2045159 - Assertion failure: mFrame->ComputeScrolledRect(mReferenceFrame) .IsEqualEdges(mScrolledRect) (The scrolled rect changed during an operation that assumed it would remain constant), at checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:7079

Status: VERIFIED FIXED

(Core :: Layout: Scrolling and Overflow, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260603-5cffec5992d3 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: mFrame->ComputeScrolledRect(mReferenceFrame) .IsEqualEdges(mScrolledRect) (The scrolled rect changed during an operation that assumed it would remain constant), at checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:7079

#0 0x7fffebd760bf in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7fffebd760bf in mozilla::ScrollContainerFrame::AutoScrolledRectCache::GetOrCompute() /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:7076:5
#2 0x7fffebd748e3 in GetScrolledRect /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:7042:32
#3 0x7fffebd748e3 in mozilla::ScrollContainerFrame::ComputeCustomOverflow(mozilla::OverflowAreas&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:6535:25
#4 0x7fffebe5335c in nsIFrame::UpdateOverflow() /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:8691:8
#5 0x7fffebd63c8c in mozilla::ScrollContainerFrame::ScrollToImpl(nsPoint, nsRect const&, mozilla::ScrollOrigin, mozilla::ScrollTriggeredByScript) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:3334:5
#6 0x7fffebd64975 in mozilla::ScrollContainerFrame::CompleteAsyncScroll(nsPoint const&, nsRect const&, std::unique_ptr<mozilla::ScrollSnapTargetIds, std::default_delete<mozilla::ScrollSnapTargetIds>>, mozilla::ScrollOrigin) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:2390:3
#7 0x7fffebd60ee6 in mozilla::ScrollContainerFrame::ScrollToWithOrigin(nsPoint, nsRect const*, mozilla::ScrollContainerFrame::ScrollOperationParams&&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:2567:5
#8 0x7fffebd70e3d in mozilla::ScrollContainerFrame::ScrollToRestoredPosition() /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:5374:7
#9 0x7fffebd7404f in mozilla::ScrollContainerFrame::ReflowFinished() /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:6425:5
#10 0x7fffebf082bd in nsListControlFrame::ReflowFinished() /builds/worker/workspace/obj-build/layout/forms/./../../../../checkouts/gecko/layout/forms/nsListControlFrame.cpp:770:32
#11 0x7fffebc5e538 in HandlePostedReflowCallbacks /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:4336:33
#12 0x7fffebc5e538 in mozilla::PresShell::DidDoReflow(bool) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:10476:3
#13 0x7fffebc846fc in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:10794:5
#14 0x7fffebc67e11 in DoFlushLayout /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:10814:10
#15 0x7fffebc67e11 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:4539:9
#16 0x7fffe7a650cd in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1545:5
#17 0x7fffe7a650cd in mozilla::dom::Document::DetermineProximityToViewportAndNotifyResizeObservers() /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Document.cpp:19215:11
#18 0x7fffebc29a14 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2540:14
#19 0x7fffebc29a14 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1309:7
#20 0x7fffebc29a14 in RunRenderingPhaseLegacy<(lambda at /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1288:35)> /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1281:3
#21 0x7fffebc29a14 in void nsRefreshDriver::RunRenderingPhase<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_11>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_11&&, bool (*)(mozilla::dom::Document const&)) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1288:3
#22 0x7fffebc2565c in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2536:3
#23 0x7fffebc2f321 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:365:13
#24 0x7fffebc2f321 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:343:7
#25 0x7fffebc2f220 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:359:5
#26 0x7fffebc2f0cd in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:946:5
#27 0x7fffebc2e70a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:856:5
#28 0x7fffebc2dbe6 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:587:14
#29 0x7fffeaf3eabb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:64:15
#30 0x7fffeb1c6cd0 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/dom/ipc/./../../ipc/ipdl/PVsyncChild.cpp:241:78
#31 0x7fffe651654c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../ipdl/PBackgroundChild.cpp:4955:32
#32 0x7fffe64b498e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1797:25
#33 0x7fffe64b1f04 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1723:9
#34 0x7fffe64b2917 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1512:3
#35 0x7fffe64b38f9 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1614:14
#36 0x7fffe6382607 in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:719:16
#37 0x7fffe6377b04 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1358:20
#38 0x7fffe6376647 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1181:15
#39 0x7fffe6376ac5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:655:36
#40 0x7fffe6381d26 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:347:37
#41 0x7fffe6381d26 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:536:5
#42 0x7fffe6396923 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1179:16
#43 0x7fffe639c67f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:472:10
#44 0x7fffe64ba887 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:83:21
#45 0x7fffe6412261 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#46 0x7fffe6412261 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#47 0x7fffeb802468 in nsBaseAppShell::Run() /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/nsBaseAppShell.cpp:151:27
#48 0x7fffeb8d5f14 in nsAppShell::Run() /builds/worker/workspace/obj-build/widget/gtk/./../../../../checkouts/gecko/widget/gtk/nsAppShell.cpp:575:33
#49 0x7fffec9038fb in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:654:20
#50 0x7fffe64bb734 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:233:9
#51 0x7fffe6412261 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#52 0x7fffe6412261 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#53 0x7fffec903052 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:592:34
#54 0x5555555dab0c in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:466:22

