956046 - "Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)", with 'order' set on the element between two anonymous flex items

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: bughunter mac stack

found via bughunter loading http://fr.liberty-tree.net/forum/la-machine-caf/quiz-travers-san-andreas-vice-city-et-liberty-city?page=5#new with a windows 7 trunk debug build (according to bughunter this is on all platforms and branches).

Loading this site (if not crash on load just shift-reload the page) it crashes with Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen))

Will try to generate a local testcase, also marking as security bug, but feel free to open

Comment 1

[Daniel Holbert [:dholbert]]

I can reproduce on 64-bit linux trunk.

Probably not a security bug -- this is just a correctness assertion -- but I'll dig in a bit more before unhiding.

Comment 2

[Daniel Holbert [:dholbert]]

Attachment: testcase 1 (aborts debug builds)

Comment 3

[Daniel Holbert [:dholbert]]

Attachment: testcase 2 (aborts debug builds)

Here's a simpler testcase.

Basically, if we have two anonymous flex items separated by a flex item that gets sorted out from between them (due to "order), then it busts the assertion about no-consecutive-anonymous-flex-items.

Which maybe means the assertion is just invalid in cases where we're reordering items due to "order"...

Comment 4

[Daniel Holbert [:dholbert]]

(In any case, this isn't security-sensitive.)

Comment 5

[Daniel Holbert [:dholbert]]

Attachment: fix v1: neuter assertion when children have been reordered

Per end of comment 3, this assertion (which checks that we don't have any anonymous flex item adjacent to another anonymous flex item) isn't valid if we've reordered our (non-anonymous) children with "order".

This patch neuters the assertion in that case. Reftest (based on "testcase 2" here) included.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 8355339 [details] [diff] [review]
fix v1: neuter assertion when children have been reordered

r=dbaron

Comment 9

[Daniel Holbert [:dholbert]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8342bfb3ef52

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/8342bfb3ef52