931464 - "ASSERTION: Unexpected frame types" with fieldset

Status: VERIFIED FIXED

(Core :: Layout, defect, P4)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: Unexpected frame types: '(frame1->GetType() == nsGkAtoms::tableFrame && frame2->GetType() == nsGkAtoms::tableOuterFrame) || (frame1->GetType() == nsGkAtoms::tableOuterFrame && frame2->GetType() == nsGkAtoms::tableFrame) || frame1->GetType() == nsGkAtoms::fieldSetFrame || (frame1->GetParent() && frame1->GetParent()->GetType() == nsGkAtoms::fieldSetFrame)', file layout/base/nsCSSFrameConstructor.cpp, line 7330

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Mats Palmgren (inactive)]

Regression window on m-c:  2013-10-25 -- 2013-10-26
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=186e834d87dc&tochange=ef3f5669b53e
contains bug 261037 which seems the most likely candidate given that the test has
<fieldset style="overflow: auto;">

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: Part 1: GetFieldSetBlockFrame needs to drill down through a scrollframe if necessary

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: Part 2: nsFieldSetFrame::Insert/Append/RemoveFrames should not be called

Comment 5

[Robert O'Callahan (:roc) (email my personal email if necessary)]

https://tbpl.mozilla.org/?tree=Try&rev=9e6da0e32d87

Comment 6

[Mats Palmgren (inactive)]

Comment on attachment 826521 [details] [diff] [review]
Part 2: nsFieldSetFrame::Insert/Append/RemoveFrames should not be called

r=mats

Nit: I would prefer MOZ_ASSERT(false, ...) over NS_ERROR.

Comment 7

[Mats Palmgren (inactive)]

... or MOZ_CRASH even.

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bf7538789583
https://hg.mozilla.org/integration/mozilla-inbound/rev/abda071349c4

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/bf7538789583
https://hg.mozilla.org/mozilla-central/rev/abda071349c4

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 826520 [details] [diff] [review]
Part 1: GetFieldSetBlockFrame needs to drill down through a scrollframe if necessary

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 261037
User impact if declined: Errors dynamically inserting content into a <fieldset>
Testing completed (on m-c, etc.): just landed
Risk to taking this patch (and alternatives if risky): low risk
String or IDL/UUID changes made by this patch: none

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/3ba941e15e5e
https://hg.mozilla.org/releases/mozilla-aurora/rev/eeec8acdb32c

Comment 12

[Catalin Varga [QA][:VarCat]]

I've performed the test from comment 1 on:

Aurora Debug
Build Id: 20140107172206

OS: Os X 10.8.5 , Ubuntu 13.04 x 64

The bug doesn't reproduce anymore.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Backed out from beta (Fx27) due to bug 960277.
https://hg.mozilla.org/releases/mozilla-beta/rev/00b274fbebf3

Comment 14

[Catalin Varga [QA][:VarCat]]

Marking the bug as verified and removing the verify me tag.