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2044231

:tnikkel, since you are the author of the regressor, bug 2044231, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260605012545-66d48816ebef.
The bug appears to have been introduced in the following build range:

Start: d702729eece284838ad15b590245dc41cd9ebf58 (20260603025759)
End: e36009fd0525f9980de27cf667a7e7d7fce45f06 (20260603025837)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=d702729eece284838ad15b590245dc41cd9ebf58&tochange=e36009fd0525f9980de27cf667a7e7d7fce45f06

Comment 3

[Timothy Nikkel (:tnikkel)]

I think when we call RecomputePerspectiveChildrenOverflow here
https://searchfox.org/firefox-main/rev/d6bfff43852356ca98af848b4705d37f8d41856f/layout/generic/ScrollContainerFrame.cpp#3332
we update the overflow rect that the scrolled rect depends on, and then the UpdateOverflow call on the next line hits the assert when it gets the scrolled rect.

We should probably invalidate the cache if this happens.

Comment 4

[Timothy Nikkel (:tnikkel)]

Attachment: Bug 2045159. Invalidate the scrolled rect cache when ScrollToImpl recomputes perspective overflow. r?#layout-reviewers

Bug 2044231 started using an AutoScrolledRectCache during
ScrollContainerFrame::ReflowFinished so the several GetScrolledRect() calls
there share a single computation. In debug builds the cache asserts that the
scrolled rect stays constant while it is alive.

ReflowFinished calls ScrollToRestoredPosition (and a clamping ScrollToImpl)
while the cache is alive. When the scroll container has perspective
descendants, ScrollToImpl calls RecomputePerspectiveChildrenOverflow, which
recomputes those descendants' overflow (it depends on the scroll position) and
thereby changes mScrolledFrame's scrollable overflow. That overflow is an input
to ComputeScrolledRect, so the scrolled rect legitimately changes while the
cache is alive, and the UpdateOverflow() on the next line reads it back through
the cache and asserts.

Invalidate the cache as soon as RecomputePerspectiveChildrenOverflow reports a
change, before the UpdateOverflow() that reads the rect, so that it (and any
later GetScrolledRect() calls in ReflowFinished) recompute the new value.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/46b4a9abdecb
https://hg.mozilla.org/integration/autoland/rev/7cf879848053
Invalidate the scrolled rect cache when ScrollToImpl recomputes perspective overflow. r=layout-reviewers,emilio

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/60770 for changes under testing/web-platform/tests

Comment 7

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/7cf879848053

Comment 8

[Timothy Nikkel (:tnikkel)]

Attachment: Bug 2045159. Invalidate the scrolled rect cache when ScrollToImpl recomputes perspective overflow.

Bug 2044231 started using an AutoScrolledRectCache during
ScrollContainerFrame::ReflowFinished so the several GetScrolledRect() calls
there share a single computation. In debug builds the cache asserts that the
scrolled rect stays constant while it is alive.

ReflowFinished calls ScrollToRestoredPosition (and a clamping ScrollToImpl)
while the cache is alive. When the scroll container has perspective
descendants, ScrollToImpl calls RecomputePerspectiveChildrenOverflow, which
recomputes those descendants' overflow (it depends on the scroll position) and
thereby changes mScrolledFrame's scrollable overflow. That overflow is an input
to ComputeScrolledRect, so the scrolled rect legitimately changes while the
cache is alive, and the UpdateOverflow() on the next line reads it back through
the cache and asserts.

Invalidate the cache as soon as RecomputePerspectiveChildrenOverflow reports a
change, before the UpdateOverflow() that reads the rect, so that it (and any
later GetScrolledRect() calls in ReflowFinished) recompute the new value.

Comment 9

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: straight forward regression fix for a bug that landed in 153 so we never ship it to users
• Code covered by automated testing?: yes
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: straight forward regression fix for a bug that landed in 153 so we never ship it to users
• String changes made/needed?: none
• Is Android affected?: yes

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260620160029-5ebe17a367f8.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 11

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/19c085995115
https://hg.mozilla.org/releases/mozilla-beta/rev/7138bb909edf

Comment 12

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot