Closed Bug 688044 Opened 8 years ago Closed 8 years ago

ASSERTION: Why is the root in mDirtyRoots already?

Categories

(Core :: Layout, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla10

People

(Reporter: jaws, Assigned: mats)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(6 files)

With the changes applied from these two patches, this assertion is hit.

To reproduce, apply patch 462117 and then apply patch 666306.
What's the concrete class of the root in this case?
Attached file stack
Here's the stack for when the root frame currently in InitialReflow
is added to 'mDirtyRoots'.  (It's a ViewportFrame)
http://mxr.mozilla.org/mozilla-central/source/layout/base/nsPresShell.cpp#1951

Maybe InitialReflow should just deal with it?
Yeah, seems like it....
Maybe we could do the FrameNeedsReflow stuff before the XBL stuff?
Then it wouldn't add the root frame twice because FrameNeedsReflow bails out of the
ancestor loop on the 'wasDirty' test here:
http://mxr.mozilla.org/mozilla-central/source/layout/base/nsPresShell.cpp#2840
Blocks: 418511, 571959
Keywords: assertion, testcase
Actually, that should just work if the following comment is right...

  // Note: Because the frame just got created, it has the NS_FRAME_IS_DIRTY

but it's not (at that point).  The bit is set when the frame is created but it's
then removed somewhere during ProcessAttachedQueue()...
Attached file stack
ProcessAttachedQueue runs some script that forces reflow of the root frame.
I'm assuming this is where the bit is removed...
Attached patch fixSplinter Review
I think we can just skip the FrameNeedsReflow stuff if the bit was cleared.
Try server results pending...
Comment on attachment 561394 [details] [diff] [review]
fix

Green on Try so far; Android still pending (with a long backlog).
Attachment #561394 - Flags: review?(bzbarsky)
Assignee: nobody → matspal
Hmm.  How did that script manage to force reflow of the root frame if the frame already had the dirty bit but wasn't in the reflow root set?
Here's the stack to nsSubDocumentFrame::Reflow that does the
PostReflowCallback which is what the earlier stack is processing
that leads to the subdocument root frame being reflowed.
(the UpdatePositionAndSize ...)

There are no checks of frame bits or mDirtyRoots on the
UpdatePositionAndSize path,  nsViewManager::DoSetWindowDimensions just calls
ResizeReflow directly.
http://mxr.mozilla.org/mozilla-central/source/view/src/nsViewManager.cpp#261
Comment on attachment 561394 [details] [diff] [review]
fix

Ah, ok.  This is probably fine, then.

That said, this is a pretty scary change; can you land it after the next aurora branchpoint?
Attachment #561394 - Flags: review?(bzbarsky) → review+
Try run for 2c6e454541bc is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=2c6e454541bc
Results (out of 171 total builds):
    success: 160
    warnings: 7
    failure: 4
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/mpalmgren@mozilla.com-2c6e454541bc
Try run for f2d288a2639a is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=f2d288a2639a
Results (out of 171 total builds):
    success: 148
    warnings: 23
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/mpalmgren@mozilla.com-f2d288a2639a
Nothing to worry about in the test failures above... the first one is for
the reviewed patch, with only known Orange.  The second is a different patch.

> this is a pretty scary change; can you land it after the next aurora branchpoint?

OK
https://hg.mozilla.org/integration/mozilla-inbound/rev/2a89973d7656
Whiteboard: [inbound]
Target Milestone: --- → mozilla10
https://hg.mozilla.org/mozilla-central/rev/2a89973d7656
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Whiteboard: [inbound]
You need to log in before you can comment on or make changes to this bug.