1181598 - Crash when creating a responsive image from browser-child.js

Status: RESOLVED DUPLICATE of bug 1160819

(Core :: DOM: Core & HTML, defect)

Description

[Marcos Caceres [:marcosc]]

I get an e10s tab crash when trying to set an img's srcset attribute from browser-child.js: 

[Child 46733] ###!!! ASSERTION: not a length or calc unit: 'aValue.IsLengthUnit() || aValue.IsCalcUnit()', file /Users/marcos/gecko/layout/style/nsRuleNode.cpp, line 373
[Child 46733] ###!!! ASSERTION: unexpected unit: 'Not Reached', file /Users/marcos/gecko/layout/style/nsRuleNode.cpp, line 535
Assertion failure: false (0 or negative matching width is invalid per spec), at /Users/marcos/gecko/dom/base/ResponsiveImageSelector.cpp:707
#01: mozilla::dom::ResponsiveImageSelector::GetSelectedImageURLSpec(nsAString_internal&)[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xfab2ca]
#02: mozilla::dom::HTMLImageElement::SelectSourceForTagWithAttrs(nsIDocument*, bool, nsAString_internal const&, nsAString_internal const&, nsAString_internal const&, nsAString_internal const&, nsAString_internal const&, nsAString_internal&)[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1eb3e43]
#03: nsDocument::ResolvePreloadImage(nsIURI*, nsAString_internal const&, nsAString_internal const&, nsAString_internal const&)[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x10471fa]
#04: nsHtml5TreeOpExecutor::PreloadImage(nsAString_internal const&, nsAString_internal const&, nsAString_internal const&, nsAString_internal const&, nsAString_internal const&)[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xbb09c4]
#05: nsHtml5TreeOpExecutor::FlushSpeculativeLoads()[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xbceb7b]
#06: nsHtml5LoadFlusher::Run()[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xbdf870]
#07: nsThread::ProcessNextEvent(bool, bool*)[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0xdf8f5]
#08: NS_ProcessPendingEvents(nsIThread*, unsigned int)[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1156af]
#09: nsBaseAppShell::NativeEventCallback()[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2747407]
#10: nsAppShell::ProcessGeckoEvents(void*)[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x279a8ae]
#11: __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x80a01]
#12: __CFRunLoopDoSources0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x72b8d]
#13: __CFRunLoopRun[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x721bf]
#14: CFRunLoopRunSpecific[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x71bd8]
#15: RunCurrentEventLoopInMode[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x3256f]
#16: ReceiveNextEventCommon[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x322ea]
#17: _BlockUntilNextEventMatchingListInModeWithFilter[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x3212b]
#18: _DPSNextEvent[/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x918ab]
#19: -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x90e58]
#20: -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:][/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2799b56]
#21: -[NSApplication run][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x86af3]
#22: nsAppShell::Run()[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x279afa5]
#23: XRE_RunAppShell[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3332214]
#24: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4a2aa2]
#25: MessageLoop::Run()[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x46c33c]
#26: XRE_InitChildProcess[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3331c2d]
#27: content_process_main(int, char**)[/Users/marcos/gecko/obj-x86_64-apple-darwin14.4.0/dist/NightlyDebug.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container +0x11c0]

Comment 1

[Marcos Caceres [:marcosc]]

(actually, maybe it's not even happening in browser-child.js... dunno)