688044 - ASSERTION: Why is the root in mDirtyRoots already?

Status: RESOLVED FIXED

Description

[Jared Wein [:jaws] (please needinfo? me)]

With the changes applied from these two patches, this assertion is hit.

To reproduce, apply patch 462117 and then apply patch 666306.

Comment 1

[Jared Wein [:jaws] (please needinfo? me)]

Created attachment 561324 [details] [diff] [review]
462117 (apply first)

Comment 2

[Jared Wein [:jaws] (please needinfo? me)]

Created attachment 561325 [details] [diff] [review]
666306 (apply second)

Comment 3

[Boris Zbarsky [:bz]]

What's the concrete class of the root in this case?

Comment 4

[Mats Palmgren (vacation - back in August)]

Created attachment 561367 [details]
stack

Here's the stack for when the root frame currently in InitialReflow
is added to 'mDirtyRoots'.  (It's a ViewportFrame)

Comment 5

[Mats Palmgren (vacation - back in August)]

http://mxr.mozilla.org/mozilla-central/source/layout/base/nsPresShell.cpp#1951

Maybe InitialReflow should just deal with it?

Comment 6

[Boris Zbarsky [:bz]]

Yeah, seems like it....

Comment 7

[Mats Palmgren (vacation - back in August)]

Maybe we could do the FrameNeedsReflow stuff before the XBL stuff?
Then it wouldn't add the root frame twice because FrameNeedsReflow bails out of the
ancestor loop on the 'wasDirty' test here:
http://mxr.mozilla.org/mozilla-central/source/layout/base/nsPresShell.cpp#2840

Comment 8

[Mats Palmgren (vacation - back in August)]

Actually, that should just work if the following comment is right...

  // Note: Because the frame just got created, it has the NS_FRAME_IS_DIRTY

but it's not (at that point).  The bit is set when the frame is created but it's
then removed somewhere during ProcessAttachedQueue()...

Comment 9

[Mats Palmgren (vacation - back in August)]

Created attachment 561386 [details]
stack

ProcessAttachedQueue runs some script that forces reflow of the root frame.
I'm assuming this is where the bit is removed...

Comment 10

[Mats Palmgren (vacation - back in August)]

Created attachment 561394 [details] [diff] [review]
fix

I think we can just skip the FrameNeedsReflow stuff if the bit was cleared.
Try server results pending...

Comment 11

[Mats Palmgren (vacation - back in August)]

Comment on attachment 561394 [details] [diff] [review]
fix

Green on Try so far; Android still pending (with a long backlog).

Comment 12

[Boris Zbarsky [:bz]]

Hmm.  How did that script manage to force reflow of the root frame if the frame already had the dirty bit but wasn't in the reflow root set?

Comment 13

[Mats Palmgren (vacation - back in August)]

Created attachment 561574 [details]
stack to nsSubDocumentFrame::Reflow

Here's the stack to nsSubDocumentFrame::Reflow that does the
PostReflowCallback which is what the earlier stack is processing
that leads to the subdocument root frame being reflowed.
(the UpdatePositionAndSize ...)

There are no checks of frame bits or mDirtyRoots on the
UpdatePositionAndSize path,  nsViewManager::DoSetWindowDimensions just calls
ResizeReflow directly.
http://mxr.mozilla.org/mozilla-central/source/view/src/nsViewManager.cpp#261

Comment 14

[Boris Zbarsky [:bz]]

Comment on attachment 561394 [details] [diff] [review]
fix

Ah, ok.  This is probably fine, then.

That said, this is a pretty scary change; can you land it after the next aurora branchpoint?

Comment 15

[Mozilla RelEng Bot]

Try run for 2c6e454541bc is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=2c6e454541bc
Results (out of 171 total builds):
    success: 160
    warnings: 7
    failure: 4
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-2c6e454541bc

Comment 16

[Mozilla RelEng Bot]

Try run for f2d288a2639a is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=f2d288a2639a
Results (out of 171 total builds):
    success: 148
    warnings: 23
Builds available at http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-f2d288a2639a

Comment 17

[Mats Palmgren (vacation - back in August)]

Nothing to worry about in the test failures above... the first one is for
the reviewed patch, with only known Orange.  The second is a different patch.

> this is a pretty scary change; can you land it after the next aurora branchpoint?

OK

Comment 18

[Mats Palmgren (vacation - back in August)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2a89973d7656

Comment 19

[Michael Wu [:mwu]]

https://hg.mozilla.org/mozilla-central/rev/2a89973d7656