1323678 - stylo: several tests fatally assert with "NS_IsMainThread() (ServoAttrSnapshots can only be dropped on the main thread)"

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Cameron McCormack (:heycam)]

Thread 81 "firefox" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffabdfc700 (LWP 4677)]
0x00007fffe6d210d0 in Gecko_DropElementSnapshot (aSnapshot=0x7fffb583b7a0) at /z/stylo/hg-incubator/layout/style/ServoBindings.cpp:281
281	  MOZ_ASSERT(NS_IsMainThread(),
(gdb) bt
#0  0x00007fffe6d210d0 in Gecko_DropElementSnapshot (aSnapshot=0x7fffb583b7a0) at /z/stylo/hg-incubator/layout/style/ServoBindings.cpp:281
#1  0x00007fffea3b220d in style::gecko::snapshot::{{impl}}::drop (self=0x7fffd518d5a8) at /z/stylo/hg-incubator/servo/components/style/gecko/snapshot.rs:27
#2  0x00007fffea231491 in drop::h0d7d3873c169cd61 () at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libcore/iter/iterator.rs:132
#3  0x00007fffea23d3e8 in drop::h941dafc24af72ace () at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libcore/iter/iterator.rs:132
#4  0x00007fffea247889 in drop::hfa0e8e133b2f17eb () at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libcore/iter/iterator.rs:132
#5  0x00007fffea23fe6e in drop::hb1b4d5fe7781d994 () at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libcore/iter/iterator.rs:132
#6  0x00007fffea2344c8 in drop::h2df5c6dd2d67d26a () at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libcore/iter/iterator.rs:132
#7  0x00007fffea240229 in drop::hb4b0103a828ff703 () at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libcore/iter/iterator.rs:132
#8  0x00007fffea24552d in drop::he004fda92ce0f7cc () at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libcore/iter/iterator.rs:132
#9  0x00007fffea2353c9 in drop::h387ecf1ae022a759 () at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libcore/iter/iterator.rs:132
#10 0x00007fffea238164 in drop::h57d1c53a2301e0a8 () at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libcore/iter/iterator.rs:132
#11 0x00007fffea3b4add in style::gecko::wrapper::GeckoElement::clear_data (self=0x7fffabdf8ca0) at /z/stylo/hg-incubator/servo/components/style/gecko/wrapper.rs:253
#12 0x00007fffea3b367d in style::gecko::traversal::{{impl}}::clear_element_data (element=0x7fffabdf8ca0) at /z/stylo/hg-incubator/servo/components/style/gecko/traversal.rs:50
#13 0x00007fffea716f89 in style::traversal::compute_style::{{closure}}<style::gecko::wrapper::GeckoElement,style::gecko::context::StandaloneStyleContext,style::gecko::traversal::RecalcStyleOnly> (e=...)
    at /z/stylo/hg-incubator/servo/components/style/traversal.rs:504
#14 0x00007fffea3f7990 in style::traversal::clear_descendant_data<style::gecko::wrapper::GeckoElement,closure> (el=..., clear_data=0x7fffeb598095) at /z/stylo/hg-incubator/servo/components/style/traversal.rs:574
#15 0x00007fffea3f7391 in style::traversal::compute_style<style::gecko::wrapper::GeckoElement,style::gecko::context::StandaloneStyleContext,style::gecko::traversal::RecalcStyleOnly> (context=0x7fffabdf9a60, data=0x7fffabdf95f8, 
    traversal_data=0x7fffabdf9a80, element=...) at /z/stylo/hg-incubator/servo/components/style/traversal.rs:504
#16 0x00007fffea3f6821 in style::traversal::recalc_style_at<style::gecko::wrapper::GeckoElement,style::gecko::context::StandaloneStyleContext,style::gecko::traversal::RecalcStyleOnly> (context=0x7fffabdf9a60, 
    traversal_data=0x7fffabdf9a80, element=..., data=0x7fffabdf95f8) at /z/stylo/hg-incubator/servo/components/style/traversal.rs:393
#17 0x00007fffea3b35b7 in style::gecko::traversal::{{impl}}::process_preorder (self=0x7fffabdf9a60, node=..., traversal_data=0x7fffabdf9a80) at /z/stylo/hg-incubator/servo/components/style/gecko/traversal.rs:34
#18 0x00007fffe9df0b45 in style::parallel::top_down_dom<style::gecko::wrapper::GeckoNode,style::gecko::traversal::RecalcStyleOnly> (unsafe_nodes=..., root=..., data=..., scope=<optimised out>, shared_context=<optimised out>)
    at /z/stylo/hg-incubator/servo/components/style/parallel.rs:89
#19 style::parallel::traverse_nodes<style::gecko::wrapper::GeckoNode,style::gecko::traversal::RecalcStyleOnly> (nodes=..., root=..., data=..., scope=0x7fffabdfab48, shared_context=0x7fffffffabf0)
    at /z/stylo/hg-incubator/servo/components/style/parallel.rs:137
#20 0x00007fffe9df0d70 in style::parallel::top_down_dom<style::gecko::wrapper::GeckoNode,style::gecko::traversal::RecalcStyleOnly> (unsafe_nodes=..., root=..., data=..., scope=<optimised out>, shared_context=<optimised out>)
    at /z/stylo/hg-incubator/servo/components/style/parallel.rs:119
#21 style::parallel::traverse_nodes<style::gecko::wrapper::GeckoNode,style::gecko::traversal::RecalcStyleOnly> (nodes=..., root=..., data=..., scope=0x7fffabdfab48, shared_context=0x7fffffffabf0)
    at /z/stylo/hg-incubator/servo/components/style/parallel.rs:137
#22 0x00007fffe9eb1ef1 in style::parallel::traverse_dom::{{closure}}::{{closure}}<style::gecko::wrapper::GeckoNode,style::gecko::traversal::RecalcStyleOnly> (scope=0x7fffabdfab48)
    at /z/stylo/hg-incubator/servo/components/style/parallel.rs:54
#23 0x00007fffe9eb1e28 in rayon::scope::{{impl}}::execute_job_closure::{{closure}}<closure> () at /z/stylo/hg-incubator/third_party/rust/rayon/src/scope/mod.rs:316
#24 0x00007fffe9e87f3a in std::panic::{{impl}}::call_once<(),closure> (self=..., _args=()) at /buildslave/rust-buildbot/slave/beta-dist-rustc-linux/build/obj/../src/libstd/panic.rs:255

Comment 1

[Cameron McCormack (:heycam)]

layout/base/crashtests/330015-1.html
layout/base/crashtests/394014-1.html

Comment 2

[Xidorn Quan [:xidorn] UTC+10]

layout/style/test/test_flexbox_order.html
layout/style/test/test_flexbox_order_table.html
layout/style/test/test_grid_computed_values.html

Comment 3

[Bobby Holley (:bholley)]

Attachment: Support off-main-thread snapshot destruction. v1

Comment 4

[Bobby Holley (:bholley)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=fa8ca87ab8133d667bd9f63a8d44ff830b4ad367

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1e8f1baf3894
Support off-main-thread snapshot destruction. r=heycam

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/1e8f1baf3894