1614101 - heap-use-after-free in [@ nsFrameSelection::cycleCollection::TraverseNative]

Comment 1

•

5 years ago

Huh, this looks like a nsFrameSelection which was not disconnected from its presshell before it went away.

I wonder if this is a recent-ish regression...

Is there a pernosco trace for this? Otherwise I can try to repro on monday or so.

Flags: needinfo?(emilio)

Updated

•

5 years ago

Flags: needinfo?(emilio)

Comment 2

•

5 years ago

Ah, I think we're not doing pernosco for sec bugs yet... Anyhow I'll poke.

Flags: needinfo?(emilio)

Tyson Smith [:tsmith]

Reporter

Comment 3

•

5 years ago

Yeah sorry no Pernosco sessions yet, the process is moving forward though :)

Andrew McCreight [:mccr8]

Comment 4

•

5 years ago

This seems like a fragmentation bug. On a debug build I hit:

[rr 133587 263194]Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Frame property OverflowProperty should never be destroyed by the FrameProperties class), at /home/emilio/src/moz/gecko/layout/generic/nsContainerFrame.h:444

From a stack like:

#15 0x00007f70a5b89762 in nsContainerFrame::AssertOnDestroyingPropertyOverflowProperty(nsFrameList*) () at /home/emilio/src/moz/gecko/layout/generic/nsContainerFrame.h:444
#16 mozilla::FramePropertyDescriptor<nsFrameList>::Destruct<&nsContainerFrame::AssertOnDestroyingPropertyOverflowProperty>(void*) (aPropertyValue=<optimized out>) at /home/emilio/src/moz/gecko/layout/base/FrameProperties.h:91
#17 0x00007f709f9a5e44 in mozilla::FrameProperties::PropertyValue::DestroyValueFor(nsIFrame const*) (this=0x606000284078, aFrame=<optimized out>) at /home/emilio/src/moz/gecko/layout/base/FrameProperties.h:336
#18 mozilla::FrameProperties::SetInternal(mozilla::FramePropertyDescriptorUntyped const*, void*, nsIFrame const*)::{lambda(mozilla::FrameProperties::PropertyValue&)#1}::operator()(mozilla::FrameProperties::PropertyValue&) const
    (this=0x7ffdfc7c9930, aPV=...) at /home/emilio/src/moz/gecko/layout/base/FrameProperties.h:394
#19 nsTArray_Impl<mozilla::FrameProperties::PropertyValue, nsTArrayInfallibleAllocator>::InvokeWithIndexAndOrReferenceHelper<mozilla::FrameProperties::PropertyValue, mozilla::FrameProperties::PropertyValue&, void>::Invoke<mozilla::FrameProperties::SetInternal(mozilla::FramePropertyDescriptorUntyped const*, void*, nsIFrame const*)::{lambda(mozilla::FrameProperties::PropertyValue&)#1}>(mozilla::FrameProperties::SetInternal(mozilla::FramePropertyDescriptorUntyped const*, void*, nsIFrame const*)::{lambda(mozilla::FrameProperties::PropertyValue&)#1}&&, unsigned long, mozilla::FrameProperties::PropertyValue&) (f=..., e=...) at /home/emilio/src/moz/gecko/obj-asan-debug/dist/include/nsTArray.h:1920
#20 0x00007f70a5b3e144 in mozilla::FrameProperties::SetInternal(mozilla::FramePropertyDescriptorUntyped const*, void*, nsIFrame const*) (this=<optimized out>, aProperty=<optimized out>, aValue=<optimized out>, aFrame=0x6250004b8798)
    at /home/emilio/src/moz/gecko/layout/base/FrameProperties.h:391
#21 mozilla::FrameProperties::Set<nsFrameList>(mozilla::FramePropertyDescriptor<nsFrameList> const*, mozilla::detail::FramePropertyTypeHelper<nsFrameList>::Type, nsIFrame const*)
    (this=<optimized out>, aProperty=<optimized out>, aValue=<optimized out>, aFrame=0x6250004b8798) at /home/emilio/src/moz/gecko/layout/base/FrameProperties.h:160
#22 nsIFrame::SetProperty<nsFrameList>(mozilla::FramePropertyDescriptor<nsFrameList> const*, mozilla::detail::FramePropertyTypeHelper<nsFrameList>::Type) (this=0x6250004b8798, aProperty=<optimized out>, aValue=<optimized out>)
    at /home/emilio/src/moz/gecko/layout/generic/nsIFrame.h:3671
#23 nsContainerFrame::SetOverflowFrames(nsFrameList const&) (this=<optimized out>, aOverflowFrames=...) at /home/emilio/src/moz/gecko/layout/generic/nsContainerFrame.cpp:1405
#24 0x00007f70a5b4f3f3 in nsContainerFrame::PushChildrenToOverflow(nsIFrame*, nsIFrame*) (this=<optimized out>, aFromChild=<optimized out>, aPrevSibling=<optimized out>)
    at /home/emilio/src/moz/gecko/layout/generic/nsContainerFrame.cpp:1438
#25 0x00007f70a5d01a4e in nsInlineFrame::PushFrames(nsPresContext*, nsIFrame*, nsIFrame*, nsInlineFrame::InlineReflowInput&) (this=0x2, aPresContext=<optimized out>, aFromChild=0x7ffdfc7c7170, aPrevSibling=0xcf, aState=...)
    at /home/emilio/src/moz/gecko/layout/generic/nsInlineFrame.cpp:787
#26 0x00007f70a5d00f18 in nsInlineFrame::ReflowInlineFrame(nsPresContext*, mozilla::ReflowInput const&, nsInlineFrame::InlineReflowInput&, nsIFrame*, nsReflowStatus&)
    (this=<optimized out>, aPresContext=<optimized out>, aReflowInput=..., irs=..., aFrame=<optimized out>, aStatus=...) at /home/emilio/src/moz/gecko/layout/generic/nsInlineFrame.cpp:716
#27 0x00007f70a5cffc31 in nsInlineFrame::ReflowFrames(nsPresContext*, mozilla::ReflowInput const&, nsInlineFrame::InlineReflowInput&, mozilla::ReflowOutput&, nsReflowStatus&)
    (this=<optimized out>, aPresContext=<optimized out>, aReflowInput=..., irs=..., aMetrics=..., aStatus=...) at /home/emilio/src/moz/gecko/layout/generic/nsInlineFrame.cpp:582
#28 0x00007f70a5cfe401 in nsInlineFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x6250004b8798, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)
    at /home/emilio/src/moz/gecko/layout/generic/nsInlineFrame.cpp:363
#29 0x00007f70a5d806b4 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&)
    (this=<optimized out>, aFrame=0x6250004b8798, aReflowStatus=..., aMetrics=<optimized out>, aPushedFrame=@0x7ffdfc7ca670: false) at /home/emilio/src/moz/gecko/layout/generic/nsLineLayout.cpp:878
#30 0x00007f70a5b081f1 in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*)
    (this=<optimized out>, aState=..., aLineLayout=..., aLine=..., aFrame=0x2, aLineReflowStatus=<optimized out>) at /home/emilio/src/moz/gecko/layout/generic/nsBlockFrame.cpp:4478
#31 0x00007f70a5b06959 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool)
    (this=<optimized out>, aState=..., aLineLayout=..., aLine=..., aFloatAvailableSpace=..., aAvailableSpaceBSize=<optimized out>, aFloatStateBeforeLine=<optimized out>, aKeepReflowGoing=<optimized out>, aLineReflowStatus=<optimized out>, aAllowPullUp=<optimized out>) at /home/emilio/src/moz/gecko/layout/generic/nsBlockFrame.cpp:4280
#32 0x00007f70a5afd113 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=<optimized out>)
    at /home/emilio/src/moz/gecko/layout/generic/nsBlockFrame.cpp:4165
#33 0x00007f70a5af34da in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) (this=<optimized out>, aState=..., aLine=..., aKeepReflowGoing=<optimized out>)
    at /home/emilio/src/moz/gecko/layout/generic/nsBlockFrame.cpp:3146
#34 0x00007f70a5ae7502 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) (this=<optimized out>, aState=...) at /home/emilio/src/moz/gecko/layout/generic/nsBlockFrame.cpp:2686
#35 0x00007f70a5ade118 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) (this=0x6250004b8688, aPresContext=<optimized out>, aMetrics=..., aReflowInput=..., aStatus=...)

