The default bug view has changed. See this FAQ.

"ABORT: comparing iterators over different lists" with -moz-column, rtl, background image

RESOLVED FIXED in mozilla7



8 years ago
6 years ago


(Reporter: Jesse Ruderman, Assigned: bz)


(Blocks: 2 bugs, {assertion, testcase})

assertion, testcase
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)



(3 attachments, 1 obsolete attachment)



8 years ago
Created attachment 364640 [details]
testcase (crashes debug Firefox when loaded)

###!!! ABORT: comparing iterators over different lists: 'mListLink == aOther.mListLink', file /Users/jruderman/central/layout/base/../generic/nsLineBox.h, line 684

Comment 1

8 years ago
Created attachment 364641 [details]
stack trace

Comment 2

8 years ago
Still happens on mozilla-central.

Comment 3

6 years ago
Still aborts debug builds.  Seems harmless on opt.

Comment 4

6 years ago
I've seen this on whatwg for linux/mac at

It is not reliable on this particular url, but spidering the anchors will almost always reproduce it.

The page appears to contain each of the elements of Jesse's test case.

The data from crash-stats for this url in April shows the related signatures: (counts are for the last week)

nsBulletFrame::GetListItemText 207 crashes (all Windows)

nsTextFrame::EnsureTextRun 107 crashes (most Windows, some Mac, Linux)

CompositeDataSourceImpl::cycleCollection::UnmarkPurple 3094 crashes (all Windows)
Blocks: 532972
So what happens here is that nsCSSRendering::PaintBackgroundWithSC calls PrepareBackgroundLayer which calls InlineBackgroundData::GetContinuousRect, which calls IsOnSameLine for two frames that are in different columns, which fails the assertion.

Ideally we'd just check whether the two frames are in the same block, but that could be somewhat expensive....  I suppose we could check that just when the frames have different parents or something.
Created attachment 541901 [details] [diff] [review]
Attachment #541901 - Flags: review?(roc)
Created attachment 541902 [details] [diff] [review]
With a comment typo fixed
Attachment #541902 - Flags: review?(roc)
Attachment #541901 - Attachment is obsolete: true
Attachment #541901 - Flags: review?(roc)
Assignee: nobody → bzbarsky
Priority: -- → P2
Whiteboard: [need review]
Comment on attachment 541902 [details] [diff] [review]
With a comment typo fixed

Review of attachment 541902 [details] [diff] [review]:
Attachment #541902 - Flags: review?(roc) → review+
Whiteboard: [need review]
Target Milestone: --- → mozilla7
Flags: in-testsuite+
Interesting effect on m-i. The crashtest.list was

asserts(6) load 479360-1.xhtml # Bug 439258
load 481806-1.html
asserts(6) load 483604-1.xhtml # Bug 439258

and when you inserted another one in between, 483604-1.xhtml stopped getting its expected 6 assertion failures, and 481806-1.html got 6 unexpected ones. Apparently that annotation on 479360-1.xhtml needs to be "asserts(6), forces-asserts-on-not-the-next-but-the-one-after-that(6)".
(In reply to comment #9)

Backed out due to perma-orange on the new test:
Attachment #541902 - Flags: checkin-
OS: Mac OS X → All
Hardware: x86 → All
Target Milestone: mozilla7 → ---
s/perma-orange on the new test/perma-orange because a previous test, the harness, and|or editor is broken/
> Apparently that annotation on 479360-1.xhtml needs to be

I made that into a comment and rejiggered the annotations.  Then pushed this again as
Attachment #541902 - Flags: checkin-
Target Milestone: --- → mozilla7
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.