1400022 - stylo: Assertion failure: !ServoStyleSet::IsInServoTraversal(), at layout/base/ServoRestyleManager.cpp:298

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P2)

Description

[Jesse Schwartzentruber (:truber)]

Attachment: testcase.html

The attached testcase causes an assertion in m-c rev 20170914-593158cd4910

Assertion failure: !ServoStyleSet::IsInServoTraversal(), at /builds/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:298
#0: mozilla::ServoRestyleManager::PostRestyleEvent, at layout/base/ServoRestyleManager.cpp:298
#1: nsSVGRenderingObserverList::InvalidateAll, at layout/svg/nsSVGEffects.cpp:808
#2: InvalidateRenderingObservers, at layout/generic/nsFrame.cpp:6404
#3: nsIFrame::SchedulePaint, at layout/generic/nsFrame.cpp:6679
#4: mozilla::dom::KeyframeEffectReadOnly::NotifyAnimationTimingUpdated, at dom/animation/KeyframeEffectReadOnly.cpp:115
#5: mozilla::dom::Animation::UpdateTiming, at dom/animation/Animation.cpp:1238
#6: mozilla::dom::Animation::PlayNoUpdate, at dom/animation/Animation.cpp:1126
#7: mozilla::dom::CSSTransition::PlayFromStyle, at layout/style/nsTransitionManager.h:149
#8: nsTransitionManager::ConsiderInitiatingTransition<const mozilla::ServoStyleContext*>, at layout/style/nsTransitionManager.cpp:1042
#9: nsTransitionManager::DoUpdateTransitions<const mozilla::ServoStyleContext*>, at layout/style/nsTransitionManager.cpp:684
#10: nsTransitionManager::UpdateTransitions, at layout/style/nsTransitionManager.cpp:642
#11: Gecko_UpdateAnimations, at layout/style/ServoBindings.cpp:690
#12: style::gecko::wrapper::{{impl}}::update_animations, at servo/components/style/gecko/wrapper.rs:1242
#13: style::context::SequentialTask<style::gecko::wrapper::GeckoElement>::execute<style::gecko::wrapper::GeckoElement>, at servo/components/style/context.rs:484
#14: style::context::{{impl}}::drop<style::gecko::wrapper::GeckoElement>, at servo/components/style/context.rs:604
#15: core::ptr::drop_in_place<style::context::SequentialTaskList<style::gecko::wrapper::GeckoElement>>, at src/libcore/ptr.rs:60
#16: core::ptr::drop_in_place<style::context::ThreadLocalStyleContext<style::gecko::wrapper::GeckoElement>>, at src/libcore/ptr.rs:60
#17: style::driver::traverse_dom<style::gecko::wrapper::GeckoElement,style::gecko::traversal::RecalcStyleOnly>, at servo/components/style/driver.rs:131
#18: geckoservo::glue::traverse_subtree, at servo/ports/geckolib/glue.rs:252
#19: geckoservo::glue::Servo_TraverseSubtree, at servo/ports/geckolib/glue.rs:290
#20: mozilla::ServoStyleSet::StyleDocument, at layout/style/ServoStyleSet.cpp:959
#21: mozilla::ServoRestyleManager::DoProcessPendingRestyles, at layout/base/ServoRestyleManager.cpp:1106
#22: mozilla::PresShell::DoFlushPendingNotifications, at layout/base/PresShell.cpp:4170
#23: mozilla::PresShell::DoFlushPendingNotifications, at layout/base/PresShell.cpp:4043
#24: nsDocument::FlushPendingNotifications, at dom/base/nsDocument.cpp:8366
#25: nsDocLoader::DocLoaderIsEmpty, at uriloader/base/nsDocLoader.cpp:703
#26: nsDocLoader::OnStopRequest, at uriloader/base/nsDocLoader.cpp:632
#27: mozilla::net::nsLoadGroup::RemoveRequest, at netwerk/base/nsLoadGroup.cpp:629
#28: nsDocument::DoUnblockOnload, at dom/base/nsDocument.cpp:9194
#29: nsDocument::UnblockOnload, at dom/base/nsDocument.cpp:9116
#30: nsDocument::DispatchContentLoadedEvents, at dom/base/nsDocument.cpp:5620
#31: mozilla::detail::RunnableMethodImpl<nsDocument*, void (nsDocument::*)(), true, (mozilla::RunnableKind)0u>::Run, at xpcom/threads/nsThreadUtils.h:1142
#32: mozilla::SchedulerGroup::Runnable::Run, at xpcom/threads/SchedulerGroup.cpp:396
#33: nsThread::ProcessNextEvent, at xpcom/threads/nsThread.cpp:1039
#34: NS_ProcessNextEvent, at xpcom/threads/nsThreadUtils.cpp:521
#35: mozilla::ipc::MessagePump::Run, at ipc/glue/MessagePump.cpp:97
#36: MessageLoop::RunInternal, at ipc/chromium/src/base/message_loop.cc:326
#37: MessageLoop::Run, at ipc/chromium/src/base/message_loop.cc:319
#38: nsBaseAppShell::Run, at widget/nsBaseAppShell.cpp:158
#39: XRE_RunAppShell, at toolkit/xre/nsEmbedFunctions.cpp:880
#40: mozilla::ipc::MessagePumpForChildProcess::Run, at ipc/glue/MessagePump.cpp:269
#41: MessageLoop::RunInternal, at ipc/chromium/src/base/message_loop.cc:326
#42: MessageLoop::Run, at ipc/chromium/src/base/message_loop.cc:319
#43: XRE_InitChildProcess, at toolkit/xre/nsEmbedFunctions.cpp:705
#44: content_process_main, at ipc/contentproc/plugin-container.cpp:63
#45: main, at browser/app/nsBrowserApp.cpp:285
#46: libc-2.25.so+0x204ca
#47: MOZ_ReportAssertionFailure, at mfbt/Assertions.h:165

Comment 1

[Hiroyuki Ikezoe (:hiro)]

I can't reproduce the assertion on linux, but I know this is a problem.

Comment 2

[Emilio Cobos Álvarez [:emilio]]

This one is pretty much the same issue indeed.

Comment 3

[Hiroyuki Ikezoe (:hiro)]

Oops, I can actually reproduce the assertion. I did replace the SchedulePaint in UpdateTargetRegistration() with RequestRestyle(Layer).

Comment 4

[Hiroyuki Ikezoe (:hiro)]

Attachment: Bug 1400022 - Backed out changeset 610fbd30a6a3 (bug 1397057).

The SchedulePaint() ends up calling
nsSVGEffects::InvalidateDirectRenderingObservers, it doesn't need for retained
display list, and causes harmful restyle events for stylo.

We will call ScheulePaint without involing InvalidateDirectRenderingObservers
later in another bug.

Review commit: https://reviewboard.mozilla.org/r/181034/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/181034/

Comment 5

[Hiroyuki Ikezoe (:hiro)]

Attachment: Bug 1400022 - Crash test.

Review commit: https://reviewboard.mozilla.org/r/181036/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/181036/

Comment 6

[Matt Woodrow (:mattwoodrow)]

Comment on attachment 8909577 [details]
Bug 1400022 - Backed out changeset 610fbd30a6a3 (bug 1397057).

https://reviewboard.mozilla.org/r/181034/#review186298

Comment 7

[Hiroyuki Ikezoe (:hiro)]

Comment on attachment 8909578 [details]
Bug 1400022 - Crash test.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/181036/diff/1-2/

Comment 8

[Hiroyuki Ikezoe (:hiro)]

Comment on attachment 8909578 [details]
Bug 1400022 - Crash test.

https://reviewboard.mozilla.org/r/181036/#review186324

Comment 9

[Hiroyuki Ikezoe (:hiro)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=7891ab74a2d798a77b41f11afc03f995c9c7ec3e

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/eaed1ca2cc9c
Backed out changeset 610fbd30a6a3 (bug 1397057). r=mattwoodrow
https://hg.mozilla.org/integration/autoland/rev/7b594f9487ad
Crash test. r=hiro

Comment 11

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Merged backout: https://hg.mozilla.org/mozilla-central/rev/eaed1ca2cc9c

Comment 12

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/eaed1ca2cc9c

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7b594f9487ad