2070171 - Infinite loop in `position-anchor` layout

Status: VERIFIED FIXED

(Core :: Layout: Positioned, defect, P2)

Description

[Xu Che]

Attachment: about:support.json

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0

Steps to reproduce:

Reproduce:

I captured the stack trace and coredump after I encountered this bug.

I handed the backtrace and core file to my AI agent, they gave me the minimal reproducible example HTML file. I checked and it can reproduce.

1. I'm running latest ArchLinux + Wayland + KDE. See my setup in attached about:support file
2. Create a new profile.
3. Go to about:config and set widget.gtk.overlay-scrollbars.enabled to false.
4. Open the attached HTML file.
5. Infinite loop in content process, eats one full CPU core.
6. Can't gracefully shutdown browser because it's in infinite loop.

GDB backtrace is also attached.

---

BTW:

Seems it's cause by a skipped result write back of the if (currentFallbackIndex) block.

(I need to figure out how to put multiple attachments on Enter Bug page...)

Comment 1

[Xu Che]

Attachment: Browser Backtrace

Comment 2

[Xu Che]

Attachment: min-repro.html

Comment 3

[Timothy Nikkel (:tnikkel)]

https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5266f9b5e4eb940947829038aac3cc4369903094&tochange=d3f9ae3d66a91ce42e0ef18b4c29dbff8feab374

Comment 4

[BugBot [:suhaib / :marco]]

:emilio, since you are the author of the regressor, bug 1897279, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 5

[BMO Github Automation]

Attachment: [mozilla-firefox/firefox] Bug 2070171 - Clear last fallback properly when don't fit after fitting. r=#layout (#362)

Comment 6

[Emilio Cobos Álvarez [:emilio]]

Thanks for the reduced test-case! Curious, did you spot it on the wild? That would help in terms of considering uplifting the fix to beta / release.

Comment 7

[Xu Che]

Yes. I found it when I was using https://chatgpt.com, the page froze when I tried to scroll

Comment 8

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1897279

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c70773c3342a
https://hg.mozilla.org/integration/autoland/rev/5868bfa1a7ba
Clear last fallback properly when don't fit after fitting. r=dshin

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62567 for changes under testing/web-platform/tests

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Please set a severity for this bug.

Comment 12

[Silaghi Andreea]

https://hg.mozilla.org/mozilla-central/rev/5868bfa1a7ba

Comment 13

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2070171 - Clear last fallback properly when don't fit after fitting.

If a fallback used to fit, but after fallback none of the positions fit,
we end up in the base position, but we didn't clear the last index
properly, so the fallback reflow kept triggering.

Move the clear to after the loop, and add a test that repros with or
without overlay scrollbars. Add also the test as a crashtest.

Pull request: https://github.com/mozilla-firefox/firefox/pull/362

Comment 14

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: Causes content process hang in realistic scenarios (chatgpt.com seems to be affected for example).
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: comment 0
• Risk associated with taking this patch: low
• Explanation of risk level: Relatively straight-forward fix.
• String changes made/needed?: none
• Is Android affected?: yes

Comment 15

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 16

[Donal Meehan [:dmeehan]]

Comment on attachment 9640298 [details]
Bug 2070171 - Clear last fallback properly when don't fit after fitting.

It's too late for Fx156 beta, switching the request to release for the planned dot release

Comment 17

[Donal Meehan [:dmeehan]]

Please add an uplift reqeust for ESR153

Comment 18

[Phabricator Automation]

firefox-esr153 Uplift Approval Request

• User impact if declined/Reason for urgency: See above
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: see above
• Risk associated with taking this patch: low
• Explanation of risk level: see above
• String changes made/needed?: none
• Is Android affected?: yes

Comment 19

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2070171 - Clear last fallback properly when don't fit after fitting.

If a fallback used to fit, but after fallback none of the positions fit,
we end up in the base position, but we didn't clear the last index
properly, so the fallback reflow kept triggering.

Move the clear to after the loop, and add a test that repros with or
without overlay scrollbars. Add also the test as a crashtest.

Pull request: https://github.com/mozilla-firefox/firefox/pull/362

Comment 20

[Monica Chiorean]

I was able to reproduce the issue on Ubuntu 24.04 using FF build 155.0.1.
Verified as fixed on Ubuntu 24.04 using FF build 158.0a1 and 157.0b1.

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr153/rev/66d475fc1d7d

Comment 22

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/59dec927d3e8
https://hg.mozilla.org/releases/mozilla-release/rev/0e705ac3b471

Comment 23

[Monica Chiorean]

Issue is fixed as I could not replicate on Ubuntu 24.04 using Firefox build 156.0.1(20260921121718).

Comment 24

[Monica Chiorean]

Verified as fixed on Ubuntu 24.04 using Firefox build 153.4.0esr.