828641 - Assertion failure: mElements.Contains(cur), at layout/style/nsCSSRuleProcessor.cpp:3382

Status: NEW

(Core :: CSS Parsing and Computation, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

Load http://www.onextrapixel.com/2009/05/05/how-to-create-a-simple-print-css-for-your-site/
and enter to print preview 

#0  0x00000034bb2ba6cd in nanosleep () from /lib64/libc.so.6
#1  0x00000034bb2ba571 in sleep () from /lib64/libc.so.6
#2  0x00007f9dff67924d in ah_crap_handler (signum=11) at /home/smaug/mozilla/hg/m-c/toolkit/xre/nsSigHandlers.cpp:88
#3  0x00007f9dff683042 in nsProfileLock::FatalSignalHandler (signo=11, info=0x7fff6fc96630, context=0x7fff6fc96500)
    at /home/smaug/mozilla/hg/m-c/ff_build/toolkit/profile/nsProfileLock.cpp:190
#4  <signal handler called>
#5  0x00007f9dffca61e3 in AncestorFilter::AssertHasAllAncestors (this=0x7fff6fc98c28, aElement=0x7f9de7dc3f80)
    at /home/smaug/mozilla/hg/m-c/layout/style/nsCSSRuleProcessor.cpp:3382
#6  0x00007f9dffc9f3c9 in RuleHash::EnumerateAllRules (this=0x7f9dcedfc400, aElement=0x7f9de7dc3f80, aData=0x7fff6fc96da0, aNodeContext=...)
    at /home/smaug/mozilla/hg/m-c/layout/style/nsCSSRuleProcessor.cpp:763
#7  0x00007f9dffca36b6 in nsCSSRuleProcessor::RulesMatching (this=0x7f9dd9f6fac0, aData=0x7fff6fc96da0)
    at /home/smaug/mozilla/hg/m-c/layout/style/nsCSSRuleProcessor.cpp:2348
#8  0x00007f9dffd3bc47 in EnumRulesMatching<ElementRuleProcessorData> (aProcessor=0x7f9dd9f6fac0, aData=0x7fff6fc96da0)
    at /home/smaug/mozilla/hg/m-c/layout/style/nsStyleSet.cpp:626
#9  0x00007f9dffd37e9c in nsStyleSet::FileRules (this=0x7f9dcde837c0, aCollectorFunc=
    0x7f9dffd3bc11 <EnumRulesMatching<ElementRuleProcessorData>(nsIStyleRuleProcessor*, void*)>, aData=0x7fff6fc96da0, aElement=0x7f9de7dc3f80, 
    aRuleWalker=0x7fff6fc96dd0) at /home/smaug/mozilla/hg/m-c/layout/style/nsStyleSet.cpp:927
#10 0x00007f9dffd38da3 in nsStyleSet::ResolveStyleFor (this=0x7f9dcde837c0, aElement=0x7f9de7dc3f80, aParentContext=0x0, aTreeMatchContext=...)
    at /home/smaug/mozilla/hg/m-c/layout/style/nsStyleSet.cpp:1147
#11 0x00007f9dffadcf26 in nsFrameManager::ReResolveStyleContext (this=0x7f9de6079000, aPresContext=0x7f9de6074c00, aFrame=0x7f9de3cfd0a0, 
    aParentContent=0x7f9dceea4c10, aChangeList=0x7fff6fc98d00, aMinChange=(nsChangeHint_RepaintFrame | nsChangeHint_SyncFrameView), 
    aParentFrameHintsNotHandledForDescendants=
    (nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_UpdateEffects | nsChangeHint_UpdateOpacityLayer | nsChangeHint_UpdateTransformLayer | nsChangeHint_UpdateOverflow | nsChangeHint_ChildrenOnlyTransform | nsChangeHint_RecomputePosition | nsChangeHint_AddOrRemoveTransform | nsChangeHint_BorderStyleNoneChange), aRestyleHint=eRestyle_Subtree, aRestyleTracker=..., aDesiredA11yNotifications=
    nsFrameManager::eSendAllNotifications, aVisibleKidsOfHiddenElement=..., aTreeMatchContext=...)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsFrameManager.cpp:1274
#12 0x00007f9dffadde30 in nsFrameManager::ReResolveStyleContext (this=0x7f9de6079000, aPresContext=0x7f9de6074c00, aFrame=0x7f9de3cfd020, 
    aParentContent=0x7f9dceea4c10, aChangeList=0x7fff6fc98d00, aMinChange=
    (nsChangeHint_RepaintFrame | nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_ClearDescendantIntrinsics | nsChangeHint_NeedDirtyReflow | nsChangeHint_SyncFrameView), aParentFrameHintsNotHandledForDescendants=(unknown: 0), aRestyleHint=eRestyle_Subtree, 
    aRestyleTracker=..., aDesiredA11yNotifications=nsFrameManager::eSendAllNotifications, aVisibleKidsOfHiddenElement=..., aTreeMatchContext=...)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsFrameManager.cpp:1581
#13 0x00007f9dffaddf42 in nsFrameManager::ReResolveStyleContext (this=0x7f9de6079000, aPresContext=0x7f9de6074c00, aFrame=0x7f9de5a9af40, 
---Type <return> to continue, or q <return> to quit---
    aParentContent=0x7f9dceea4c10, aChangeList=0x7fff6fc98d00, aMinChange=
    (nsChangeHint_RepaintFrame | nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_ClearDescendantIntrinsics | nsChangeHint_NeedDirtyReflow | nsChangeHint_SyncFrameView), aParentFrameHintsNotHandledForDescendants=(unknown: 0), aRestyleHint=eRestyle_Subtree, 
    aRestyleTracker=..., aDesiredA11yNotifications=nsFrameManager::eSendAllNotifications, aVisibleKidsOfHiddenElement=..., aTreeMatchContext=...)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsFrameManager.cpp:1604
#14 0x00007f9dffaddf42 in nsFrameManager::ReResolveStyleContext (this=0x7f9de6079000, aPresContext=0x7f9de6074c00, aFrame=0x7f9de5a9aec0, 
    aParentContent=0x7f9dceea4c10, aChangeList=0x7fff6fc98d00, aMinChange=
    (nsChangeHint_RepaintFrame | nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_ClearDescendantIntrinsics | nsChangeHint_NeedDirtyReflow | nsChangeHint_SyncFrameView), aParentFrameHintsNotHandledForDescendants=(unknown: 0), aRestyleHint=eRestyle_Subtree, 
    aRestyleTracker=..., aDesiredA11yNotifications=nsFrameManager::eSendAllNotifications, aVisibleKidsOfHiddenElement=..., aTreeMatchContext=...)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsFrameManager.cpp:1604
#15 0x00007f9dffaddf42 in nsFrameManager::ReResolveStyleContext (this=0x7f9de6079000, aPresContext=0x7f9de6074c00, aFrame=0x7f9de96296c8, 
    aParentContent=0x7f9dceea4c10, aChangeList=0x7fff6fc98d00, aMinChange=
    (nsChangeHint_RepaintFrame | nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_ClearDescendantIntrinsics | nsChangeHint_NeedDirtyReflow | nsChangeHint_SyncFrameView), aParentFrameHintsNotHandledForDescendants=(unknown: 0), aRestyleHint=eRestyle_Subtree, 
    aRestyleTracker=..., aDesiredA11yNotifications=nsFrameManager::eSendAllNotifications, aVisibleKidsOfHiddenElement=..., aTreeMatchContext=...)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsFrameManager.cpp:1604
#16 0x00007f9dffaddf42 in nsFrameManager::ReResolveStyleContext (this=0x7f9de6079000, aPresContext=0x7f9de6074c00, aFrame=0x7f9de9629ae8, 
    aParentContent=0x0, aChangeList=0x7fff6fc98d00, aMinChange=
    (nsChangeHint_RepaintFrame | nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_ClearDescendantIntrinsics | nsChangeHint_NeedDirtyReflow | nsChangeHint_SyncFrameView), aParentFrameHintsNotHandledForDescendants=(unknown: 0), aRestyleHint=eRestyle_Subtree, 
    aRestyleTracker=..., aDesiredA11yNotifications=nsFrameManager::eSendAllNotifications, aVisibleKidsOfHiddenElement=..., aTreeMatchContext=...)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsFrameManager.cpp:1604
#17 0x00007f9dffaddf42 in nsFrameManager::ReResolveStyleContext (this=0x7f9de6079000, aPresContext=0x7f9de6074c00, aFrame=0x7f9de9629420, 
    aParentContent=0x0, aChangeList=0x7fff6fc98d00, aMinChange=
    (nsChangeHint_RepaintFrame | nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_ClearDescendantIntrinsics | nsChangeHint_NeedDirtyReflow | nsChangeHint_SyncFrameView), aParentFrameHintsNotHandledForDescendants=(unknown: 0), aRestyleHint=eRestyle_Subtree, 
    aRestyleTracker=..., aDesiredA11yNotifications=nsFrameManager::eSendAllNotifications, aVisibleKidsOfHiddenElement=..., aTreeMatchContext=...)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsFrameManager.cpp:1604
#18 0x00007f9dffade3e8 in nsFrameManager::ComputeStyleChangeFor (this=0x7f9de6079000, aFrame=0x7f9de9629420, aChangeList=0x7fff6fc98d00, aMinChange=
    (nsChangeHint_RepaintFrame | nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_ClearDescendantIntrinsics | nsChangeHint_NeedDirtyReflow | nsChangeHint_SyncFrameView), aRestyleTracker=..., aRestyleDescendants=true)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsFrameManager.cpp:1697
#19 0x00007f9dffa76f2a in nsCSSFrameConstructor::DoRebuildAllStyleData (this=0x7f9de6079000, aRestyleTracker=..., aExtraHint=
---Type <return> to continue, or q <return> to quit---
    (nsChangeHint_RepaintFrame | nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_ClearDescendantIntrinsics | nsChangeHint_NeedDirtyReflow | nsChangeHint_SyncFrameView)) at /home/smaug/mozilla/hg/m-c/layout/base/nsCSSFrameConstructor.cpp:12075
#20 0x00007f9dffa76e3b in nsCSSFrameConstructor::RebuildAllStyleData (this=0x7f9de6079000, aExtraHint=
    (nsChangeHint_RepaintFrame | nsChangeHint_NeedReflow | nsChangeHint_ClearAncestorIntrinsics | nsChangeHint_ClearDescendantIntrinsics | nsChangeHint_NeedDirtyReflow | nsChangeHint_SyncFrameView)) at /home/smaug/mozilla/hg/m-c/layout/base/nsCSSFrameConstructor.cpp:12041
#21 0x00007f9dffa7718b in nsCSSFrameConstructor::ProcessPendingRestyles (this=0x7f9de6079000)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsCSSFrameConstructor.cpp:12140
#22 0x00007f9dffb14806 in PresShell::FlushPendingNotifications (this=0x7f9de5f7e200, aFlush=...)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsPresShell.cpp:3867
#23 0x00007f9dffb1439e in PresShell::FlushPendingNotifications (this=0x7f9de5f7e200, aType=Flush_Layout)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsPresShell.cpp:3756
#24 0x00007f9dffb142c5 in PresShell::HandlePostedReflowCallbacks (this=0x7f9de5f7e200, aInterruptible=false)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsPresShell.cpp:3725
#25 0x00007f9dffb20649 in PresShell::DidDoReflow (this=0x7f9de5f7e200, aInterruptible=false)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsPresShell.cpp:7422
#26 0x00007f9dffb21722 in PresShell::ProcessReflowCommands (this=0x7f9de5f7e200, aInterruptible=false)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsPresShell.cpp:7720
#27 0x00007f9dffb14991 in PresShell::FlushPendingNotifications (this=0x7f9de5f7e200, aFlush=...)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsPresShell.cpp:3906
#28 0x00007f9dffb1439e in PresShell::FlushPendingNotifications (this=0x7f9de5f7e200, aType=Flush_Layout)
    at /home/smaug/mozilla/hg/m-c/layout/base/nsPresShell.cpp:3756
#29 0x00007f9e00753518 in nsPrintEngine::ReflowPrintObject (this=0x7f9dd0562af0, aPO=0x7f9dcd6787c0)
    at /home/smaug/mozilla/hg/m-c/layout/printing/nsPrintEngine.cpp:2269
#30 0x00007f9e00751a17 in nsPrintEngine::ReflowDocList (this=0x7f9dd0562af0, aPO=0x7f9dcd6787c0, aSetPixelScale=false)
    at /home/smaug/mozilla/hg/m-c/layout/printing/nsPrintEngine.cpp:1870
#31 0x00007f9e00751cbb in nsPrintEngine::InitPrintDocConstruction (this=0x7f9dd0562af0, aHandleError=false)
    at /home/smaug/mozilla/hg/m-c/layout/printing/nsPrintEngine.cpp:1898
#32 0x00007f9e0074d6ff in nsPrintEngine::DoCommonPrint (this=0x7f9dd0562af0, aIsPrintPreview=true, aPrintSettings=0x7f9dcea3e010, 
    aWebProgressListener=0x7f9de2070e88, aDoc=0x7f9dda56f238) at /home/smaug/mozilla/hg/m-c/layout/printing/nsPrintEngine.cpp:718
#33 0x00007f9e0074bfce in nsPrintEngine::CommonPrint (this=0x7f9dd0562af0, aIsPrintPreview=true, aPrintSettings=0x7f9dcea3e010, aWebProgressListener=
    0x7f9de2070e88, aDoc=0x7f9dda56f238) at /home/smaug/mozilla/hg/m-c/layout/printing/nsPrintEngine.cpp:416
#34 0x00007f9e0074daac in nsPrintEngine::PrintPreview (this=0x7f9dd0562af0, aPrintSettings=0x7f9dcea3e010, aChildDOMWin=0x7f9de491a800, 
    aWebProgressListener=0x7f9de2070e88) at /home/smaug/mozilla/hg/m-c/layout/printing/nsPrintEngine.cpp:778

Comment 1

[Boris Zbarsky [:bzbarsky]]

Is this a regression from bug 508725?  That changed ancestor filter bits....

Comment 2

[Boris Zbarsky [:bzbarsky]]

Or is this older?

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

If this isn't anything obvious, I can try to find the regression range tomorrow.
(I happened to get the crash when testing some other patch)

Comment 4

[Boris Zbarsky [:bzbarsky]]

It's not obvious based on the stack; this should not be happening.

Let me look in a debugger.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Oh, print preview.  So can't test it on Mac.  :(  I'll take a look on Linux, but not till much later tonight.

Comment 6

[Boris Zbarsky [:bzbarsky]]

OK, I can reproduce on Linux.  At the point when we assert, mElements contains 5 copies of the <html>.  cur, on the other hand, is a <div>.  Its parent, grandparent, and grand-grandparent are also <div>s, then <body> and <html>.

So we're in a style reresolve here.  It looks like the frame we're dealing with is a block frame for a HTMLSpanElement.  The parent of this frame is an nsCanvasFrame, so this is presumably a fixed-pos <span>.  And aFrame->GetStyleDisplay()->mPosition is NS_STYLE_POSITION_FIXED, fine.

This looks like a replicated fixed frame or something: the parent of the placeholder is _also_ the canvas.

The ancestor filter setup for these is in fact broken: I had relied on the frame tree being a strict superset of the content tree in ReResolveStyleContext's setup of the ancestor filter, but for replicated fixed-pos frames this is blatantly false.  I guess that instead of asserting mElements.Contains(cur) we could deoptimize instead if not and just match as if nothing were filtered out.  But would this still be a problem for scoped stylesheets?  Cameron?

Note that this was not introduced in the scoped stylesheet patch.

Comment 7

[Cameron McCormack (:heycam)]

(In reply to Boris Zbarsky (:bz) from comment #6)
> But would this still be a problem for scoped stylesheets?  Cameron?

Would this mean that we wouldn't be calling mTreeMatchContext.PushStyleScope() from inside TreeMatchContext::AutoAncestorPusher, because we would no longer push these ancestors when we detect this kind of frame tree?  TreeMatchContext::mStyleScopes needs to be filled in properly for the scoped style stuff to function correctly.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Yeah, it would.  In fact, we're not calling it right now in this situation...  So scoped stylesheets might not work quite right on fixed-pos elements in print preview on the second and later page at the moment.

Sounds like we should really fix this.  The question is whether to fix it by changing ReResolveStyleContext or by adding more stuff to the frame tree for replicated fixed-pos frames.  Or perhaps by doing fixed-pos in printing via a mechanism other than replicating frames...

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

We could potentially do a trick with display lists to replicate the rendering of fixed-pos frames across pages. However, when pages have different sizes the fixed-pos content would benefit from being reflowed independently for each page.