1390933 - Assertion failure: aContent || !(aHint & nsChangeHint_ReconstructFrame) (must have content), at nsStyleChangeList.cpp:26

Status: RESOLVED WORKSFORME

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev 20170816-6ebc251bd288.

Assertion failure: aContent || !(aHint & nsChangeHint_ReconstructFrame) (must have content), at /home/worker/workspace/build/src/layout/base/nsStyleChangeList.cpp:26

#01: mozilla::ElementRestyler::ComputeStyleChangeFor at layout/base/GeckoRestyleManager.cpp:3108
#02: mozilla::GeckoRestyleManager::ComputeAndProcessStyleChange at layout/base/GeckoRestyleManager.cpp:3575
#03: mozilla::GeckoRestyleManager::StartRebuildAllStyleData at xpcom/ds/nsTArray.h:2234
#04: mozilla::GeckoRestyleManager::RestyleElement at layout/base/GeckoRestyleManager.cpp:219
#05: mozilla::RestyleTracker::ProcessOneRestyle at layout/base/RestyleTracker.cpp:95
#06: mozilla::RestyleTracker::DoProcessRestyles at layout/base/RestyleTracker.cpp:257
#07: mozilla::GeckoRestyleManager::ProcessPendingRestyles at layout/base/GeckoRestyleManager.cpp:581
#08: mozilla::PresShell::DoFlushPendingNotifications at layout/base/PresShell.cpp:4200
#09: nsRefreshDriver::Tick at mfbt/RefPtr.h:284
#10: mozilla::RefreshDriverTimer::TickRefreshDrivers at layout/base/nsRefreshDriver.cpp:309
#11: mozilla::RefreshDriverTimer::Tick at layout/base/nsRefreshDriver.cpp:329
#12: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver at layout/base/nsRefreshDriver.cpp:686
#13: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run at layout/base/nsRefreshDriver.cpp:531
#14: nsThread::ProcessNextEvent at mfbt/Maybe.h:445
#15: NS_ProcessNextEvent at xpcom/threads/nsThreadUtils.cpp:521
#16: mozilla::ipc::MessagePump::Run at ipc/glue/MessagePump.cpp:98
#17: MessageLoop::RunInternal at ipc/chromium/src/base/message_loop.cc:327
#18: MessageLoop::Run at ipc/chromium/src/base/message_loop.cc:299
#19: nsBaseAppShell::Run at widget/nsBaseAppShell.cpp:160
#20: nsAppStartup::Run at toolkit/components/startup/nsAppStartup.cpp:288
#21: XREMain::XRE_mainRun at toolkit/xre/nsAppRunner.cpp:4647
#22: XREMain::XRE_main at toolkit/xre/nsAppRunner.cpp:4810
#23: XRE_main at toolkit/xre/nsAppRunner.cpp:4905
#24: do_main at browser/app/nsBrowserApp.cpp:236
#25: main at browser/app/nsBrowserApp.cpp:311
#26: __libc_start_main[/lib/x86_64-linux-gnu/libc.so.6 +0x20830]
#27: _start at 0x29

Comment 1

[Ryan VanderMeulen [:RyanVM]]

INFO: Last good revision: 8f349f00f6668cfe6f619f32c108b69b2bc929a2
INFO: First bad revision: a3a199efb743a1043d88b7128d01870186c1fa91
INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=8f349f00f6668cfe6f619f32c108b69b2bc929a2&tochange=a3a199efb743a1043d88b7128d01870186c1fa91

This only reproduces with Stylo disabled, so we can probably just close it out once we're shipping it by default everywhere?

Comment 2

[Emilio Cobos Álvarez (:emilio)]

This code is all gone.