878538 - "ASSERTION: Out-of-flow frame got reflowed before its placeholder" with <select>, fixed & abs pos

Status: NEW

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: Out-of-flow frame got reflowed before its placeholder: 'Error', file layout/generic/nsPlaceholderFrame.cpp, line 127

This assertion was added in bug 874418.

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Still reproduces on trunk.

Comment 3

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 4

[ISHIKAWA, Chiaki]

Attachment: stack trace in one of the test in mochitest (full log) of ASAN-build of DEBUG version of C-C TB

I have begun to see this assertion hit during local mochitest of DEBUG version of C-C TB's.
The ilne numbers have changed a bit over the years.

There are about 10 hits as a whole.
I am attaching an excerpt to show one such a case.

This assertion is triggered by
93:42.54 TEST_START: comm/mail/components/extensions/test/browser/browser_ext_commands_onCommand.js

First three lines of stacktrace.

93:53.39 GECKO(588745) [588745, Main Thread] ###!!! ASSERTION: Out-of-flow frame got reflowed before its placeholder: 'Error', file /NEW-SSD/NREF-COMM-CENTRAL/mozilla/layout/generic/nsPlaceholderFrame.cpp:134
93:53.39 GECKO(588745) #01: nsIFrame::BoxReflow(nsBoxLayoutState&, nsPresContext*, mozilla::ReflowOutput&, gfxContext*, int, int, int, int, bool) (/NEW-SSD/NREF-COMM-CENTRAL/mozilla/layout/generic/nsIFrame.cpp:10599)
93:53.40 GECKO(588745) #02: nsIFrame::DoXULLayout(nsBoxLayoutState&) (/NEW-SSD/NREF-COMM-CENTRAL/mozilla/layout/generic/nsIFrame.cpp:10352)
93:53.40 GECKO(588745) #03: nsBoxFrame::LayoutChildAt(nsBoxLayoutState&, nsIFrame*, nsRect const&) (/NEW-SSD/NREF-COMM-CENTRAL/mozilla/layout/xul/nsBoxFrame.cpp:1018)

BTW, I did not see this on a local mochitest job on Sept 8, but I saw it
on Sept 29 and I have seen it constantly until today (Nov 19).

So, considering the slight delay of my update of M-C/C-C tree, I think something changed at the end of August or the beginning of September.

Comment 5

[ISHIKAWA, Chiaki]

My observation is under Debian GNU/Linux, amd64 version.

Comment 6

[David Shin[:dshin]]

No longer seeing this with comment 0's testcase + mozregression --launch 2026-01-20 -B debug, FWIW, but the assertion still certainly happens (See bug 2010760)

Comment 7

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

The assertion happens with https://wpt.live/css/css-break/out-of-flow-in-multicolumn-116.html