The existing overflow list has a (mozilla::ColumnSetWrapperFrame *) and co, but also a nsTextControlFrame*:

(rr) p $6
$17 = (nsFrameList *) 0x625000503540
(rr) p $6[0]
$18 = {mFirstChild = 0x625000503478, mLastChild = 0x625000502b98}
(rr) p $6[0].mFirstChild
$19 = (mozilla::ColumnSetWrapperFrame *) 0x625000503478
(rr) p $6[0].mFirstChild->DumpFrameTreeLimited()
ColumnSetWrapper(q)(1)@625000503478 parent=6250004b8798 next=6250004b8ec0 prev-in-flow=6250004b8998 (0,0,0,0) wm=sw-lr-ltr logical-size=(0 x 0) [state=0000060000c00606] [content=60d00005add0] [cs=61100020f488]<
>
$20 = void
(rr) p $6[0].mFirstChild->mNextSibling
$21 = (nsTextFrame *) 0x6250004b8ec0
(rr) p $6[0].mFirstChild->mNextSibling->DumpFrameTreeLimited()
Text(2)"\n"@6250004b8ec0 parent=6250004b8798 next=6250004b8f60 (12295,0,305,1140) [state=40010000a0000000] [content=60c0002a1a80] [cs=61100020fc08:-moz-text] [run=60c0002a4900][0,1,T] 
$22 = void
(rr) p $6[0].mFirstChild->mNextSibling->mNextSibling
$23 = (nsTextControlFrame *) 0x6250004b8f60
(rr) p $6[0].mFirstChild->mNextSibling->mNextSibling->DumpFrameTreeLimited()
nsTextControlFrame@6250004b8f60 parent=6250004b8798 next=625000502b98 (12600,-1560,9640,2640) [state=0002000000004210] [content=6120000a6e40] [cs=61100020f988]<
  HTMLScroll(div)(-1)@6250004b9050 parent=6250004b8f60 (60,60,9520,2520) [state=008b000000084008] [content=60d00005b2b0] [cs=6110001ee508]<
    ScrollbarFrame(scrollbar)(-1)@6250004b92a0 parent=6250004b9050 next=6250004b9588 (0,2520,9520,0) [state=000b000080c84008] [content=60d00005b380] [cs=6110001ee648]<
      SliderFrame(slider)(-1)@6250004b93b0 parent=6250004b92a0 (0,0,9520,0) [state=000b000080c04008] [content=60d00005bba0] [cs=61100022fb48]<
        ButtonBoxFrame(thumb)(0)@6250004b94b0 parent=6250004b93b0 (0,0,2760,0) [state=0009000080404000] [content=60d00005bc70] [cs=61100022fc88]<>
      >
    >
    ScrollbarFrame(scrollbar)(-1)@6250004b9588 parent=6250004b9050 next=625000502920 (9520,0,0,2520) [state=000b000080884008] [content=60d00005b450] [cs=6110001ee788]<
      SliderFrame(slider)(-1)@6250004b9698 parent=6250004b9588 (0,0,0,2520) vis-overflow=(0,0,0,0) scr-overflow=(0,0,0,2760) [state=000b000080804008] [content=60d00005c490] [cs=61100020e308]<
        ButtonBoxFrame(thumb)(0)@6250004b9798 parent=6250004b9698 (0,0,0,2760) [state=0009000080004000] [content=60d00005c560] [cs=61100020e448]<>
      >
    >
    Box(resizer)(-1)@625000502920 parent=6250004b9050 next=625000502a10 (8620,1620,900,900) [state=0009000080c04008] [content=60d00005b520] [cs=6110001ee8c8]<>
    Box(scrollcorner)(-1)@625000502a10 parent=6250004b9050 next=625000502ad8 (9520,2520,0,0) [state=0009000080c04208] [content=60d00005b5f0] [cs=61100022f788]<>
    Block(div)(-1)@625000502ad8 parent=6250004b9050 (0,0,9520,2520) [state=0009000000d04200] [content=60d00005b2b0] [cs=611000240808:-moz-scrolled-content]<
      line 625000502f60: count=1 state=inline,clean,prevmarginclean,not-impacted,not-wrapped,before:nobr,after:linebr[0x80100] (60,0,1,900) <
        Frame(br)(0)@625000502ee8 parent=625000502ad8 (60,0,1,900) [state=0000000000004000] [content=60d0000667e0] [cs=611000240d08]
      >
    >
  >
>
$24 = void
(rr) p $6[0].mFirstChild->mNextSibling->mNextSibling->mNextSibling
$25 = (nsTextFrame *) 0x625000502b98
(rr) p $6[0].mFirstChild->mNextSibling->mNextSibling->mNextSibling->DumpFrameTreeLimited
$26 = {void (const nsIFrame * const)} 0x7f70a5c01b40 <nsIFrame::DumpFrameTreeLimited() const>
(rr) p $6[0].mFirstChild->mNextSibling->mNextSibling->mNextSibling->DumpFrameTreeLimited()
Text(4)"\n"@625000502b98 parent=6250004b8798 (22240,0,0,1140) [state=40010000a0400000] [content=60c0002a1cc0] [cs=61100020fc08:-moz-text] [run=60c0002a49c0][0,1,T] 
$27 = void

Presumably leaking the nsTextControlFrame means it never gets destroyed and its TextControlState keeps a reference to an nsFrameSelection that points to a dead pres shell.

CC'ing some folks that may know more about inline layou and multicol.

Sean Voisen (:svoisen)

Updated

•

5 years ago

Priority: -- → P1

Updated

•

5 years ago

Keywords: sec-high

Sean Voisen (:svoisen)

Comment 5

•

5 years ago

I asked Mats to take a look at this.

@Ting-Yu: Would you mind keeping this on your radar if Mats has any actionable updates?

Flags: needinfo?(mats)

Flags: needinfo?(aethanyc)

Tyson Smith [:tsmith]

Reporter

Comment 6

•

5 years ago

A Pernosco session is available here: https://pernos.co/debug/6Mx6sVwZ-_lm0zjbpSRH-g/index.html

Mats Palmgren (inactive)

Comment 7

•

5 years ago

Attached file Testcase that crashes consistently on load (no prefs needed) — Details

Mats Palmgren (inactive)

Comment 8

•

5 years ago

(it crashes consistently in an ASAN or DEBUG build to be clear)

Mats Palmgren (inactive)

Comment 9

•

5 years ago

The root of the problem appears to be this code:
https://searchfox.org/mozilla-central/rev/174f1195ec740e8f17223b48018f7e14e6d4e40e/layout/generic/nsColumnSetFrame.cpp#865-888
which eventually leads to creating a ColumnSetWrapperFrame next-in-flow.
That seems wrong to me because the columnset in this case is an inline-block which are supposed to be atomic and thus never have any continuations in an unconstrained reflow.
I can't say that I understand how this code is supposed to work these days though.

Flags: needinfo?(mats)

Julien Cristau [:jcristau] (back 2025-01-09)

Updated

•

5 years ago

status-firefox75: --- → affected

status-firefox-esr68: --- → ?

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Assignee

Comment 10

•

5 years ago

(In reply to Mats Palmgren (:mats) from comment #9)

The root of the problem appears to be this code:
https://searchfox.org/mozilla-central/rev/174f1195ec740e8f17223b48018f7e14e6d4e40e/layout/generic/nsColumnSetFrame.cpp#865-888
which eventually leads to creating a ColumnSetWrapperFrame next-in-flow.
That seems wrong to me because the columnset in this case is an inline-block which are supposed to be atomic and thus never have any continuations in an unconstrained reflow.

If I understand how inline-blocks are made atomic correctly, we unconditionally set available block-size to NS_UNCONSTRAINEDSIZE [1] when a block is reflowing under an inline frame. However, when reflowing nsColumnSetFrame, we apply the columnized inline-block's block-size as the available block-size constraint in [2], and we didn't aware that the inline-block should be atomic.

I think the root cause is bug 534182. That is, we don't handle continuations in nsLineLayout very well (because we pass NS_UNCONSTRAINEDSIZE and assume the children should be fully complete.)

I think it should be reasonable to only apply [2] when ColumnSetWrapperFrame is not reflowed under nsLineLayout by checking whether ReflowInput::mLineLayout is nullptr or not.

[1] https://searchfox.org/mozilla-central/rev/df94cd5ba431234bc220ac081def0801fe44b89e/layout/generic/nsLineLayout.cpp#818
[2] https://searchfox.org/mozilla-central/rev/df94cd5ba431234bc220ac081def0801fe44b89e/layout/generic/nsBlockFrame.cpp#3717-3749
[3] https://searchfox.org/mozilla-central/rev/df94cd5ba431234bc220ac081def0801fe44b89e/layout/generic/ReflowInput.h#416

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Assignee

Comment 11

•

5 years ago

Attached file Bug 1614101 - Make sure ColumnSet does not split in the last reflow if ColumnSetWrapper's available block-size is unconstrained. — Details

Because nsLineLayout::ReflowFrame() unconditionally sets its children's
available block-size to NS_UNCONSTRAINEDSIZE. ColumnSetWrapper should
respect that by not applying ColumnSetWrapper's block-size to
ColumnSet's available block-size when ColumnSetWrapper is reflowing
under nsLineLayout.

Phabricator Automation

Updated

•

5 years ago

Assignee: nobody → aethanyc

Status: NEW → ASSIGNED

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Assignee

Comment 12

•

5 years ago

Attached file Bug 1614101 - Add a crashtest. r?dbaron — Details

Depends on D63385

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Assignee

Updated

•

5 years ago

Flags: needinfo?(aethanyc)

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Comment 13

•

5 years ago

Thanks Ting-Yu!

Flags: needinfo?(emilio)

Phabricator Automation

Updated

•

5 years ago

Attachment #9127675 - Attachment description: Bug 1614101 - Avoid fragmenting inline-block multi-column containers. r?dbaron → Bug 1614101 - Make sure ColumnSet does not split in the last reflow if ColumnSetWrapper's available block-size is unconstrained.

Assignee

Comment 14

•

5 years ago

I use mozregression to track down the regression. This was regressed by bug 1603088. (I'm not sure we want to set "Regressed by" field in a sec-high bug, so I'll leave blank for now).

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Assignee

Comment 15

•

5 years ago

Comment on attachment 9127675 [details]
Bug 1614101 - Make sure ColumnSet does not split in the last reflow if ColumnSetWrapper's available block-size is unconstrained.

Security Approval Request

How easily could an exploit be constructed based on the patch?: It's hard to deduce a test case from the patch. It requires the page to use balancing inline-block multicol layout with very small height/width (and probably with other conditions). This is unlikely to be used by any reasonable pages.
Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
Which older supported branches are affected by this flaw?: Firefox 74
If not all supported branches, which bug introduced the flaw?: Bug 1603088
Do you have backports for the affected branches?: No
If not, how different, hard to create, and risky will they be?: The patch can be applied cleanly on Firefox 74 (currently the beta branch).
How likely is this patch to cause regressions; how much testing does it need?: It corrects one condition that can make multicol layout being fragmenting less, which is less error-prone. (Fragmenting layout frames tends to introduce more bugs ...)

Attachment #9127675 - Flags: sec-approval?

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Assignee

Updated

•

5 years ago

Attachment #9127676 - Flags: sec-approval?

Julien Cristau [:jcristau] (back 2025-01-09)

Updated

•

5 years ago

status-firefox73: --- → unaffected

status-firefox-esr68: ? → unaffected

Keywords: regression

Regressed by: 1603088

BMO Automation

Updated

•

5 years ago

Has Regression Range: --- → yes

Updated

•

5 years ago

status-firefox74: affected → wontfix

Comment 16

•

5 years ago

Comment on attachment 9127675 [details]
Bug 1614101 - Make sure ColumnSet does not split in the last reflow if ColumnSetWrapper's available block-size is unconstrained.

Please land and request uplift to mozilla-release for 74 RC2, thanks!

Attachment #9127675 - Flags: sec-approval? → sec-approval+

Updated

•

5 years ago

Attachment #9127676 - Flags: sec-approval? → sec-approval+

Updated

•

5 years ago

status-firefox74: wontfix → affected

Updated

•

5 years ago

Flags: needinfo?(aethanyc)

https://hg.mozilla.org/integration/autoland/rev/5ecd70faa23fbf5e7fe4e4b1168a62f9a068acd6

Comment 17

•

5 years ago

tracking-firefox74: --- → +

tracking-firefox75: --- → +

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 18

•

5 years ago

Backed out for crashtest failures on 1015844.html:

https://hg.mozilla.org/integration/autoland/rev/4f86599abde019a3ca9235509143f8aab716e7b1

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=autoland&group_state=expanded&resultStatus=usercancel%2Ctestfailed%2Cbusted%2Cexception&revision=5ecd70faa23fbf5e7fe4e4b1168a62f9a068acd6
Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=291669173&repo=autoland
layout/generic/crashtests/1015844.html | assertion count 48 is more than expected 21 assertions

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Assignee

Comment 19

•

5 years ago

Comment on attachment 9127675 [details]
Bug 1614101 - Make sure ColumnSet does not split in the last reflow if ColumnSetWrapper's available block-size is unconstrained.

Beta/Release Uplift Approval Request

User impact if declined: See my security approval request in Comment 15.
Is this code covered by automated tests?: Yes
Has the fix been verified in Nightly?: No
Needs manual test from QE?: No
If yes, steps to reproduce:
List of other uplifts needed: None
Risk to taking this patch: Low
Why is the change risky/not risky? (and alternatives if risky): It corrects one condition that can make multicol layout being fragmenting less, which is less error-prone.
String changes made/needed: None

Flags: needinfo?(aethanyc)

Attachment #9127675 - Flags: approval-mozilla-beta?

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Assignee

Updated

•

5 years ago

Attachment #9127676 - Flags: approval-mozilla-beta?

Ting-Yu Lin [:TYLin] (PST, UTC-8) (Out of office Dec 21 - Dec 29)

Assignee

Comment 20

•

5 years ago

I update my patch to bump the assertion count for 1015844.html on Android. The crashtest involves multicol, and the assertion count was adjusted in bug 1603088. It is likely that my patch, which changes the behavior of multicol balancing, can make an impact on that again.

Comment 21

•

5 years ago

Yeah, the logcat just shows a bunch more instances of the already-occurring "Available block-size should be constrained because it's restricted..." assertion.

https://hg.mozilla.org/integration/autoland/rev/25126aa01673794de76a9562501a5b7cdbdfa409
https://hg.mozilla.org/integration/autoland/rev/b6affc2813062a8e5a227a3ecf679e13c0c7a853

Comment 22

•

5 years ago

Flags: in-testsuite? → in-testsuite+

Updated

•

5 years ago

Blocks: 1610411

Comment 23

•

5 years ago

Comment on attachment 9127675 [details]
Bug 1614101 - Make sure ColumnSet does not split in the last reflow if ColumnSetWrapper's available block-size is unconstrained.

Approved for 74.0 RC2.

Attachment #9127675 - Flags: approval-mozilla-beta? → approval-mozilla-release+

Updated

•

5 years ago

Attachment #9127676 - Flags: approval-mozilla-beta? → approval-mozilla-release+

https://hg.mozilla.org/releases/mozilla-release/rev/47bc0dc40c85
https://hg.mozilla.org/releases/mozilla-release/rev/f1df9c949f8b

Comment 24

•

5 years ago

uplift

status-firefox74: affected → fixed