398043 - "ASSERTION: didn't subtract all that we added" with wide div in td

Status: NEW

(Core :: Layout: Tables, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase triggers:

###!!! ASSERTION: didn't subtract all that we added: 'totalSPref == 0 && totalSMin == 0 && totalSNonPctPref == 0 && nonPctCount == 0 && minOutsidePref == 0 && minWithinPref == 0 && (info.prefCoord == 0 || info.prefCoord == nscoord_MAX) && (info.prefPercent == 0.0f || !spanHasNonPct)', file /Users/jruderman/trunk/mozilla/layout/tables/BasicTableLayoutStrategy.cpp, line 531

Comment 1

[Daniel Holbert [:dholbert]]

The issue is an approximation error in converting a large int (less than nscoord_MAX) to a float.

Specifically, it's the "float(info.prefCoord)", at BasicTableLayoutStrategy.cpp line 496:

493 nscoord allocatedPref =
       ...
496   NSToCoordRound(float(info.prefCoord) * coordRatio)

In the testcase, when we compute allocatedPref for the third and final column in the colspan, we have info.prefCoord =  140000040

  (which is (7000000px * 60 + 120 units of spacing) / 3)

When we convert this to a float, this value is approximated as 140000032, which is off by 8.  coordRatio is 1.0 at this point (since we want to allocate all remaining width to the final column), and so allocatedPref = 140000032 * 1.0, which is 8 less than info.prefWidth.

Then, after we subtract allocatedPref from info.prefCoord, we end up info.prefCoord = 8 instead of 0, and we fail the assertion.


I'm not sure what the best way to solve this is... 
Maybe we could add a special case for when coordRatio == 1.0, in which case we set allocatedPref = info.prefCoord?  (and we don't do any float-conversions)  We still could make small float-conversion errors for the first few columns, but the last column would always soak up the difference.  (unless coordRatio wasn't exactly 1.0 for the final column)

Comment 2

[Jesse Ruderman]

Still happens on trunk.

Comment 3

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

(In reply to Jesse Ruderman from comment #2)
> Still happens on trunk.

Comment 4

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals