2066154 - Anchor-positioned element with position-visibility:always results in a crash when the containing block is inline and IB-split

Status: RESOLVED FIXED

(Core :: Layout: Positioned, defect)

Description

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Testcase #1: testcase in bug 2010760 with position-visibility:always

File a platform layout bug for the root cause for bug 2010760.

Load the attached testcase. It doesn't render anything in Firefox release, and triggers the following assertion in debug builds.

[27177] Assertion failure: nsLayoutUtils::IsProperAncestorFrameConsideringContinuations( aLimitAncestor, asrFrame.mFrame), at layout/base/DisplayPortUtils.cpp:1273
#01: mozilla::DisplayPortUtils::ActivateDisplayportOnASRAncestors(nsIFrame*, nsIFrame*, mozilla::ActiveScrolledRoot const*, mozilla::nsDisplayListBuilder*)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc122d58]
#02: nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc36ce24]
#03: nsContainerFrame::BuildDisplayListForNonBlockChildren(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc36be4c]
#04: nsContainerFrame::BuildDisplayListForInline(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc37f4ec]
#05: nsInlineFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc43a498]
#06: nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc36d318]
#07: DisplayLine(mozilla::nsDisplayListBuilder*, GenericLineListIterator<nsLineLink, false>&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&, bool&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc32b570]
#08: nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc32a46c]
#09: nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc36d274]
#10: DisplayLine(mozilla::nsDisplayListBuilder*, GenericLineListIterator<nsLineLink, false>&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&, bool&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc32b570]
#11: nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc32a46c]
#12: nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc36d274]
#13: nsCanvasFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc32f268]
#14: nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc36d274]
#15: mozilla::ScrollContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc2e277c]
#16: nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc36d274]
#17: mozilla::ViewportFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc30198c]
#18: nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc4082ac]
#19: nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc22e684]
#20: mozilla::PresShell::PaintInternal(nsIFrame*, mozilla::WindowRenderer*, mozilla::PaintInternalFlags)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc152034]
#21: mozilla::PresShell::PaintAndRequestComposite(nsIFrame*, mozilla::WindowRenderer*, mozilla::PaintFlags)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc1516b4]
#22: mozilla::PresShell::PaintSynchronously()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc16b6b0]
#23: nsRefreshDriver::PaintIfNeeded()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0e8224]
#24: nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_14::operator()() const[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc105708]
#25: void nsRefreshDriver::RunRenderingPhaseLegacy<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_14>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTran[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0e7a58]
#26: nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0e4c34]
#27: mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0ef840]
#28: mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0ef724]
#29: mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0ef580]
#30: mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0ef25c]
#31: mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0ed66c]
#32: mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0ecc74]
#33: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0ec16c]
#34: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xc0ebbd8]
#35: mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xab08458]
#36: mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xaef69d4]
#37: mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x260c5b8]
#38: mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x254b878]
#39: mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::__1::unique_ptr<IPC::Message, std::__1::default_delete<IPC::Message>>)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x254a118]
#40: mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x254a56c]
#41: mozilla::ipc::MessageChannel::MessageTask::Run()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x254af88]
#42: mozilla::RunnableTask::Run()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x22a4f64]
#43: mozilla::TaskController::RunTask(mozilla::Task*)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x227cb08]
#44: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x22834dc]
#45: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2280398]
#46: mozilla::TaskController::ProcessPendingMTTask(bool)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2280754]
#47: mozilla::TaskController::TaskController()::$_0::operator()() const[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x22a2960]
#48: mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x22a28cc]
#49: nsThread::ProcessNextEvent(bool, bool*)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x22c514c]
#50: NS_ProcessNextEvent(nsIThread*, bool)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x22ccf60]
#51: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2550978]
#52: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2551638]
#53: MessageLoop::RunInternal()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x240aa0c]
#54: MessageLoop::RunHandler()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x240a954]
#55: MessageLoop::Run()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x240a8d4]
#56: nsBaseAppShell::Run()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xbaeb70c]
#57: nsAppShell::Run()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xbbd38f4]
#58: XRE_RunAppShell()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xd9d081c]
#59: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2551494]
#60: MessageLoop::RunInternal()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x240aa0c]
#61: MessageLoop::RunHandler()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x240a954]
#62: MessageLoop::Run()[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0x240a8d4]
#63: XRE_InitChildProcess(int, char**, XREChildData const*)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xd9cf924]
#64: mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*)[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/XUL +0xd9e3fb0]
#65: main[/Users/tlin/Projects/gecko/obj-firefox/dist/NightlyDebug.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container +0x870]

Comment 1

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Bug 2066154 Part 1 - Minor cleanup in ComputePositionVisibility(). r?#layout

When the containingBlock is a scrolled frame, rootRect is
recomputed, so move GetAllInFlowRectsUnion() to the else branch.

Note that in the else branch, intersectionRoot and
containingBlock are the same, but this patch swaps the arguments of
GetAllInFlowRectsUnion(), indicating that we are computing
containingBlock's rect in the intersectionRoot's coordinate space.

This does not change behavior.

Comment 2

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Bug 2066154 Part 2 - Consider IB-split when computing position-visibility and walking the ASR chain. r?#layout

The DisplayPortUtils.cpp modification is needed to prevent this
assertion [1]:

Assertion failure:
nsLayoutUtils::IsProperAncestorFrameConsideringContinuations(
  aLimitAncestor, asrFrame.mFrame)

Teach
nsLayoutUtils::IsAncestorFrameCrossDocInProcessConsideringContinuations()
the concept of IB-split so that DOMIntersectionObserver [2] works
when calling from ComputePositionVisibility().

[1] https://searchfox.org/firefox-main/rev/935d871d99c5ccb94a8a8b087241d08b4fe1deae/layout/base/DisplayPortUtils.cpp#1272-1273
[2] https://searchfox.org/firefox-main/rev/935d871d99c5ccb94a8a8b087241d08b4fe1deae/dom/base/DOMIntersectionObserver.cpp#817-825

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/f328cdda7bc2
https://hg.mozilla.org/integration/autoland/rev/225691dd43dc
Part 1 - Minor cleanup in ComputePositionVisibility(). r=layout-reviewers,emilio
https://github.com/mozilla-firefox/firefox/commit/d9f248df0752
https://hg.mozilla.org/integration/autoland/rev/71e45e828212
Part 2 - Consider IB-split when computing position-visibility and walking the ASR chain. r=layout-reviewers,emilio

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/225691dd43dc
https://hg.mozilla.org/mozilla-central/rev/71e45e828212

Comment 5

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62400 for changes under testing/web-platform/tests

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot