Open Bug 1189610 Opened 9 years ago Updated 2 years ago

###!!! ASSERTION: must be in an update: 'mUpdateCount != 0' in layout/base/nsPresShell.cpp, line 4523

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox42 --- affected

People

(Reporter: jya, Unassigned)

Details

I see this assertion whenever I start (I have e10s disabled, not sure if that makes a difference)

Showing a few times as it starts or restore the previous session
Can you get a stack to the assertion?
Sure:

not that any lines in nsPressShell.cpp > 4524 must be reduced by 3 as I added the following to get a breakpoint
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index b0aa59d..7077ea9 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -4522,6 +4522,9 @@ PresShell::RecordStyleSheetChange(nsIStyleSheet* aStyleSheet)
   // too bad we can't check that the update is UPDATE_STYLE
   NS_ASSERTION(mUpdateCount != 0, "must be in an update");
 
+  if (mUpdateCount == 0) {
+    int i = 0;
+  }


there is it:
(lldb) bt
* thread #1: tid = 0x7360ba, 0x0000000107f5746f XUL`PresShell::RecordStyleSheetChange(this=0x000000012d90f800, aStyleSheet=0x000000012d981240) + 111 at nsPresShell.cpp:4526, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
  * frame #0: 0x0000000107f5746f XUL`PresShell::RecordStyleSheetChange(this=0x000000012d90f800, aStyleSheet=0x000000012d981240) + 111 at nsPresShell.cpp:4526
    frame #1: 0x0000000107f57601 XUL`PresShell::StyleSheetAdded(this=0x000000012d90f800, aDocument=0x000000012d92b000, aStyleSheet=0x000000012d981240, aDocumentSheet=true) + 161 at nsPresShell.cpp:4552
    frame #2: 0x0000000107f57656 XUL`non-virtual thunk to PresShell::StyleSheetAdded(this=0x000000012d90f950, aDocument=0x000000012d92b000, aStyleSheet=0x000000012d981240, aDocumentSheet=true) + 70 at nsPresShell.cpp:4554
    frame #3: 0x0000000105988c45 XUL`nsDocument::NotifyStyleSheetAdded(this=0x000000012d92b000, aSheet=0x000000012d981240, aDocumentSheet=true) + 197 at nsDocument.cpp:4234
    frame #4: 0x0000000105989420 XUL`nsDocument::AddStyleSheet(this=0x000000012d92b000, aSheet=0x000000012d981240) + 208 at nsDocument.cpp:4268
    frame #5: 0x00000001079222c5 XUL`mozilla::dom::XULDocument::DoneWalking(this=0x000000012d92b000) + 277 at XULDocument.cpp:3020
    frame #6: 0x0000000107922c94 XUL`mozilla::dom::XULDocument::StyleSheetLoaded(this=0x000000012d92b000, aSheet=0x000000012d981c90, aWasAlternate=false, aStatus=NS_OK) + 180 at XULDocument.cpp:3143
    frame #7: 0x0000000107922d04 XUL`non-virtual thunk to mozilla::dom::XULDocument::StyleSheetLoaded(this=0x000000012d92b800, aSheet=0x000000012d981c90, aWasAlternate=false, aStatus=NS_OK) + 68 at XULDocument.cpp:3148
    frame #8: 0x0000000107cc108d XUL`mozilla::css::Loader::SheetComplete(this=0x000000012d929740, aLoadData=0x00000001220c7200, aStatus=NS_OK) + 605 at Loader.cpp:1765
    frame #9: 0x0000000107cc1643 XUL`mozilla::css::Loader::ParseSheet(this=0x000000012d929740, aInput=0x000000012db374f8, aLoadData=0x00000001220c7200, aCompleted=0x00007fff5fbfc777) + 883 at Loader.cpp:1727
    frame #10: 0x0000000107cc0d34 XUL`mozilla::css::SheetLoadData::OnStreamComplete(this=0x00000001220c7200, aLoader=0x000000012db374a0, aContext=0x0000000000000000, aStatus=NS_OK, aBuffer=0x000000012db374f8) + 3796 at Loader.cpp:936
    frame #11: 0x0000000107cc16b5 XUL`non-virtual thunk to mozilla::css::SheetLoadData::OnStreamComplete(this=0x00000001220c7208, aLoader=0x000000012db374a0, aContext=0x0000000000000000, aStatus=NS_OK, aBuffer=0x000000012db374f8) + 69 at Loader.cpp:939
    frame #12: 0x000000010411633b XUL`nsUnicharStreamLoader::OnStopRequest(this=0x000000012db374a0, aRequest=0x0000000122060cc0, aContext=0x0000000000000000, aStatus=NS_OK) + 667 at nsUnicharStreamLoader.cpp:99
    frame #13: 0x000000010405070e XUL`nsBaseChannel::OnStopRequest(this=0x0000000122060c70, request=0x0000000122181200, ctxt=0x0000000000000000, status=NS_OK) + 254 at nsBaseChannel.cpp:801
    frame #14: 0x00000001040507ed XUL`non-virtual thunk to nsBaseChannel::OnStopRequest(this=0x0000000122060cf8, request=0x0000000122181200, ctxt=0x0000000000000000, status=NS_OK) + 61 at nsBaseChannel.cpp:815
    frame #15: 0x00000001040883d3 XUL`nsInputStreamPump::OnStateStop(this=0x0000000122181200) + 1043 at nsInputStreamPump.cpp:717
    frame #16: 0x00000001040873cc XUL`nsInputStreamPump::OnInputStreamReady(this=0x0000000122181200, stream=0x000000012db1fe00) + 444 at nsInputStreamPump.cpp:436
    frame #17: 0x00000001040884df XUL`non-virtual thunk to nsInputStreamPump::OnInputStreamReady(this=0x0000000122181208, stream=0x000000012db1fe00) + 47 at nsInputStreamPump.cpp:498
    frame #18: 0x0000000103ef1110 XUL`nsInputStreamReadyEvent::Run(this=0x000000012dea2540) + 144 at nsStreamUtils.cpp:91
    frame #19: 0x0000000103f21c53 XUL`nsThread::ProcessNextEvent(this=0x0000000100437310, aMayWait=false, aResult=0x00007fff5fbfd023) + 1971 at nsThread.cpp:867
    frame #20: 0x0000000103f945b7 XUL`NS_ProcessPendingEvents(aThread=0x0000000100437310, aTimeout=20) + 151 at nsThreadUtils.cpp:219
    frame #21: 0x0000000107a13786 XUL`nsBaseAppShell::NativeEventCallback(this=0x000000011ec87660) + 198 at nsBaseAppShell.cpp:99
    frame #22: 0x0000000107a899bd XUL`nsAppShell::ProcessGeckoEvents(aInfo=0x000000011ec87660) + 445 at nsAppShell.mm:388
    frame #23: 0x00007fff90920a01 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
    frame #24: 0x00007fff90912b8d CoreFoundation`__CFRunLoopDoSources0 + 269
    frame #25: 0x00007fff909121bf CoreFoundation`__CFRunLoopRun + 927
    frame #26: 0x00007fff90911bd8 CoreFoundation`CFRunLoopRunSpecific + 296
    frame #27: 0x00007fff969cc56f HIToolbox`RunCurrentEventLoopInMode + 235
    frame #28: 0x00007fff969cc2ea HIToolbox`ReceiveNextEventCommon + 431
    frame #29: 0x00007fff969cc12b HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 71
    frame #30: 0x00007fff9756d8ab AppKit`_DPSNextEvent + 978
    frame #31: 0x00007fff9756ce58 AppKit`-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 346
    frame #32: 0x0000000107a88487 XUL`-[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:](self=0x0000000119c44700, _cmd=0x00007fff97e897f8, mask=18446744073709551615, expiration=0x422d63c37f00000d, mode=0x00007fff7d54a040, flag='\x01') + 119 at nsAppShell.mm:122
    frame #33: 0x00007fff97562af3 AppKit`-[NSApplication run] + 594
    frame #34: 0x0000000107a8a3b1 XUL`nsAppShell::Run(this=0x000000011ec87660) + 177 at nsAppShell.mm:663
    frame #35: 0x0000000108ad5211 XUL`nsAppStartup::Run(this=0x000000011d779380) + 161 at nsAppStartup.cpp:280
    frame #36: 0x0000000108ba00cb XUL`XREMain::XRE_mainRun(this=0x00007fff5fbfefa0) + 5963 at nsAppRunner.cpp:4288
    frame #37: 0x0000000108ba09ed XUL`XREMain::XRE_main(this=0x00007fff5fbfefa0, argc=5, argv=0x00007fff5fbff8a0, aAppData=0x00007fff5fbff228) + 989 at nsAppRunner.cpp:4385
    frame #38: 0x0000000108ba0e92 XUL`XRE_main(argc=5, argv=0x00007fff5fbff8a0, aAppData=0x00007fff5fbff228, aFlags=0) + 98 at nsAppRunner.cpp:4474
    frame #39: 0x00000001000029db firefox`do_main(argc=5, argv=0x00007fff5fbff8a0, xreDirectory=0x000000010040e040) + 1819 at nsBrowserApp.cpp:212
    frame #40: 0x0000000100001dbd firefox`main(argc=5, argv=0x00007fff5fbff8a0) + 301 at nsBrowserApp.cpp:399
    frame #41: 0x0000000100001834 firefox`start + 52
(lldb)
Thanks.  For what it's worth, if you run with XPCOM_DEBUG_BREAK=trap then assertions will automatically drop into the debugger.

This is exciting.  Certainly DoneWalking doesn't do an update around AddStyleSheet, and AddStyleSheet starts sending mutation observer notifications without entering an update...

So why doesn't this assert every time?  Because normally at this point the document doesn't have a presshell yet (StartLayout() happens later in DoneWalking), so we never reach the code that's asserting.

It sounds like in your case something forced layout start before we were done loading the chrome stylesheets, which is rather bad performance-wise.  Any extensions involved?
Actually, no, that's not it.  StartLayout hasn't happened, but we do have a presshell (albeit one not doing frame construction).  The real reason this is not asserting for me is that mOverlaySheets is empty so we never reach the AddStyleSheet() call.

What we should probably do is do a style update around that whole loop....
Only the bare minimum on thisrun, it's my development environment: User Agent Switcher 0.7.3.1 and the about:media plugin
Hi,

I also see this during the |make mozmill| test run of FULL DEBUG BUILD of C-C TB.

One type of assertion that bugs me when I check the log of |make
mozmill| of full DEBUG version of C-C TB on my local PC is as follows.

I get 176 assertions of the following type.
(The line number must have changed since last year.)

###!!! ASSERTION: must be in an update: 'mUpdateCount != 0', file /NREF-COMM-CENTRAL/comm-central/mozilla/layout/base/nsPresShell.cpp, line 4408

This is now the second frequent assertions in the log.

The next  most frequent assertions is

###!!! ASSERTION: selection count is wrong: 'selection.Length() == uint32_t(count)', file /NREF-COMM-CENTRAL/comm-central/mailnews/base/src/nsMsgDBView.cpp, line 1279

which happens 37 times.


Back to the assertion:
###!!! ASSERTION: must be in an update: 'mUpdateCount != 0', file /NREF-COMM-CENTRAL/comm-central/mozilla/layout/base/nsPresShell.cpp, line 4408

This has begun to show up since December 2014.

The assertion leaves the stack trace:

The popular cases are of the following type:
This does not look similar to the one in comment 2 at all.

[14521] ###!!! ASSERTION: must be in an update: 'mUpdateCount != 0', file /NREF-COMM-CENTRAL/comm-central/mozilla/layout/base/nsPresShell.cpp, line 4408
#01: mozilla::MediaStreamListener::AddRef() (/NREF-COMM-CENTRAL/comm-central/mozilla/dom/media/MediaStreamGraph.h:105 (discriminator 2))
#02: mozilla::dom::DocumentBinding::elementsFromPoint(JSContext*, JS::Handle<JSObject*>, nsIDocument*, JSJitMethodCallArgs const&) (/NREF-COMM-CENTRAL/objdir-tb3/dom/bindings/DocumentBinding.cpp:3040)
#03: mozilla::dom::workers::WorkerSameThreadRunnable::~WorkerSameThreadRunnable() (/NREF-COMM-CENTRAL/objdir-tb3/dist/include/mozilla/dom/WorkerRunnable.h:380)
#04: mozilla::CheckedInt<unsigned int> mozilla::operator*<unsigned int, unsigned int>(mozilla::CheckedInt<unsigned int> const&, unsigned int) (/NREF-COMM-CENTRAL/objdir-tb3/dist/include/mozilla/CheckedInt.h:758)
#05: mozilla::dom::ImageData* DowncastCCParticipant<mozilla::dom::ImageData>(void*) (/NREF-COMM-CENTRAL/objdir-tb3/dist/include/nsCycleCollectionParticipant.h:318)
#06: TraitPerToken* nsTArray_Impl<TraitPerToken, nsTArrayInfallibleAllocator>::ReplaceElementsAt<TraitPerToken, nsTArrayInfallibleAllocator>(unsigned long, unsigned long, TraitPerToken const*, unsigned long) (/NREF-COMM-CENTRAL/objdir-tb3/dist/include/nsTArray.h:1274)


A few rare cases are this:

[15582] ###!!! ASSERTION: must be in an update: 'mUpdateCount != 0', file /NREF-COMM-CENTRAL/comm-central/mozilla/layout/base/nsPresShell.cpp, line 4408
#01: mozilla::MediaStreamListener::AddRef() (/NREF-COMM-CENTRAL/comm-central/mozilla/dom/media/MediaStreamGraph.h:105 (discriminator 2))
#02: mozilla::dom::DocumentBinding::elementsFromPoint(JSContext*, JS::Handle<JSObject*>, nsIDocument*, JSJitMethodCallArgs const&) (/NREF-COMM-CENTRAL/objdir-tb3/dom/bindings/DocumentBinding.cpp:3040)
#03: mozilla::dom::DocumentBinding::set_ondurationchange(JSContext*, JS::Handle<JSObject*>, nsIDocument*, JSJitSetterCallArgs) (/NREF-COMM-CENTRAL/objdir-tb3/dom/bindings/DocumentBinding.cpp:5712 (discriminator 1))
#04: mozilla::dom::DocumentBinding::set_onloadstart(JSContext*, JS::Handle<JSObject*>, nsIDocument*, JSJitSetterCallArgs) (/NREF-COMM-CENTRAL/objdir-tb3/dom/bindings/DocumentBinding.cpp:6453)
#05: already_AddRefed<mozilla::dom::DeviceMotionEvent>::take() (/NREF-COMM-CENTRAL/objdir-tb3/dist/include/mozilla/AlreadyAddRefed.h:116)
#06: mozilla::PWebBrowserPersistDocumentParent::DeallocSubtree() (/NREF-COMM-CENTRAL/objdir-tb3/ipc/ipdl/PWebBrowserPersistDocumentParent.cpp:608 (discriminator 4))


The code in question looks like this:

void
PresShell::RecordStyleSheetChange(CSSStyleSheet* aStyleSheet)
{
  // too bad we can't check that the update is UPDATE_STYLE
  NS_ASSERTION(mUpdateCount != 0, "must be in an update");

  if (mStylesHaveChanged)
    return;


I have no idea what this assertion means in the context of C-C TB.
But I think it is prudent to report it so that someone can take a look.
[6835] ###!!! ASSERTION: must be in an update: 'mUpdateCount != 0', file /scratch/var/tmp/portage/www-client/seamonkey-2.40/work/seamonkey-2.40/mozilla/layout/base/nsPresShell.cpp, line 4518
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.