Closed
Bug 1404316
Opened 7 years ago
Closed 7 years ago
stylo: thread 'StyleThread#1' panicked at 'assertion failed: `(left == right)` (left: `0`, right: `1`)', /builds/worker/workspace/build/src/servo/components/style/traversal.rs:668
Categories
(Core :: CSS Parsing and Computation, defect, P2)
Core
CSS Parsing and Computation
Tracking
()
RESOLVED
FIXED
mozilla58
Tracking | Status | |
---|---|---|
firefox-esr52 | --- | unaffected |
firefox56 | --- | unaffected |
firefox57 | --- | fixed |
firefox58 | --- | fixed |
People
(Reporter: jkratzer, Assigned: bholley)
References
(Blocks 2 open bugs)
Details
(Keywords: assertion, testcase)
Attachments
(3 files, 1 obsolete file)
949 bytes,
text/html
|
Details | |
4.44 KB,
patch
|
emilio
:
review+
|
Details | Diff | Splinter Review |
122 bytes,
text/plain
|
ritu
:
approval-mozilla-beta+
|
Details |
Testcase found while fuzzing mozilla-central rev 946b9c995ec3.
thread 'StyleThread#2' panicked at 'assertion failed: `(left == right)` (left: `0`, right: `1`)', /builds/worker/workspace/build/src/servo/components/style/traversal.rs:668
stack backtrace:
thread 'StyleThread#1' panicked at 'assertion failed: `(left == right)` (left: `0`, right: `1`)', /builds/worker/workspace/build/src/servo/components/style/traversal.rs:668
0: 0x7fdada3f0493 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::hcab99e0793da62c7
1: 0x7fdada3eb7b6 - std::sys_common::backtrace::_print::hbfe5b0c7e79c0711
2: 0x7fdada3fdb2a - std::panicking::default_hook::{{closure}}::h9ba2c6973907a2be
3: 0x7fdada3fd72b - std::panicking::default_hook::he4d55e2dd21c3cca
4: 0x7fdada3fdf7a - std::panicking::rust_panic_with_hook::ha138c05cd33ad44d
5: 0x7fdada3fde14 - std::panicking::begin_panic::hcdbfa35c94142fa2
6: 0x7fdada3fdd49 - std::panicking::begin_panic_fmt::hc09fe500d9b7be81
7: 0x7fdada4c1590 - style::traversal::compute_style::he9440e02ab5b4568
8: 0x7fdada5dc4fd - style::traversal::recalc_style_at::hb7b907d23224e88a
9: 0x7fdada5b5c9a - <style::gecko::traversal::RecalcStyleOnly<'recalc> as style::traversal::DomTraversal<style::gecko::wrapper::GeckoElement<'le>>>::process_preorder::h64c5cec2c7de7224
10: 0x7fdada5dad41 - style::parallel::traverse_nodes::{{closure}}::h7089d5281be6469a
11: 0x7fdada5a9359 - rayon_core::scope::Scope::execute_job_closure::{{closure}}::h041192ab93362884
12: 0x7fdada5fbacd - <std::panic::AssertUnwindSafe<F> as core::ops::FnOnce<()>>::call_once::hd6cb4163f56c867b
13: 0x7fdada5b920d - std::panicking::try::do_call::hd4197f2a970ab863
14: 0x7fdada40281b - <unknown>
Redirecting call to abort() to mozalloc_abort
Hit MOZ_CRASH() at /builds/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33
stack backtrace:
0: 0x7fdada3f0493 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::hcab99e0793da62c7
1: 0x7fdada3eb7b6 - std::sys_common::backtrace::_print::hbfe5b0c7e79c0711
2: 0x7fdada3fdb2a - std::panicking::default_hook::{{closure}}::h9ba2c6973907a2be
3: 0x7fdada3fd72b - std::panicking::default_hook::he4d55e2dd21c3cca
4: 0x7fdada3fdf7a - std::panicking::rust_panic_with_hook::ha138c05cd33ad44d
5: 0x7fdada3fde14 - std::panicking::begin_panic::hcdbfa35c94142fa2
6: 0x7fdada3fdd49 - std::panicking::begin_panic_fmt::hc09fe500d9b7be81
7: 0x7fdada4c1590 - style::traversal::compute_style::he9440e02ab5b4568
8: 0x7fdada5dc4fd - style::traversal::recalc_style_at::hb7b907d23224e88a
9: 0x7fdada5b5c9a - <style::gecko::traversal::RecalcStyleOnly<'recalc> as style::traversal::DomTraversal<style::gecko::wrapper::GeckoElement<'le>>>::process_preorder::h64c5cec2c7de7224
10: 0x7fdada5dad41 - style::parallel::traverse_nodes::{{closure}}::h7089d5281be6469a
11: 0x7fdada5a9359 - rayon_core::scope::Scope::execute_job_closure::{{closure}}::h041192ab93362884
12: 0x7fdada5fbacd - <std::panic::AssertUnwindSafe<F> as core::ops::FnOnce<()>>::call_once::hd6cb4163f56c867b
13: 0x7fdada5b920d - std::panicking::try::do_call::hd4197f2a970ab863
14: 0x7fdada40281b - <unknown>
Redirecting call to abort() to mozalloc_abort
Hit MOZ_CRASH() at /builds/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33
Flags: in-testsuite?
