Open Bug 1668039 Opened 4 years ago Updated 2 years ago

Assertion failure: !mFirstMap, at /builds/worker/checkouts/gecko/layout/tables/nsCellMap.cpp:263

Categories

(Core :: Layout: Tables, defect)

defect

Tracking

()

Tracking Status
firefox-esr91 --- affected
firefox83 --- wontfix
firefox95 --- wontfix
firefox96 --- wontfix
firefox97 --- wontfix
firefox99 --- wontfix
firefox100 --- affected
firefox101 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file, 1 obsolete file)

Attached file testcase.zip (obsolete) (deleted) —

Testcase found while fuzzing mozilla-central rev 5f3283738794 (built with --enable-debug).

Assertion failure: !mFirstMap, at /builds/worker/checkouts/gecko/layout/tables/nsCellMap.cpp:263

    #0 0x7f2377b9d6ba in nsTableCellMap::Synchronize(nsTableFrame*) /builds/worker/checkouts/gecko/layout/tables/nsCellMap.cpp:263:5
    #1 0x7f2377bba91f in nsTableFrame::DoRemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*) /builds/worker/checkouts/gecko/layout/tables/nsTableFrame.cpp:2498:16
    #2 0x7f2377bbab7e in nsTableFrame::RemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*) /builds/worker/checkouts/gecko/layout/tables/nsTableFrame.cpp:2524:13
    #3 0x7f2377967713 in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7583:5
    #4 0x7f237795f92c in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8567:7
    #5 0x7f23779681f4 in nsCSSFrameConstructor::MaybeRecreateContainerForFrameRemoval(nsIFrame*) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp
    #6 0x7f237795f8cc in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8556:16
    #7 0x7f23779681f4 in nsCSSFrameConstructor::MaybeRecreateContainerForFrameRemoval(nsIFrame*) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp
    #8 0x7f237795f8cc in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8556:16
    #9 0x7f237792ce64 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1481:25
    #10 0x7f23779339ab in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3034:9
    #11 0x7f237790ded0 in ProcessPendingRestyles /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3113:3
    #12 0x7f237790ded0 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4197:39
    #13 0x7f23778d9e37 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2116:22
    #14 0x7f23778e1301 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:373:13
    #15 0x7f23778e1301 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:352:7
    #16 0x7f23778e11ec in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:5
    #17 0x7f23778e69f8 in RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:825:5
    #18 0x7f23778e69f8 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:743:16
    #19 0x7f23778e62f1 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:645:7
    #20 0x7f23778df55d in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:538:20
    #21 0x7f2373152403 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:244:16
    #22 0x7f237312dd44 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:514:26
    #23 0x7f237312cdf4 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:373:15
    #24 0x7f237312cf83 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:170:36
    #25 0x7f2373157556 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:84:37
    #26 0x7f2373157556 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #27 0x7f23731414a7 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1234:14
    #28 0x7f2373146cba in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #29 0x7f2373a3c396 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #30 0x7f23739af063 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #31 0x7f23739aef7d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #32 0x7f23739aef7d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #33 0x7f237763a2b8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #34 0x7f2378e23be3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #35 0x7f2373a3d159 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #36 0x7f23739af063 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #37 0x7f23739aef7d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #38 0x7f23739aef7d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #39 0x7f2378e237c8 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #40 0x55f20fa43917 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #41 0x55f20fa43917 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:304:18
    #42 0x7f238e978b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
Flags: in-testsuite?

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20200929094055-661294ad7357
mozilla-central 20200929094055-661294ad7357
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
Whiteboard: [bugmon:confirm] → [bugmon:confirmed]
Attached file testcase.html (deleted) —
Attachment #9178487 - Attachment is obsolete: true
Keywords: bugmon
Whiteboard: [bugmon:confirmed]

Bugmon Analysis
Unable to reproduce bug 1668039 using build mozilla-central 20210420095122-a916ade0ae29. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: