If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

stylo: Assertion failure: !StylistNeedsUpdate()

RESOLVED FIXED in Firefox 57

Status

()

Core
CSS Parsing and Computation
P2
normal
RESOLVED FIXED
a month ago
a month ago

People

(Reporter: jkratzer, Assigned: emilio)

Tracking

(Blocks: 2 bugs, {assertion, testcase})

unspecified
mozilla57
assertion, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox55 unaffected, firefox56 wontfix, firefox57 fixed)

Details

MozReview Requests

()

Submitter Diff Changes Open Issues Last Updated
Loading...
Error loading review requests:

Attachments

(2 attachments)

(Reporter)

Description

a month ago
Created attachment 8894725 [details]
trigger.html

Attached testcase causes an assertion in m-c rev 65507616792c with stylo enabled by pref.

Assertion failure: !StylistNeedsUpdate(), at /home/worker/workspace/build/src/layout/style/ServoStyleSet.cpp:532
#01: mozilla::StyleSetHandle::Ptr::ResolveInheritingAnonymousBoxStyle at mfbt/AlreadyAddRefed.h:121
#02: nsTableFrame::AppendAnonymousColFrames at layout/tables/nsTableFrame.cpp:753
#03: nsTableFrame::InsertCells at layout/tables/nsTableFrame.cpp:841
#04: nsTableFrame::AttributeChangedFor at layout/tables/nsTableFrame.cpp:379
#05: nsTableCellFrame::AttributeChanged at layout/tables/nsTableCellFrame.cpp:236
#06: mozilla::ServoRestyleManager::AttributeChanged at layout/base/ServoRestyleManager.cpp:1221
#07: mozilla::PresShell::AttributeChanged at layout/base/RestyleManagerInlines.h:72
#08: nsNodeUtils::AttributeChanged at dom/base/nsNodeUtils.cpp:145
#09: mozilla::dom::Element::SetAttrAndNotify at dom/base/Element.cpp:2659
#10: mozilla::dom::Element::SetAttr at dom/base/Element.cpp:2470
#11: mozilla::dom::Element::SetAttr at dom/base/Element.h:1343
#12: nsGenericHTMLElement::SetUnsignedIntAttr at xpcom/string/nsTSubstring.h:347
#13: mozilla::dom::HTMLTableCellElementBinding::set_rowSpan at obj-firefox/dom/bindings/HTMLTableCellElementBinding.cpp:112
#14: mozilla::dom::GenericBindingSetter at dom/bindings/BindingUtils.cpp:3014
#15: js::CallJSNative at js/src/jscntxtinlines.h:293
#16: js::InternalCallOrConstruct at js/src/vm/Interpreter.cpp:469
#17: js::Call at js/src/vm/Interpreter.cpp:533
#18: js::CallSetter at js/public/RootingAPI.h:825
#19: js::NativeSetProperty at js/src/vm/NativeObject.cpp:2764
#20: Interpret at js/src/vm/NativeObject.h:1553
Flags: in-testsuite?
(Assignee)

Updated

a month ago
Flags: needinfo?(emilio+bugs)
(Assignee)

Updated

a month ago
Flags: needinfo?(emilio+bugs)
(Assignee)

Comment 1

a month ago
Gah, attribute change notifications randomly calling into ResolveInheritingAnonymousBoxStyle? :(

I guess it's fine to just update the stylist if we need to, we'll have a full restyle scheduled anyway.
(Assignee)

Comment 2

a month ago
This could also, I guess, explain why we do a few more rebuilds than needed... But we don't really want to throw away the "stylesheets are up-to-date" assertions... sigh.
Comment hidden (mozreview-request)
Assignee: nobody → emilio+bugs
Priority: -- → P2

Comment 4

a month ago
mozreview-review
Comment on attachment 8894857 [details]
Bug 1388234: Don't assert when calling out of band to ResolveInheritingAnonymousBoxStyle.

https://reviewboard.mozilla.org/r/166022/#review171514

::: commit-message-2d30d:1
(Diff revision 1)
> +Bug 1388234: Don't assert when calling out of band to ResolveInheritingAnonimousBoxStyle. r?heycam

Anonymous

::: layout/style/ServoStyleSet.cpp:539
(Diff revision 1)
> +    // People like to call into here from random attribute notifications (see
> +    // bug 1388234).

Do you think the cell attribute stuff should be changed to avoid doing that?  If so, please file a (low priority) bug and reference that bug instead of this one here.
Attachment #8894857 - Flags: review?(cam) → review+
(Assignee)

Updated

a month ago
See Also: → bug 1389029
Comment hidden (mozreview-request)

Comment 6

a month ago
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/bf9cf6f393eb
Don't assert when calling out of band to ResolveInheritingAnonymousBoxStyle. r=heycam

Comment 7

a month ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/bf9cf6f393eb
Status: NEW → RESOLVED
Last Resolved: a month ago
status-firefox57: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
status-firefox55: --- → unaffected
status-firefox56: --- → wontfix
status-firefox-esr52: --- → unaffected
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.