Assignee | ||
Comment 1•7 years ago
|
||
This is the bloom filter depth assertion [1]. Somehow the insert_parents_recovering call above isn't ending us up with the right depth.
[1] http://searchfox.org/mozilla-central/rev/20e41d4a61a8f5e34c9cf357304b78b3e9bced8a/servo/components/style/traversal.rs#668
Priority: -- → P2
Assignee | ||
Updated•7 years ago
|
Assignee: nobody → bobbyholley
Assignee | ||
Comment 2•7 years ago
|
||
So, this is flattened tree coherency problem, where the parent (the root) thinks it has a child, but the child thinks it has no parent (because it thinks it's document-level NAC).
This is because the root element is content-editable, and so the editor machinery creates manual NAC beneath it. But the document-level NAC detection code in GetFlattenedTreeParentForStyle predates our handling of manual NAC, and thus makes faulty assumptions about it. Fix should be straightforward, I'll write it up.
Assignee | ||
Comment 3•7 years ago
|
||
Assignee | ||
Comment 4•7 years ago
|
||
Assignee | ||
Comment 5•7 years ago
|
||
MozReview-Commit-ID: 74UMBeZBZcw
Assignee | ||
Comment 6•7 years ago
|
||
Comment on attachment 8913888 [details] [diff] [review]
Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. v1
Whoops, out of date patch.
Attachment #8913888 -
Attachment is obsolete: true
Assignee | ||
Comment 7•7 years ago
|
||
Assignee | ||
Comment 8•7 years ago
|
||
MozReview-Commit-ID: 74UMBeZBZcw
Attachment #8913889 -
Flags: review?(emilio)
Assignee | ||
Comment 9•7 years ago
|
||
(In reply to Bobby Holley (:bholley) (busy with Stylo) from comment #7)
> https://treeherder.mozilla.org/#/
> jobs?repo=try&revision=1920b65df4b8f8b85d6de38d771f9c32ed56b44e
This is green.
Comment 10•7 years ago
|
||
Comment on attachment 8913889 [details] [diff] [review]
Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. v1
Review of attachment 8913889 [details] [diff] [review]:
-----------------------------------------------------------------
r=me
::: dom/base/FragmentOrElement.cpp
@@ +185,5 @@
> + nsContentUtils::AppendNativeAnonymousChildren(
> + parent, rootElementNAC, nsIContent::eSkipDocumentLevelNativeAnonymousContent);
> + bool isDocLevelNAC = !rootElementNAC.Contains(this);
> +
> +#ifdef DEBUG
nit: I'd maybe introduce a block here, to avoid accidentally using variables defined only in debug mode if someone is touching this code, but not a big deal either way.
Attachment #8913889 -
Flags: review?(emilio) → review+
Comment 11•7 years ago
|
||
Pushed by bholley@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/e939fa11b68c
Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. r=emilio
https://hg.mozilla.org/integration/autoland/rev/555a9dafe460
Crashtest. r=me
Comment 12•7 years ago
|
||
Backed out in https://hg.mozilla.org/integration/autoland/rev/f90790f7a346 for debug build bustage, https://treeherder.mozilla.org/logviewer.html#?job_id=134237211&repo=autoland
Assignee | ||
Comment 13•7 years ago
|
||
Whoops, forgot to commit the changes in my tree before cherry-picking them to autoland.
