Open Bug 1513438 Opened 6 years ago Updated 3 years ago

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Extra child frame found in nsVideoFrame. Possibly from stray whitespace around the videocontrols container element.), at nsVideoFrame.cpp:376, with contentEditable and "enableObjectResizing"

Categories

(Core :: Layout, defect, P5)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox65 --- wontfix
firefox66 --- wontfix
firefox67 --- affected
firefox68 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

testcase.html
497 bytes, text/html
Details
Attached file testcase.html —
Reduced with m-c: BuildID=20181211213305 SourceStamp=ac7f3beb633340c6b3fea25059e8b8aa52b5fc8a Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Extra child frame found in nsVideoFrame. Possibly from stray whitespace around the videocontrols container element.), at src/layout/generic/nsVideoFrame.cpp:376 #0 nsVideoFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsVideoFrame.cpp:367:18 #1 nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) src/layout/generic/nsLineLayout.cpp:883:13 #2 nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) src/layout/generic/nsBlockFrame.cpp:4084:15 #3 nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) src/layout/generic/nsBlockFrame.cpp:3887:5 #4 nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3772:9 #5 nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:2791:5 #6 nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) src/layout/generic/nsBlockFrame.cpp:2334:7 #7 nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsBlockFrame.cpp:1207:3 #8 nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&) src/layout/generic/nsBlockReflowContext.cpp:297:11 #9 nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3408:11 #10 nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:2788:5 #11 nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) src/layout/generic/nsBlockFrame.cpp:2334:7 #12 nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsBlockFrame.cpp:1207:3 #13 nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) src/layout/generic/nsContainerFrame.cpp:883:14 #14 nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsCanvasFrame.cpp:731:5 #15 nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) src/layout/generic/nsContainerFrame.cpp:883:14 #16 nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*, bool) src/layout/generic/nsGfxScrollFrame.cpp:573:3 #17 nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) src/layout/generic/nsGfxScrollFrame.cpp:686:3 #18 nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsGfxScrollFrame.cpp:1052:3 #19 nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) src/layout/generic/nsContainerFrame.cpp:922:14 #20 mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/ViewportFrame.cpp:314:7 #21 mozilla::PresShell::DoReflow(nsIFrame*, bool) src/layout/base/PresShell.cpp:8481:11 #22 mozilla::PresShell::ProcessReflowCommands(bool) src/layout/base/PresShell.cpp:8650:24 #23 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4080:11 #24 nsIDocument::FlushPendingNotifications(mozilla::ChangesToFlush) src/dom/base/nsDocument.cpp:7154:12 #25 nsIDocument::FlushPendingNotifications(mozilla::FlushType) src/dom/base/nsDocument.cpp:7096:3 #26 mozilla::dom::Element::GetPrimaryFrame(mozilla::FlushType) src/dom/base/Element.cpp:2125:10 #27 nsGenericHTMLElement::GetOffsetRect(mozilla::gfx::IntRectTyped<mozilla::CSSPixel>&) src/dom/html/nsGenericHTMLElement.cpp:209:21 #28 nsGenericHTMLElement::OffsetWidth() src/dom/html/nsGenericHTMLElement.h:204:5 #29 mozilla::HTMLEditor::GetPositionAndDimensions(mozilla::dom::Element&, int&, int&, int&, int&, int&, int&, int&, int&) src/editor/libeditor/HTMLAnonymousNodeEditor.cpp:526:23 #30 mozilla::HTMLEditor::ShowResizersInternal(mozilla::dom::Element&) src/editor/libeditor/HTMLEditorObjectResizer.cpp:353:19 #31 mozilla::HTMLEditor::RefereshEditingUI() src/editor/libeditor/HTMLAnonymousNodeEditor.cpp:436:21 #32 mozilla::HTMLEditor::NotifySelectionChanged(nsIDocument*, mozilla::dom::Selection*, short) src/editor/libeditor/HTMLEditor.cpp:411:32 #33 mozilla::dom::Selection::NotifySelectionListeners() src/dom/base/Selection.cpp:3232:15 #34 nsFrameSelection::NotifySelectionListeners(mozilla::SelectionType) src/layout/generic/nsFrameSelection.cpp:1898:23 #35 mozilla::dom::Selection::EndBatchChanges(short) src/dom/base/Selection.cpp:3247:21 #36 mozilla::dom::SelectionBatcher::~SelectionBatcher() src/obj-firefox/dist/include/mozilla/dom/Selection.h:750:19 #37 mozilla::dom::Selection::SelectAllChildren(nsINode&, mozilla::ErrorResult&) src/dom/base/Selection.cpp:2767:1 #38 mozilla::HTMLEditor::SelectAllInternal() src/editor/libeditor/HTMLEditor.cpp:3686:22 #39 mozilla::EditorBase::SelectAll() src/editor/libeditor/EditorBase.cpp:956:17 #40 mozilla::SelectAllCommand::DoCommand(char const*, nsISupports*) src/editor/libeditor/EditorCommands.cpp:811:22 #41 nsControllerCommandTable::DoCommand(char const*, nsISupports*) src/dom/commandhandler/nsControllerCommandTable.cpp:140:26 #42 nsBaseCommandController::DoCommand(char const*) src/dom/commandhandler/nsBaseCommandController.cpp:123:25 #43 nsCommandManager::DoCommand(char const*, nsICommandParams*, mozIDOMWindowProxy*) src/dom/commandhandler/nsCommandManager.cpp:199:22 #44 nsHTMLDocument::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) src/dom/html/nsHTMLDocument.cpp:2813:18 #45 mozilla::dom::HTMLDocument_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, nsHTMLDocument*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:619:21 #46 bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3064:13 #47 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:443:13 #48 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:535:12 #49 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:590:10 #50 Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3320:16 #51 js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:423:10 #52 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:563:13 #53 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:590:10 #54 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:606:8 #55 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2649:10 #56 mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventListenerBinding.cpp:52:8 #57 void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12 #58 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1040:43 #59 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1239:17 #60 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:346:17 #61 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:548:16 #62 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1038:11 #63 nsContentUtils::MaybeFireNodeRemoved(nsINode*, nsINode*) src/dom/base/nsContentUtils.cpp:4394:5 #64 nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:2092:7 #65 mozilla::dom::Node_Binding::appendChild(JSContext*, JS::Handle<JSObject*>, nsINode*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/NodeBinding.cpp:1018:45 #66 bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3064:13 #67 CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:443:13 #68 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:535:12 #69 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:590:10 #70 Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3320:16 #71 js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:423:10 #72 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:563:13 #73 InternalCall(JSContext*, js::AnyInvokeArgs const&) src/js/src/vm/Interpreter.cpp:590:10 #74 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:606:8 #75 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2649:10 #76 mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:265:37 #77 void mozilla::dom::EventHandlerNonNull::Call<nsISupports*>(nsISupports* const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:363:12 #78 mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:205:12 #79 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1044:51 #80 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1239:17 #81 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:346:17 #82 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:548:16 #83 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1038:11 #84 (anonymous namespace)::AsyncTimeEventRunner::Run() src/dom/smil/nsSMILTimedElement.cpp:96:12 #85 mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:299:32 #86 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1157:14 #87 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:468:10 #88 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21 #89 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:314:10 #90 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:289:3 #91 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27 #92 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:915:20 #93 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9 #94 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:314:10 #95 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:289:3 #96 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:753:34 #97 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:49:28 #98 main src/browser/app/nsBrowserApp.cpp:265:18 #99 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 #100 _start (firefox+0x349f4)
Flags: in-testsuite?
<video contenteditable>... interesting... It's probably not something can happen in the wild, and the assertion itself is debug only and seems to be pretty harmless in general even if broken (unexpected rendering may happen but... if no one actually does this, who cares?)
Priority: -- → P5

