1315408 - Assertion failure: !color.IsEmpty() in [@nsColorControlFrame::UpdateColor()]

Status: VERIFIED DUPLICATE of bug 1388230

(Core :: Layout, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: log.txt

Assertion failure: !color.IsEmpty() (Content node's GetValue() should return a valid color string (the default color, in case no valid color is set)), at /home/worker/workspace/build/src/layout/forms/nsColorControlFrame.cpp:107

==10765==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fd9c8eadb17 bp 0x7ffca17aba50 sp 0x7ffca17ab820 T0)
    #0 0x7fd9c8eadb16 in nsColorControlFrame::UpdateColor() /home/worker/workspace/build/src/layout/forms/nsColorControlFrame.cpp:110:52
    #1 0x7fd9c8ead608 in nsColorControlFrame::CreateAnonymousContent(nsTArray<nsIAnonymousContentCreator::ContentInfo>&) /home/worker/workspace/build/src/layout/forms/nsColorControlFrame.cpp:74:17
    #2 0x7fd9c8acea5e in nsCSSFrameConstructor::GetAnonymousContent(nsIContent*, nsIFrame*, nsTArray<nsIAnonymousContentCreator::ContentInfo>&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:4213:17
    #3 0x7fd9c8ac83ff in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsStyleContext*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10714:3
    #4 0x7fd9c8ad42f7 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:4012:9
    #5 0x7fd9c8ada003 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:6172:3
    #6 0x7fd9c8ac7e78 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10579:5
    #7 0x7fd9c8ae1619 in nsCSSFrameConstructor::ContentAppended(nsIContent*, nsIContent*, bool) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:7494:3
    #8 0x7fd9c8c07e42 in PresShell::ContentAppended(nsIDocument*, nsIContent*, nsIContent*, int) /home/worker/workspace/build/src/layout/base/nsPresShell.cpp:4369:3
    #9 0x7fd9c590180c in nsNodeUtils::ContentAppended(nsIContent*, nsIContent*, int) /home/worker/workspace/build/src/dom/base/nsNodeUtils.cpp:167:3
    #10 0x7fd9c4d04684 in nsHtml5TreeOperation::Append(nsIContent*, nsIContent*, nsHtml5DocumentBuilder*) /home/worker/workspace/build/src/parser/html/nsHtml5TreeOperation.cpp:184:5
    #11 0x7fd9c4d09aac in nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**) /home/worker/workspace/build/src/parser/html/nsHtml5TreeOperation.cpp:645:14
    #12 0x7fd9c4cfb502 in nsHtml5TreeOpExecutor::RunFlushLoop() /home/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:449:21
    #13 0x7fd9c4cfef04 in nsHtml5ExecutorFlusher::Run() /home/worker/workspace/build/src/parser/html/nsHtml5StreamParser.cpp:128:9
    #14 0x7fd9c353fc12 in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1175:7
    #15 0x7fd9c35c8570 in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/glue/nsThreadUtils.cpp:361:10
    #16 0x7fd9c40411d9 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21
    #17 0x7fd9c3fafc57 in MessageLoop::RunInternal() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3
    #18 0x7fd9c3fafae9 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205:3
    #19 0x7fd9c857b64a in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3
    #20 0x7fd9c9ce796c in nsAppStartup::Run() /home/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:283:19
    #21 0x7fd9c9dfd26d in XREMain::XRE_mainRun() /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4467:10
    #22 0x7fd9c9dfe8a2 in XREMain::XRE_main(int, char**, nsXREAppData const*) /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4600:8
    #23 0x7fd9c9dff4f2 in XRE_main /home/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4691:16
    #24 0x4e02a9 in do_main(int, char**, char**, nsIFile*) /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:282:10
    #25 0x4df985 in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:415:16
    #26 0x7fd9debc082f in __libc_start_main /build/glibc-Qz8a69/glibc-2.23/csu/../csu/libc-start.c:291
    #27 0x41c134 in _start (/home/user/workspace/browsers/firefox_dbg/firefox+0x41c134)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Comment 2

[Julien Cristau [:jcristau] (back April 22)]

Too late for firefox 52, mass-wontfix.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

mozregression says this was fixed by bug 1348073. Is that an expected outcome for this testcase?

Comment 4

[Makoto Kato [:m_kato]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #3)
> mozregression says this was fixed by bug 1348073. Is that an expected
> outcome for this testcase?

No, unexpected.  But, by bug 1348073, this won't occur because we don't create layout's frame when appending DOM tree.

Comment 5

[Daniel Holbert [:dholbert]]

It sounds like anyone wanting to look into this will need to first do a local backout of https://hg.mozilla.org/mozilla-central/rev/6b27a9f18281 (from bug 1348073), then.

Comment 6

[Arnaud Bienner]

Looks like a duplicate of bug 1388230, which dholbert is currently fixing.

Comment 7

[Daniel Holbert [:dholbert]]

Yup, thanks!

(When working on that bug, I thought I remembered seeing another copy somewhere recently... Thanks for finding it & duping.)

Comment 8

[Daniel Holbert [:dholbert]]

I'll include the testcase from this bug here as a crashtest as part of the final patch over there, too.