893496 - "Assertion failure: curFlexWeight >= 0.0f (weights are non-negative)"

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Assertion failure: curFlexWeight >= 0.0f (weights are non-negative), at layout/generic/nsFlexContainerFrame.cpp:1361

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Daniel Holbert [:dholbert]]

I can reproduce in my Linux debug build (64-bit).

Comment 3

[Daniel Holbert [:dholbert]]

(I can still reproduce this in trunk debug builds, BTW. Sorry for the non-action here; hoping to look into it soon.)

Comment 4

[Daniel Holbert [:dholbert]]

So what's happening here is:
 - The flex-shrink property value ends up being parsed as (float)infinity.
 - When we use that flex-shrink value, we normalize it by multiplying it by the flex-basis, which is 0.
 - So we end up performing infinity * 0, which produces -nan(0x400000) (according to GDB), which fails our >=0 assertion.

Comment 5

[Daniel Holbert [:dholbert]]

(In reply to Daniel Holbert [:dholbert] from comment #4)
>  - When we use that flex-shrink value, we normalize it by multiplying it by
> the flex-basis, which is 0.

(er, technically I meant to say s/flex-basis/flex base size/ there. They're basically the same thing; the flex base size is really just the resolved version of flex-basis, for cases with e.g. "flex-basis:auto".)

So anyway -- in cases where we'd get infinity * 0 in this particular multiplication, the reasonable thing to do is to return 0 (as opposed to e.g. returning infinity).

That's because the question we're really trying to answer here is "how far is this FlexItem willing to shrink below its flex base size?" -- and the "0" value in the multiplication here actually indicates that we're *already* at 0. We can't shrink beyond that, so we shouldn't volunteer to shrink any further.

Patch coming up to do that.

Comment 6

[Daniel Holbert [:dholbert]]

Attachment: fix v1: return 0 early, for "multiplying by 0" case, to avoid inf*0

Comment 7

[Daniel Holbert [:dholbert]]

If you're curious, the relevant chunk of the spec here is step 5 under:
 http://dev.w3.org/csswg/css-flexbox/#resolve-flexible-lengths
and here's an MXR link to the code, for more context:
 http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsFlexContainerFrame.cpp#327

(The spec text used to use the terms "flex weight" & "scaled flex shrink weight", which is why those terms appear in the code comments. Now the spec uses "flex factor" & "scaled flex shrink factor" instead.)

Comment 8

[Mats Palmgren (inactive)]

Comment on attachment 8355899 [details] [diff] [review]
fix v1: return 0 early, for "multiplying by 0" case, to avoid inf*0

r=mats

Comment 9

[Daniel Holbert [:dholbert]]

https://tbpl.mozilla.org/?tree=Try&rev=387e2dbf898b

Comment 10

[Daniel Holbert [:dholbert]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d1cf3709a1f0

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d1cf3709a1f0