2056633 - Assertion failure: IsTextInputScrolledContent(aBlockFrame->GetParent()), at checkouts/gecko/layout/generic/TextOverflow.cpp:841

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260718-1d0f3519e526 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: IsTextInputScrolledContent(aBlockFrame->GetParent()), at checkouts/gecko/layout/generic/TextOverflow.cpp:841

#0 0x75504a07cc18 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x75504a07cc18 in mozilla::css::TextOverflow::CanHaveOverflowMarkers(nsBlockFrame*, mozilla::css::TextOverflow::BeforeReflow) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/TextOverflow.cpp:841:5
#2 0x755049fdc700 in mozilla::BlockReflowState::BlockReflowState(mozilla::ReflowInput const&, nsPresContext*, nsBlockFrame*, bool, bool, bool, int, int, int) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/BlockReflowState.cpp:110:36
#3 0x75504a0965a3 in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2101:20
#4 0x75504a0939c2 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1760:9
#5 0x75504a2c0d02 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsLineLayout.cpp:863:13
#6 0x75504a0b885d in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, GenericLineListIterator<nsLineLink, false>, nsIFrame*, LineReflowStatus*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:5511:15
#7 0x75504a0b67ec in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, GenericLineListIterator<nsLineLink, false>, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:5310:5
#8 0x75504a0afc0d in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:5167:9
#9 0x75504a0a8ffe in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4072:24
#10 0x75504a09d9db in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:3577:29
#11 0x75504a0968db in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2149:35
#12 0x75504a0939c2 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1760:9
#13 0x75504a10b38a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:713:14
#14 0x75504a0d70fa in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:701:7
#15 0x75504a0db37a in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1297:37
#16 0x75504a0b4364 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, mozilla::CollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:289:11
#17 0x75504a0ac1fe in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4807:11
#18 0x75504a0a9141 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4069:5
#19 0x75504a09d9db in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:3577:29
#20 0x75504a0968db in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2149:35
#21 0x75504a0939c2 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1760:9
#22 0x75504a10b38a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:713:14
#23 0x75504a02464c in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:981:3
#24 0x75504a025e52 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1091:3
#25 0x75504a02a599 in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1544:3
#26 0x75504a3afee2 in nsTextControlFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/forms/./../../../../checkouts/gecko/layout/forms/nsTextControlFrame.cpp:266:25
#27 0x75504a2c0d02 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsLineLayout.cpp:863:13
...

Comment 1

[Mayank Bansal]

Got a crash from the testcase on Nightly: https://crash-stats.mozilla.org/report/index/ec2b50c1-bb7d-4d1e-a989-fd39f0260722

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260721202327-396bd39825d0.
The bug appears to have been introduced in the following build range:

Start: 45084753b876bb64c88bb4886ae295bb4be535d0 (20260717161114)
End: 296eb6b873687b885f040e6fb71aec88ec02316a (20260717163416)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=45084753b876bb64c88bb4886ae295bb4be535d0&tochange=296eb6b873687b885f040e6fb71aec88ec02316a

Comment 3

[BugBot [:suhaib / :marco]]

:emilio, since you are the author of the regressor, bug 2047669, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2056633 - Don't allow <input> / <textarea> to be affected by multicol styles. r=TYLin,#layout

Matches other browsers and our previous behavior, in general it doesn't
make sense to split an input into columns.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/694b65b487a4
https://hg.mozilla.org/integration/autoland/rev/f5a67dd06bc5
Don't allow <input> / <textarea> to be affected by multicol styles. r=layout-reviewers,jfkthame

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/61481 for changes under testing/web-platform/tests

Comment 7

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/f5a67dd06bc5

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 9

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:emilio, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox154 to wontfix.

For more information, please visit BugBot documentation.

Comment 10

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2056633 - Don't allow <input> / <textarea> to be affected by multicol styles.

Matches other browsers and our previous behavior, in general it doesn't
make sense to split an input into columns.

Original Revision: https://phabricator.services.mozilla.com/D313434

Comment 11

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: oneliner crash fix
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Trivial fix + test
• String changes made/needed?: none
• Is Android affected?: yes

Comment 12

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260722214024-ae4fce337439.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 13

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/098302da9ad3
https://hg.mozilla.org/releases/mozilla-beta/rev/0c50c1f73808

Comment 14

[Phabricator Automation]

firefox-esr153 Uplift Approval Request

• User impact if declined/Reason for urgency: Regression fix
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: bug 2047669 comment 0
• Risk associated with taking this patch: low
• Explanation of risk level: Has been on nightly + beta for a bit and it's well tested.
• String changes made/needed?: none
• Is Android affected?: yes

Comment 15

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2056633 - Don't allow <input> / <textarea> to be affected by multicol styles.

Matches other browsers and our previous behavior, in general it doesn't
make sense to split an input into columns.

Original Revision: https://phabricator.services.mozilla.com/D313434

Comment 16

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr153/rev/5c429d957218

Comment 17

[Ina Popescu, Desktop QA]

Reproduced the issue on Nightly 155.0a1 (2026-07-20) and also reproduced the issue mentioned in Comment 14 on Nightly 153.0a1 (2026-06-14) using Ubuntu 22.04. Verified as fixed on the latest Nightly 155.0a1, Firefox 154.0b7 and Firefox 153.1.0esr (treeherder build) where the issues no longer reproduce. Updating the flags accordingly.