This is hit frequently while fuzzing and impacts fuzzing performance. If this is not a valid or useful assertion can it potentially be downgraded to a warning?

status-firefox65: affected → wontfix
status-firefox66: affected → wontfix
status-firefox67: --- → affected
status-firefox68: --- → affected
Flags: needinfo?(xidorn+moz)

I think so, but I'd pass the question to the author and reviewer of this code.

Flags: needinfo?(timdream)
Flags: needinfo?(dholbert)
Flags: needinfo?(xidorn+moz)

This can be addressed by inspecting the frame tree to find out what’s being generated, and accordingly, find the appropriate layout code to not to generate the child frame.

Flags: needinfo?(timdream)

When we trip the MOZ_ASSERT_UNREACHABLE, the frame tree for the <video> looks like this (and the unexpected child that triggers the assertion is the first Placeholder(span):

              HTMLVideo(video)(4)@7ff0c119b3c8 parent=7ff0c119aae0 {14820,0,18000,9000} vis-overflow=-60,-60,18120,9120 scr-overflow=0,0,18000,9000 [state=004b404000001231] [content=7ff0bfcd3000] [cs=7ff0c11d8c48]<
                ImageFrame(img)(-1)@7ff0c119b470 parent=7ff0c119b3c8 next=7ff0c119b568 {0,0,0,0} vis-overflow=0,0,1440,1440 [state=0009400000000208] [content=7ff0bfb76fc0] [cs=7ff0c11d8d38]
                Block(div)(-1)@7ff0c119b568 parent=7ff0c119b3c8 next=7ff0c119b620 {0,0,18000,9000} [state=0009002800100208] [content=7ff0c03a5430] [cs=7ff0c11d84c8]<
                >
                HTMLScroll(div)(0)@7ff0c119b620 parent=7ff0c119b3c8 next=7ff0c1f6da28 {0,0,18000,9000} [state=008b020800000000] [content=7ff0c03649d0] [cs=7ff0c11d7898]<
                  Block(div)(0)@7ff0c119b860 parent=7ff0c119b620 {0,0,18000,9000} [state=020b000008d00220] [content=7ff0c03649d0] [cs=7ff0c11d85b8:-moz-scrolled-content]<
                    line 7ff0c119bac0: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x8] {0,0,18000,9000} <
                      Block(div)(3)@7ff0c119b918 parent=7ff0c119b860 {0,0,18000,9000} [state=000b022008100220] [content=7ff0c0364b80] [cs=7ff0c11d7c58]<
                        line 7ff0c119ba70: count=1 state=block,clean,prevmarginclean,not impacted,not wrapped,before:nobr,after:nobr[0x8] {0,0,18000,9000} <
                          FlexContainer(div)(1)@7ff0c119b9d0 parent=7ff0c119b918 {0,0,18000,9000} [state=0009022000900220] [content=7ff0c0364c10] [cs=7ff0c11d7d48]<>
                        >
                      >
                    >
                  >
                >
                Placeholder(span)(-1)@7ff0c1f6da28 parent=7ff0c119b3c8 next=7ff0c1f6d8f8 {0,0,0,0} [state=0001000000200402] [content=7ff0c11c7a60] [cs=7ff0c11fa2f8:-moz-oof-placeholder] outOfFlowFrame=Block(span)(-1)@7ff0c1f6d970
