852293 - mozilla::css::OverflowChangedTracker::Flush hits SplayTree assertion

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (takes a few seconds)

Within a few seconds, the testcase usually hits:

Assertion failure: Comparator::compare(*minimum, *node) < 0, at SplayTree.h:263

Why is this non-deterministic?  Can this kind of bug be made deterministic, perhaps by adding more assertions?  (The non-determinism caused me to spend several hours massaging the testcase instead of several minutes simply reducing it.)

Comment 1

[Jesse Ruderman]

Attachment: stack (gdb)

Comment 2

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Might this have started as a result of the patch to bug 849263?  I still think that patch is right, though.

Comment 3

[Matt Woodrow (:mattwoodrow)]

(In reply to David Baron [:dbaron] (don't cc:, use needinfo? instead) from comment #2)
> Might this have started as a result of the patch to bug 849263?  I still
> think that patch is right, though.

I believe so, yes. This appears to be a different symptom of bug 850672.

Thanks for the testcase Jesse!

Comment 4

[Jesse Ruderman]

Makes sense.  The non-determinism might come from [whether and when the presarena reuses a memory address].  This particular SplayTree cares whether frame pointers are reused because its entries are sorted by by depth and then frame pointer.

Comment 5

[Mats Palmgren (inactive)]

WFM in local m-c debug build on Linux64 and OSX.

Comment 7

[Mats Palmgren (inactive)]

Crash test:
https://hg.mozilla.org/integration/mozilla-inbound/rev/62aa2d6dbeb2

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/62aa2d6dbeb2