2075419 - Assertion failure: targetFrame == nullptr && targetLine == nullptr, at checkouts/gecko/layout/generic/nsBlockFrame.h:760

Status: VERIFIED FIXED

(Core :: Layout: Block and Inline, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260905-0742d09fdc84 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: targetFrame == nullptr && targetLine == nullptr, at checkouts/gecko/layout/generic/nsBlockFrame.h:760

#0 0x7fffeb9555ff in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7fffeb9555ff in nsBlockFrame::LineClampTarget::IsFullyClampedOut(nsBlockFrame*, nsBlockFrame*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.h:760:9
#2 0x7fffeb955487 in nsBlockFrame::ApplyLineClamp(nsBlockFrame::LineClampTarget, nsBlockFrame*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2488:24
#3 0x7fffeb9539d1 in ApplySmallestLineClamp /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2545:3
#4 0x7fffeb9539d1 in nsBlockFrame::ComputeFinalSize(mozilla::ReflowInput const&, mozilla::BlockReflowState&, mozilla::ReflowOutput&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2705:34
#5 0x7fffeb94d60b in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2301:7
#6 0x7fffeb94b395 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1798:9
#7 0x7fffeb95fd42 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, mozilla::CollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:294:11
#8 0x7fffeb95b445 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:5014:11
#9 0x7fffeb958713 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4271:5
#10 0x7fffeb950b42 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:3779:29
#11 0x7fffeb94ce10 in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2192:35
#12 0x7fffeb94b395 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1798:9
#13 0x7fffeb8b1811 in MeasureIntrinsicContentSize(gfxContext*, nsIFrame*, mozilla::Maybe<mozilla::LogicalSize> const&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsLayoutUtils.cpp:4715:11
#14 0x7fffeb8b1261 in nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, gfxContext*, nsIFrame*, mozilla::IntrinsicISizeType, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int, int, mozilla::StyleSizeOverrides const&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsLayoutUtils.cpp:4919:23
#15 0x7fffeb8b263c in nsLayoutUtils::IntrinsicForContainer(gfxContext*, nsIFrame*, mozilla::IntrinsicISizeType, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int, mozilla::StyleSizeOverrides const&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsLayoutUtils.cpp:5074:10
#16 0x7fffeb946a36 in nsBlockFrame::MinISize(mozilla::IntrinsicSizeInput const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:888:29
#17 0x7fffeb946464 in operator() /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:838:52
#18 0x7fffeb946464 in GetOrSet<(lambda at ./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:837:59)> /builds/worker/workspace/obj-build/dist/include/mozilla/IntrinsicISizesCache.h:35:13
#19 0x7fffeb946464 in nsBlockFrame::IntrinsicISize(mozilla::IntrinsicSizeInput const&, mozilla::IntrinsicISizeType) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:837:28
#20 0x7fffeb914624 in operator() /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1312:28
#21 0x7fffeb914624 in mozilla::ScrollContainerFrame::IntrinsicISize(mozilla::IntrinsicSizeInput const&, mozilla::IntrinsicISizeType) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1304:20
#22 0x7fffeb98b35d in GetMinISize /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.h:2746:12
#23 0x7fffeb98b35d in ShrinkISizeToFit /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:7616:22
#24 0x7fffeb98b35d in nsIFrame::ComputeAutoSize(mozilla::SizeComputationInput const&, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::StyleSizeOverrides const&, mozilla::EnumSet<mozilla::ComputeSizeFlag, unsigned char>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:7408:25
#25 0x7fffeb9898ca in nsContainerFrame::ComputeAutoSize(mozilla::SizeComputationInput const&, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::StyleSizeOverrides const&, mozilla::EnumSet<mozilla::ComputeSizeFlag, unsigned char>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:652:24
#26 0x7fffeb99a429 in nsIFrame::ComputeSize(mozilla::SizeComputationInput const&, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::StyleSizeOverrides const&, mozilla::EnumSet<mozilla::ComputeSizeFlag, unsigned char>) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsIFrame.cpp:6910:7
#27 0x7fffeb8fdf4d in mozilla::ReflowInput::InitConstraints(nsPresContext*, mozilla::Maybe<mozilla::LogicalSize> const&, mozilla::Maybe<mozilla::LogicalMargin> const&, mozilla::Maybe<mozilla::LogicalMargin> const&, mozilla::LayoutFrameType) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ReflowInput.cpp:2397:27
#28 0x7fffeb8f8f71 in mozilla::ReflowInput::Init(nsPresContext*, mozilla::Maybe<mozilla::LogicalSize> const&, mozilla::Maybe<mozilla::LogicalMargin> const&, mozilla::Maybe<mozilla::LogicalMargin> const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ReflowInput.cpp:525:3
#29 0x7fffeb8fa276 in mozilla::ReflowInput::ReflowInput(nsPresContext*, mozilla::ReflowInput const&, nsIFrame*, mozilla::LogicalSize const&, mozilla::Maybe<mozilla::LogicalSize> const&, mozilla::EnumSet<mozilla::ReflowInput::InitFlag, unsigned char>, mozilla::StyleSizeOverrides const&, mozilla::EnumSet<mozilla::ComputeSizeFlag, unsigned char>, mozilla::AnchorPosResolutionCache*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ReflowInput.cpp:361:5
#30 0x7fffeb95ed9d in nsBlockReflowContext::ComputeCollapsedBStartMargin(mozilla::ReflowInput const&, mozilla::CollapsingMargin*, nsIFrame*, bool*, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:156:25
#31 0x7fffeb95a59d in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4753:11
...

Comment 1

[Tyson Smith [:tsmith]]

This issue has also been detected via live site testing.

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260924164300-39878598097d.
The bug appears to have been introduced in the following build range:

Start: bcbe03ae0007f14660426146ceeb0f4aa0c971d0 (20260904160449)
End: c12eb912e9fe374a38261096acf924c6df47dff2 (20260904143245)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=bcbe03ae0007f14660426146ceeb0f4aa0c971d0&tochange=c12eb912e9fe374a38261096acf924c6df47dff2

Comment 3

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2043002

:salipov, since you are the author of the regressor, bug 2043002, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Seva Alipov]

Attachment: Bug 2075419: Fix assertion failure in line-clamp containers with 0-height non-empty lines. r=#layout

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/41eb98d6e3ad
https://hg.mozilla.org/integration/autoland/rev/8d91754c411c
Fix assertion failure in line-clamp containers with 0-height non-empty lines. r=layout-reviewers,emilio

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/63044 for changes under testing/web-platform/tests

Comment 7

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/8d91754c411c

Comment 8

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.

:salipov, please make an uplift decision for beta:

• For beta, nominate the patch for beta uplift approval if the fix should be included in this release, or set status-firefox158 to wontfix if the fix can wait for the next release.

See Requesting an Uplift for documentation on how to request an uplift.

For more information, please visit BugBot documentation.

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260929042044-12b8a40c6321.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 11

[Seva Alipov]

Not uplifting to beta, as this bug doesn't impact the user (no impact on non-debug builds).