                Placeholder(span)(-1)@7ff0c1f6d8f8 parent=7ff0c119b3c8 next=7ff0c1f6d7c8 {0,0,0,0} [state=0001000000200402] [content=7ff0c11c78b0] [cs=7ff0c11fa2f8:-moz-oof-placeholder] outOfFlowFrame=Block(span)(-1)@7ff0c1f6d840
                Placeholder(span)(-1)@7ff0c1f6d7c8 parent=7ff0c119b3c8 next=7ff0c1f6d698 {0,0,0,0} [state=0001000000200402] [content=7ff0c11c7820] [cs=7ff0c11fa2f8:-moz-oof-placeholder] outOfFlowFrame=Block(span)(-1)@7ff0c1f6d710
                Placeholder(span)(-1)@7ff0c1f6d698 parent=7ff0c119b3c8 next=7ff0c1f6d568 {0,0,0,0} [state=0001000000200402] [content=7ff0c11c7790] [cs=7ff0c11fa2f8:-moz-oof-placeholder] outOfFlowFrame=Block(span)(-1)@7ff0c1f6d5e0
                Placeholder(span)(-1)@7ff0c1f6d568 parent=7ff0c119b3c8 next=7ff0c1f6d438 {0,0,0,0} [state=0001000000200402] [content=7ff0c11c7670] [cs=7ff0c11fa2f8:-moz-oof-placeholder] outOfFlowFrame=Block(span)(-1)@7ff0c1f6d4b0
                Placeholder(span)(-1)@7ff0c1f6d438 parent=7ff0c119b3c8 next=7ff0c1f6d308 {0,0,0,0} [state=0001000000200402] [content=7ff0c11c74c0] [cs=7ff0c11fa2f8:-moz-oof-placeholder] outOfFlowFrame=Block(span)(-1)@7ff0c1f6d380
                Placeholder(span)(-1)@7ff0c1f6d308 parent=7ff0c119b3c8 next=7ff0c1f6d1d8 {0,0,0,0} [state=0001000000200402] [content=7ff0c11c7040] [cs=7ff0c11fa2f8:-moz-oof-placeholder] outOfFlowFrame=Block(span)(-1)@7ff0c1f6d250
                Placeholder(span)(-1)@7ff0c1f6d1d8 parent=7ff0c119b3c8 {0,0,0,0} [state=0001000000200402] [content=7ff0c11b6e50] [cs=7ff0c11fa2f8:-moz-oof-placeholder] outOfFlowFrame=Block(span)(-1)@7ff0c119abe8
              >
            >
          >
        >
      >
    >
    AbsoluteList 7ff0bfb879a0 <
      Block(span)(-1)@7ff0c119abe8 parent=7ff0c119a0b8 next=7ff0c1f6d250 {0,0,0,0} [state=0000002000d00702] [content=7ff0c11b6e50] [cs=7ff0c11fa208]<
      >
      Block(span)(-1)@7ff0c1f6d250 parent=7ff0c119a0b8 next=7ff0c1f6d380 {0,0,0,0} [state=0000002000d00702] [content=7ff0c11c7040] [cs=7ff0c11d76b8]<
      >
      Block(span)(-1)@7ff0c1f6d380 parent=7ff0c119a0b8 next=7ff0c1f6d4b0 {0,0,0,0} [state=0000002000d00702] [content=7ff0c11c74c0] [cs=7ff0c11d77a8]<
      >
      Block(span)(-1)@7ff0c1f6d4b0 parent=7ff0c119a0b8 next=7ff0c1f6d5e0 {0,0,0,0} [state=0000002000d00702] [content=7ff0c11c7670] [cs=7ff0c11d7988]<
      >
      Block(span)(-1)@7ff0c1f6d5e0 parent=7ff0c119a0b8 next=7ff0c1f6d710 {0,0,0,0} [state=0000002000d00702] [content=7ff0c11c7790] [cs=7ff0c11d8018]<
      >
      Block(span)(-1)@7ff0c1f6d710 parent=7ff0c119a0b8 next=7ff0c1f6d840 {0,0,0,0} [state=0000002000d00702] [content=7ff0c11c7820] [cs=7ff0c11d83d8]<
      >
      Block(span)(-1)@7ff0c1f6d840 parent=7ff0c119a0b8 next=7ff0c1f6d970 {0,0,0,0} [state=0000002000d00702] [content=7ff0c11c78b0] [cs=7ff0c11d8f18]<
      >
      Block(span)(-1)@7ff0c1f6d970 parent=7ff0c119a0b8 {0,0,0,0} [state=0000002000d00702] [content=7ff0c11c7a60] [cs=7ff0c11fa028]<
      >
    >
  >

