2063854 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Attempt to insert a frame twice was made), at checkouts/gecko/layout/base/PresShell.cpp:11679

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Found with m-c 20260815-808fcc0ee37e (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting https://build.nvidia.com/google/diffusiongemma-26b-a4b-it/playground. A Pernosco session is available here: https://pernos.co/debug/FHclUInG_kXzW34LZOWeiQ/index.html

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Attempt to insert a frame twice was made), at checkouts/gecko/layout/base/PresShell.cpp:11679

0|0|libxul.so|mozilla::PresShell::AddAnchorPosAnchorImpl(nsAtom const*, nsIFrame*, bool)|git:github.com/mozilla-firefox/firefox:layout/base/PresShell.cpp:98f1235b79c19a808e3101160efb7810b71a75d7|11679|0x401
0|1|libxul.so|nsIFrame::HandlePrimaryFrameStyleChange(mozilla::ComputedStyle*)|git:github.com/mozilla-firefox/firefox:layout/generic/nsIFrame.cpp:98f1235b79c19a808e3101160efb7810b71a75d7|884|0x497
0|2|libxul.so|nsIContent::SetPrimaryFrame(nsIFrame*)|git:github.com/mozilla-firefox/firefox:dom/base/nsIContentInlines.h:98f1235b79c19a808e3101160efb7810b71a75d7|65|0xde
0|3|libxul.so|nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&)|git:github.com/mozilla-firefox/firefox:layout/base/nsCSSFrameConstructor.cpp:98f1235b79c19a808e3101160efb7810b71a75d7|3847|0xb4a
0|4|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&)|git:github.com/mozilla-firefox/firefox:layout/base/nsCSSFrameConstructor.cpp:98f1235b79c19a808e3101160efb7810b71a75d7|5328|0x4f
0|5|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&)|git:github.com/mozilla-firefox/firefox:layout/base/nsCSSFrameConstructor.cpp:98f1235b79c19a808e3101160efb7810b71a75d7|8931|0x335
0|6|libxul.so|nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameList&, bool, nsIFrame*)|git:github.com/mozilla-firefox/firefox:layout/base/nsCSSFrameConstructor.cpp:98f1235b79c19a808e3101160efb7810b71a75d7|9234|0x70f
...

Comment 1

[David Shin[:dshin]]

Attachment: Minimum Reproducible Case

Registering twice by the same name.

Comment 2

[BMO Github Automation]

Attachment: [mozilla-firefox/firefox] Bug 2063854: Don't try to add anchor frame by the same name multiple times. r=#layout-reviewers (#339)

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ebcc08224f29
https://hg.mozilla.org/integration/autoland/rev/1e4fc8691a19
Don't try to add anchor frame by the same name multiple times. r=emilio

Comment 4

[rperta]

https://hg.mozilla.org/mozilla-central/rev/1e4fc8691a19

Comment 5

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62150 for changes under testing/web-platform/tests

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR was closed without merging

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot