stylo: Assertion failure: !(isInitial || forReconstruct) || !postTraversalRequired

RESOLVED FIXED in Firefox 56

Status

()

defect
P2
normal
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: jkratzer, Assigned: bholley)

Tracking

(Blocks 2 bugs, {assertion, testcase})

56 Branch
mozilla57
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox55 unaffected, firefox56 fixed, firefox57 fixed)

Details

Attachments

(3 attachments)

Reporter

Description

2 years ago
Posted file trigger.html
Attached testcase causes an assertion in m-c rev 36ad88e6b7b2 with stylo enabled by pref.

Assertion failure: !(isInitial || forReconstruct) || !postTraversalRequired, at /home/worker/workspace/build/src/layout/style/ServoStyleSet.cpp:294

#01: mozilla::ServoStyleSet::StyleDocument at layout/style/ServoStyleSet.cpp:790
#02: nsCSSFrameConstructor::ConstructDocElementFrame at layout/style/StyleSetHandle.h:199
#03: nsCSSFrameConstructor::ContentRangeInserted at layout/base/nsCSSFrameConstructor.cpp:8057
#04: nsCSSFrameConstructor::ContentInserted at layout/base/nsCSSFrameConstructor.h:277
#05: mozilla::PresShell::ContentInserted at dom/base/nsINode.h:580
#06: nsNodeUtils::ContentInserted at dom/base/nsNodeUtils.cpp:201
#07: nsINode::doInsertChildAt at dom/base/nsINode.cpp:1640
#08: nsINode::ReplaceOrInsertBefore at dom/bindings/ErrorResult.h:376
#09: mozilla::dom::NodeBinding::replaceChild at obj-firefox/dom/bindings/NodeBinding.cpp:946
#10: mozilla::dom::GenericBindingMethod at dom/bindings/BindingUtils.cpp:3055
Flags: in-testsuite?
Assignee

Updated

2 years ago
Assignee: nobody → bobbyholley
Priority: -- → P2
Assignee

Comment 1

2 years ago
This fixes the testcase in the bug, which removes and reinserts
some elements. Our invariants require us not to set the dirty
descendants bits on unstyled elements.

MozReview-Commit-ID: 1eESZjNSURG
Attachment #8895216 - Flags: review?(emilio+bugs)
Assignee

Comment 2

2 years ago
MozReview-Commit-ID: 59I61PQIWHi
Attachment #8895217 - Flags: review+
Attachment #8895216 - Flags: review?(emilio+bugs) → review+

Comment 4

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/fa3284a6b8f0
https://hg.mozilla.org/mozilla-central/rev/0787a4518e77
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
Bobby, do we want this on Beta in support of the Stylo experiment or can it ride the 57 train?
Flags: needinfo?(bobbyholley)
Version: unspecified → 56 Branch
Assignee

Comment 6

2 years ago
(In reply to Ryan VanderMeulen [:RyanVM] from comment #5)
> Bobby, do we want this on Beta in support of the Stylo experiment or can it
> ride the 57 train?

I guess it couldn't hurt. Extremely low risk.
Flags: needinfo?(bobbyholley)
Assignee

Comment 7

2 years ago
Comment on attachment 8895216 [details] [diff] [review]
Clear the servo bits when dropping servo data. v1

Approval Request Comment
[Feature/Bug causing the regression]: N/A
[User impact if declined]: Small chance of stability/correctness issues with the stylo experiment we're running on 56 beta.
[Is this code covered by automated tests?]: Yes
[Has the fix been verified in Nightly?]: (via tests)
[Needs manual test from QE? If yes, steps to reproduce]: No 
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: No.
[Why is the change risky/not risky?]:  Only affects stylo, and very low risk for stylo.
[String changes made/needed]: None
Attachment #8895216 - Flags: approval-mozilla-beta?
Comment on attachment 8895216 [details] [diff] [review]
Clear the servo bits when dropping servo data. v1

Fix should only affect stylo for beta 56 experiement. Please uplift for beta 3.
Attachment #8895216 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.