I am guessing the problematic abspos span boxes are resizer handles from enableObjectResizing in the testcase.

It seems we disabled those resizers for images and tables in bug 1449564. Seems like perhaps we should do it for video as well?

Summary: Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Extra child frame found in nsVideoFrame. Possibly from stray whitespace around the videocontrols container element.), at src/layout/generic/nsVideoFrame.cpp:376 → Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Extra child frame found in nsVideoFrame. Possibly from stray whitespace around the videocontrols container element.), at nsVideoFrame.cpp:376, with contentEditable and "enableObjectResizing"

masayuki, do you know how/where these resizer <span> elements get generated, and how best to prevent them from being added as a child of a <video> element? (Can/should we disable them entirely for this case, given that video element is a container frame that only expects a few specific children and no others?)

In the meantime, I think we can increase fuzzer quality-of-life (and reflect reality) by reducing the severity of this assertion -- I'll spin off a helper for that.

Flags: needinfo?(dholbert)
Flags: needinfo?(masayuki)
See Also: → 1546499

First of all, I should explain the background. Our editor may create anonymous children for some specific editing ability. There are 3 case:

  1. resizers to resize object like <img>.
  2. buttons to add/remove table row/column to edit structure of <table>.
  3. grabber to move absolute positioned element.

Currently, those UIs have not been implemented by modern browsers except Gecko. And those UIs are now hidden by default (bug 1449564).

However, for backward compatibility, there are prefs to show these UIs by default by users, and also there are commands forcibly to enable them by web apps. Therefore, these UIs are still alive in the web. (Actually these UIs are still used intentionally according to telemetry.) Additionally, these UIs are available by default on Thunderbird's email composer. So, making resizers for <video> completely disabled might break some user experience.

So, personally, I'd like to recommend that such assertion should ignore frames which are created for native anonymous nodes like scrollbars.

Flags: needinfo?(masayuki)
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: