Closed Bug 956046 Opened 6 years ago Closed 6 years ago

"Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)", with 'order' set on the element between two anonymous flex items

Categories

(Core :: Layout, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla29

People

(Reporter: cbook, Assigned: dholbert)

References

(Blocks 1 open bug, )

Details

(Keywords: assertion, testcase)

Attachments

(4 files)

Attached file bughunter mac stack
found via bughunter loading http://fr.liberty-tree.net/forum/la-machine-caf/quiz-travers-san-andreas-vice-city-et-liberty-city?page=5#new with a windows 7 trunk debug build (according to bughunter this is on all platforms and branches).

Loading this site (if not crash on load just shift-reload the page) it crashes with Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen))

Will try to generate a local testcase, also marking as security bug, but feel free to open
I can reproduce on 64-bit linux trunk.

Probably not a security bug -- this is just a correctness assertion -- but I'll dig in a bit more before unhiding.
Hardware: x86 → All
Keywords: testcase
Summary: Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)) → Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)) with 'order' and abspos ::before and ::after in a flex container
Summary: Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)) with 'order' and abspos ::before and ::after in a flex container → "Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)", with 'order' and abspos ::before and ::after in a flex container
Here's a simpler testcase.

Basically, if we have two anonymous flex items separated by a flex item that gets sorted out from between them (due to "order), then it busts the assertion about no-consecutive-anonymous-flex-items.

Which maybe means the assertion is just invalid in cases where we're reordering items due to "order"...
(In any case, this isn't security-sensitive.)
Group: core-security
Summary: "Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)", with 'order' and abspos ::before and ::after in a flex container → "Assertion failure: !prevChildWasAnonFlexItem (two anon flex items in a row (shouldn't happen)", with 'order' set on the element between two anonymous flex items
Assignee: nobody → dholbert
Status: NEW → ASSIGNED
Per end of comment 3, this assertion (which checks that we don't have any anonymous flex item adjacent to another anonymous flex item) isn't valid if we've reordered our (non-anonymous) children with "order".

This patch neuters the assertion in that case. Reftest (based on "testcase 2" here) included.
Attachment #8355339 - Flags: review?(dbaron)
Comment on attachment 8355339 [details] [diff] [review]
fix v1: neuter assertion when children have been reordered

r=dbaron
Attachment #8355339 - Flags: review?(dbaron) → review+
https://hg.mozilla.org/mozilla-central/rev/8342bfb3ef52
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
You need to log in before you can comment on or make changes to this bug.