Comment 14•7 years ago
|
||
Pushed by bholley@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/e6663f10c42b
Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. r=emilio
https://hg.mozilla.org/integration/autoland/rev/325ab1b04aba
Crashtest. r=me
Comment 15•7 years ago
|
||
Backed out for crashing in devtools/server/tests/browser/browser_canvasframe_helper_04.js on Windows 7 debug with non-e10s builds:
https://hg.mozilla.org/integration/autoland/rev/1340a2e8b79fd360552a7c24ba8061e9ecfb18d3
https://hg.mozilla.org/integration/autoland/rev/3a0ac72b90db6776118409bb7fd5e0a5cfc97aea
Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=325ab1b04abac56d4126bd73ec20c9827ba6f5f6&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-resultStatus=usercancel&filter-resultStatus=runnable&filter-searchStr=f539b5f127e6d7fcaed24809429b5803247288bb
Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=134250910&repo=autoland
08:04:21 INFO - 644 INFO TEST-START | devtools/server/tests/browser/browser_canvasframe_helper_04.js
08:04:21 INFO - GECKO(2112) | ++DOCSHELL 167AFC00 == 32 [pid = 2112] [id = {ded01f6e-d11b-461a-a63c-4839dc35c55f}]
08:04:21 INFO - GECKO(2112) | ++DOMWINDOW == 94 (167B0000) [pid = 2112] [serial = 155] [outer = 00000000]
08:04:21 INFO - GECKO(2112) | ++DOMWINDOW == 95 (1EF83C00) [pid = 2112] [serial = 156] [outer = 167B0000]
08:04:21 INFO - GECKO(2112) | ++DOMWINDOW == 96 (1278E800) [pid = 2112] [serial = 157] [outer = 167B0000]
08:04:21 INFO - GECKO(2112) | [2112, Main Thread] WARNING: stylo: Web Components not supported yet: file z:/build/build/src/dom/base/nsDocument.cpp, line 6419
08:04:21 INFO - GECKO(2112) | [2112, Main Thread] WARNING: stylo: Web Components not supported yet: file z:/build/build/src/dom/base/nsDocument.cpp, line 6419
08:04:21 INFO - GECKO(2112) | ++DOMWINDOW == 97 (14091400) [pid = 2112] [serial = 158] [outer = 167B0000]
08:04:21 INFO - GECKO(2112) | [2112, Main Thread] WARNING: stylo: Web Components not supported yet: file z:/build/build/src/dom/base/nsDocument.cpp, line 6419
08:04:21 INFO - GECKO(2112) | [2112, Main Thread] WARNING: stylo: Web Components not supported yet: file z:/build/build/src/dom/base/nsDocument.cpp, line 6419
08:04:21 INFO - TEST-INFO | Main app process: exit 1
08:04:21 ERROR - 645 ERROR TEST-UNEXPECTED-FAIL | ShutdownLeaks | process() called before end of test suite
08:04:21 INFO - Buffered messages logged at 08:04:21
08:04:21 INFO - 646 INFO Entering test bound
08:04:21 INFO - 647 INFO Adding a new tab with URL: data:text/html;charset=utf-8,CanvasFrameAnonymousContentHelper test 1
08:04:21 INFO - 648 INFO Tab added and URL data:text/html;charset=utf-8,CanvasFrameAnonymousContentHelper test 1 loaded
08:04:21 INFO - 649 INFO Building the helper
08:04:21 INFO - 650 INFO Get an element from the helper
08:04:21 INFO - 651 INFO Try to access the element
08:04:21 INFO - 652 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The attribute is correct before navigation -
08:04:21 INFO - 653 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The text content is correct before navigation -
08:04:21 INFO - 654 INFO Add an event listener on the element
08:04:21 INFO - 655 INFO Synthesizing an event on the element
08:04:21 INFO - 656 INFO Waiting for event: 'mousedown' on [object HTMLDocument].
08:04:21 INFO - 657 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The mousedown event was triggered on the element -
08:04:21 INFO - 658 INFO Got event: 'mousedown' on [object HTMLDocument].
