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot