1389790 - Crash in mozilla::ServoStyleContext::GetCachedInheritingAnonBoxStyle

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-42701d05-7d64-43d0-9a7b-af9f00170808.
=============================================================

Seen while looking at nightly crash stats - crashes started in 20170806100257: http://bit.ly/2vYRsBY

Code was touched in Bug 1368290. ni on :emilio for investigation

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Hmm... So I see how can this in theory happen if we have an element without a frame that has text children and isn't display: contents...

But I'm having a hard time to find a situation where that would be true... Marcia, do you know how can I look to see if there's any URL in the reports?

(Also, my patch introduces the crash, but the behaviour we had before is wrong too...)

Comment 2

[Emilio Cobos Álvarez (:emilio)]

(Sorry, I wasn't intending to remove the ni? request from me, I can still write a patch, but I don't know how to look at the crash stats for page URLs, and they would be helpful to construct a test-case).

Comment 3

[Marcia Knous [:marcia]]

(In reply to Emilio Cobos Álvarez [:emilio] from comment #2)
> (Sorry, I wasn't intending to remove the ni? request from me, I can still
> write a patch, but I don't know how to look at the crash stats for page
> URLs, and they would be helpful to construct a test-case).

Permissions are needed to see the URLs and can be requested from the Socorro team.

From what I see, the only URL showing is http://www.rawpol.com.pl/pl/fotopopup.html?img=../photo2/9024/0006019024.jpg or some variant of that site.  The other reports I looked at did not have a URL.

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1389790: Ensure we always have an up-to-date style context even if we have no frame.

I'm still not quite sure how may we end up restyling a text node under there,
but all my attempts to build a test-case have failed.

Anyway this is the right thing to do.

Review commit: https://reviewboard.mozilla.org/r/167924/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/167924/

Comment 5

[Cameron McCormack (:heycam)]

Comment on attachment 8896644 [details]
Bug 1389790: Ensure we always have an up-to-date style context even if we have no frame.

https://reviewboard.mozilla.org/r/167924/#review173116

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/69d373634f87
Ensure we always have an up-to-date style context even if we have no frame. r=heycam

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/69d373634f87