08:04:21 INFO - 659 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The mousedown event was handled once before navigation -
08:04:21 INFO - 660 INFO Navigating to a new page
08:04:21 INFO - 661 INFO Try to access the element again
08:04:21 INFO - 662 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The attribute is correct after navigation -
08:04:21 INFO - 663 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The text content is correct after navigation -
08:04:21 INFO - 664 INFO Synthesizing an event on the element again
08:04:21 INFO - 665 INFO Waiting for event: 'mousedown' on [object HTMLDocument].
08:04:21 INFO - 666 INFO Got event: 'mousedown' on [object HTMLDocument].
08:04:21 INFO - Buffered messages finished
08:04:21 ERROR - 667 ERROR TEST-UNEXPECTED-FAIL | devtools/server/tests/browser/browser_canvasframe_helper_04.js | application terminated with exit code 1
08:04:21 INFO - runtests.py | Application ran for: 0:01:00.951000
08:04:21 INFO - zombiecheck | Reading PID log: c:\users\genericworker\appdata\local\temp\tmp17gbrjpidlog
08:04:21 INFO - mozcrash Copy/paste: Z:\task_1506843424\build\win32-minidump_stackwalk.exe c:\users\genericworker\appdata\local\temp\tmpbwfi4a.mozrunner\minidumps\997990f4-44ba-48b5-91e2-2f8fce58e708.dmp Z:\task_1506843424\build\symbols
08:04:39 INFO - mozcrash Saved minidump as Z:\task_1506843424\build\blobber_upload_dir\997990f4-44ba-48b5-91e2-2f8fce58e708.dmp
08:04:39 INFO - mozcrash Saved app info as Z:\task_1506843424\build\blobber_upload_dir\997990f4-44ba-48b5-91e2-2f8fce58e708.extra
08:04:40 WARNING - PROCESS-CRASH | devtools/server/tests/browser/browser_canvasframe_helper_04.js | application crashed [@ nsIPresShell::GetRootScrollFrame()]
08:04:40 INFO - Crash dump filename: c:\users\genericworker\appdata\local\temp\tmpbwfi4a.mozrunner\minidumps\997990f4-44ba-48b5-91e2-2f8fce58e708.dmp
08:04:40 INFO - Operating system: Windows NT
08:04:40 INFO - 6.1.7601 Service Pack 1
08:04:40 INFO - CPU: x86
08:04:40 INFO - GenuineIntel family 6 model 63 stepping 2
08:04:40 INFO - 8 CPUs
08:04:40 INFO - GPU: UNKNOWN
08:04:40 INFO - Crash reason: EXCEPTION_ACCESS_VIOLATION_READ
08:04:40 INFO - Crash address: 0x10
08:04:40 INFO - Process uptime: 61 seconds
08:04:40 INFO - Thread 0 (crashed)
08:04:40 INFO - 0 xul.dll!nsIPresShell::GetRootScrollFrame() [PresShell.cpp:325ab1b04aba : 2434 + 0x0]
08:04:40 INFO - eip = 0x5cb5bd8d esp = 0x0015b748 ebp = 0x0015b7b8 ebx = 0x1ee3b8f0
08:04:40 INFO - esi = 0x0f412760 edi = 0x1ee3b8e0 eax = 0x1ee3b880 ecx = 0x00000000
08:04:40 INFO - edx = 0x0015b75c efl = 0x00010246
08:04:40 INFO - Found by: given as instruction pointer in context
08:04:40 INFO - 1 xul.dll!nsIContent::GetFlattenedTreeParentNodeInternal(nsIContent::FlattenedParentType) [FragmentOrElement.cpp:325ab1b04aba : 197 + 0x22]
08:04:40 INFO - eip = 0x5ba3a023 esp = 0x0015b74c ebp = 0x0015b7b8
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 2 xul.dll!GetFlattenedTreeParentNode<1> [nsIContentInlines.h:325ab1b04aba : 99 + 0x10]
08:04:40 INFO - eip = 0x5b9b49b5 esp = 0x0015b7c0 ebp = 0x0015b7cc
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 3 xul.dll!nsINode::GetFlattenedTreeParentElementForStyle() [ElementInlines.h:325ab1b04aba : 49 + 0x6]
08:04:40 INFO - eip = 0x5b9bf381 esp = 0x0015b7d4 ebp = 0x0015b7e0
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 4 xul.dll!AssertNoBitsPropagatedFrom [Element.cpp:325ab1b04aba : 4354 + 0x7]
08:04:40 INFO - eip = 0x5ba3280c esp = 0x0015b7dc ebp = 0x0015b7e0
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 5 xul.dll!NoteDirtyElement [Element.cpp:325ab1b04aba : 4457 + 0x6]
08:04:40 INFO - eip = 0x5ba3e540 esp = 0x0015b7e8 ebp = 0x0015b804
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 6 xul.dll!mozilla::dom::Element::NoteDirtyForServo() [Element.cpp:325ab1b04aba : 4538 + 0xb]
08:04:40 INFO - eip = 0x5ba3e6eb esp = 0x0015b80c ebp = 0x0015b820
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 7 xul.dll!mozilla::ServoRestyleManager::SnapshotFor(mozilla::dom::Element *) [ServoRestyleManager.cpp:325ab1b04aba : 1055 + 0x7]
08:04:40 INFO - eip = 0x5cb718c3 esp = 0x0015b818 ebp = 0x0015b820
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 8 xul.dll!mozilla::ServoRestyleManager::ContentStateChanged(nsIContent *,mozilla::EventStates) [ServoRestyleManager.cpp:325ab1b04aba : 1251 + 0x8]
08:04:40 INFO - eip = 0x5cb51db7 esp = 0x0015b828 ebp = 0x0015b840
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 9 xul.dll!mozilla::RestyleManager::ContentStateChanged(nsIContent *,mozilla::EventStates) [RestyleManagerInlines.h:325ab1b04aba : 51 + 0x1b]
08:04:40 INFO - eip = 0x5cb51d2d esp = 0x0015b848 ebp = 0x0015b854
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 10 xul.dll!mozilla::PresShell::ContentStateChanged(nsIDocument *,nsIContent *,mozilla::EventStates) [PresShell.cpp:325ab1b04aba : 4254 + 0x1c]
08:04:40 INFO - eip = 0x5cb51cda esp = 0x0015b85c ebp = 0x0015b870
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 11 xul.dll!nsDocument::ContentStateChanged(nsIContent *,mozilla::EventStates) [nsDocument.cpp:325ab1b04aba : 5668 + 0x2f]
08:04:40 INFO - eip = 0x5baa94d7 esp = 0x0015b878 ebp = 0x0015b89c
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 12 xul.dll!mozilla::dom::Element::NotifyStateChange(mozilla::EventStates) [Element.cpp:325ab1b04aba : 247 + 0x11]
08:04:40 INFO - eip = 0x5ba3e835 esp = 0x0015b8a4 ebp = 0x0015b8c0
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 13 xul.dll!mozilla::dom::Element::RemoveStates(mozilla::EventStates) [Element.h:325ab1b04aba : 644 + 0x7]
08:04:40 INFO - eip = 0x5bafc48a esp = 0x0015b8c8 ebp = 0x0015b8dc
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 14 xul.dll!mozilla::EventStateManager::DoStateChange(mozilla::dom::Element *,mozilla::EventStates,bool) [EventStateManager.cpp:325ab1b04aba : 4875 + 0x6]
08:04:40 INFO - eip = 0x5c29946c esp = 0x0015b8e4 ebp = 0x0015b8ec
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 15 xul.dll!mozilla::EventStateManager::UpdateAncestorState(nsIContent *,nsIContent *,mozilla::EventStates,bool) [EventStateManager.cpp:325ab1b04aba : 4905 + 0x11]
08:04:40 INFO - eip = 0x5c29f8b9 esp = 0x0015b8f4 ebp = 0x0015b914
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 16 xul.dll!mozilla::EventStateManager::SetContentState(nsIContent *,mozilla::EventStates) [EventStateManager.cpp:325ab1b04aba : 5055 + 0x14]
08:04:40 INFO - eip = 0x5c29f214 esp = 0x0015b91c ebp = 0x0015b950
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 17 xul.dll!mozilla::EventStateManager::SetActiveManager(mozilla::EventStateManager *,nsIContent *) [EventStateManager.cpp:325ab1b04aba : 5414 + 0xb]
08:04:40 INFO - eip = 0x5c29ecb3 esp = 0x0015b958 ebp = 0x0015b968
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 18 xul.dll!mozilla::EventStateManager::PostHandleEvent(nsPresContext *,mozilla::WidgetEvent *,nsIFrame *,nsEventStatus *) [EventStateManager.cpp:325ab1b04aba : 3202 + 0xb]
08:04:40 INFO - eip = 0x5c29d1b7 esp = 0x0015b970 ebp = 0x0015b9ac
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 19 xul.dll!mozilla::PresShell::HandleEventInternal(mozilla::WidgetEvent *,nsEventStatus *,bool) [PresShell.cpp:325ab1b04aba : 7766 + 0x1f]
08:04:40 INFO - eip = 0x5cb5eb2c esp = 0x0015b9b4 ebp = 0x0015ba2c
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 20 xul.dll!mozilla::PresShell::HandlePositionedEvent(nsIFrame *,mozilla::WidgetGUIEvent *,nsEventStatus *) [PresShell.cpp:325ab1b04aba : 7510 + 0xf]
08:04:40 INFO - eip = 0x5cb5f4a2 esp = 0x0015ba34 ebp = 0x0015ba4c
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 21 xul.dll!mozilla::PresShell::HandleEvent(nsIFrame *,mozilla::WidgetGUIEvent *,bool,nsEventStatus *,nsIContent * *) [PresShell.cpp:325ab1b04aba : 7307 + 0x7]
08:04:40 INFO - eip = 0x5cb5e0ee esp = 0x0015ba54 ebp = 0x0015bb18
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 22 xul.dll!nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent *,nsView *,nsEventStatus *) [nsViewManager.cpp:325ab1b04aba : 812 + 0x1b]
08:04:40 INFO - eip = 0x5c931d64 esp = 0x0015bb20 ebp = 0x0015bb50
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 23 xul.dll!nsView::HandleEvent(mozilla::WidgetGUIEvent *,bool) [nsView.cpp:325ab1b04aba : 1140 + 0x15]
08:04:40 INFO - eip = 0x5c9328f6 esp = 0x0015bb58 ebp = 0x0015bb70
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 24 xul.dll!nsWindow::DispatchEvent(mozilla::WidgetGUIEvent *,nsEventStatus &) [nsWindow.cpp:325ab1b04aba : 4169 + 0x10]
08:04:40 INFO - eip = 0x5c9b3d15 esp = 0x0015bb78 ebp = 0x0015bb88
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 25 xul.dll!nsContentUtils::SendMouseEvent(nsCOMPtr<nsIPresShell> const &,nsTSubstring<char16_t> const &,float,float,int,int,int,int,bool,float,unsigned short,unsigned int,bool,bool *,bool,bool) [nsContentUtils.cpp:325ab1b04aba : 8805 + 0x1a]
08:04:40 INFO - eip = 0x5b9c9f80 esp = 0x0015bb90 ebp = 0x0015bc7c
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 26 xul.dll!nsDOMWindowUtils::SendMouseEventCommon(nsTSubstring<char16_t> const &,float,float,int,int,int,bool,float,unsigned short,unsigned int,bool,bool *,bool,bool,int) [nsDOMWindowUtils.cpp:325ab1b04aba : 756 + 0x4f]
08:04:40 INFO - eip = 0x5b9d7199 esp = 0x0015bc84 ebp = 0x0015bcc8
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 27 xul.dll!nsDOMWindowUtils::SendMouseEvent(nsTSubstring<char16_t> const &,float,float,int,int,int,bool,float,unsigned short,bool,bool,int,unsigned int,unsigned char,bool *) [nsDOMWindowUtils.cpp:325ab1b04aba : 692 + 0x7a]
08:04:40 INFO - eip = 0x5b9d7131 esp = 0x0015bcd0 ebp = 0x0015bd10
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 28 xul.dll!NS_InvokeByIndex + 0x27
08:04:40 INFO - eip = 0x5addd527 esp = 0x0015bd18 ebp = 0x0015bd94
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 29 xul.dll!CallMethodHelper::Invoke() [XPCWrappedNative.cpp:325ab1b04aba : 1996 + 0xf]
08:04:40 INFO - eip = 0x5b5449b3 esp = 0x0015bd9c ebp = 0x0015bdc8
08:04:40 INFO - Found by: previous frame's frame pointer
08:04:40 INFO - 30 xul.dll!CallMethodHelper::Call() [XPCWrappedNative.cpp:325ab1b04aba : 1315 + 0x7]
08:04:40 INFO - eip = 0x5b538a6d esp = 0x0015bdb0 ebp = 0x0015bdc8
08:04:40 INFO - Found by: call frame info with scanning
08:04:40 INFO - 31 xul.dll!XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) [XPCWrappedNative.cpp:325ab1b04aba : 1282 + 0x12]
08:04:40 INFO - eip = 0x5b538b02 esp = 0x0015bdd0 ebp = 0x0015bdc8
08:04:40 INFO - Found by: stack scanning
08:04:40 INFO - 32 xul.dll!XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) [XPCWrappedNative.cpp:325ab1b04aba : 1282 + 0x12]
08:04:40 INFO - eip = 0x5b538b02 esp = 0x0015bdd8 ebp = 0x0015bea8
08:04:40 INFO - Found by: stack scanning
08:04:40 INFO - 33 xul.dll!js::HeapSlot::assertPreconditionForWriteBarrierPost(js::NativeObject *,js::HeapSlot::Kind,unsigned int,JS::Value const &) [Barrier.cpp:325ab1b04aba : 64 + 0x7]
08:04:40 INFO - eip = 0x5dc6f7fa esp = 0x0015be14 ebp = 0x0015bea8
08:04:40 INFO - Found by: stack scanning
08:04:40 INFO - 34 xul.dll!XPC_WN_CallMethod(JSContext *,unsigned int,JS::Value *) [XPCWrappedNativeJSOps.cpp:325ab1b04aba : 929 + 0xd]
08:04:40 INFO - eip = 0x5b54bc00 esp = 0x0015beb0 ebp = 0x0015bf5c
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 35 xul.dll!js::frontend::BytecodeEmitter::locationOfNameBoundInFunctionScope(JSAtom *,js::frontend::BytecodeEmitter::EmitterScope *) [BytecodeEmitter.cpp:325ab1b04aba : 2276 + 0x5]
08:04:40 INFO - eip = 0x5e0d6b01 esp = 0x0015becc ebp = 0x0015bf5c
08:04:40 INFO - Found by: stack scanning
08:04:40 INFO - 36 xul.dll!js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [jscntxtinlines.h:325ab1b04aba : 293 + 0xd]
08:04:40 INFO - eip = 0x5e1a5d34 esp = 0x0015bf64 ebp = 0x00000000
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 37 xul.dll!JS::Rooted<JSFunction *>::Rooted<JSFunction *><JSContext *,JSFunction *>(JSContext * const &,JSFunction * &&) [RootingAPI.h:325ab1b04aba : 831 + 0xc]
08:04:40 INFO - eip = 0x5b4c4fb6 esp = 0x0015bf80 ebp = 0x0015c250
08:04:40 INFO - Found by: stack scanning
08:04:40 INFO - 38 xul.dll!js::CheckZoneGroup<3>::check() [ProtectedData.cpp:325ab1b04aba : 77 + 0x5]
08:04:40 INFO - eip = 0x5dd8a7f8 esp = 0x0015bfac ebp = 0x0015c010
08:04:40 INFO - Found by: call frame info with scanning
08:04:40 INFO - 39 xul.dll!js::gc::IsCellPointerValid(void const *) [HeapAPI.h:325ab1b04aba : 414 + 0x6]
08:04:40 INFO - eip = 0x5ad5c187 esp = 0x0015bfc4 ebp = 0x0015c010
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 40 xul.dll!js::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,js::AnyInvokeArgs const &,JS::MutableHandle<JS::Value>) [Interpreter.cpp:325ab1b04aba : 559 + 0x5]
08:04:40 INFO - eip = 0x5e1a5b44 esp = 0x0015c018 ebp = 0x0015c2e4
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 41 xul.dll!js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [jscntxtinlines.h:325ab1b04aba : 293 + 0xd]
08:04:40 INFO - eip = 0x5e1a5d34 esp = 0x0015c2ec ebp = 0x0015c250
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 42 xul.dll!js::gc::IsCellPointerValid(void const *) [HeapAPI.h:325ab1b04aba : 414 + 0x6]
08:04:40 INFO - eip = 0x5ad5c187 esp = 0x0015c340 ebp = 0x0015c398
08:04:40 INFO - Found by: call frame info with scanning
08:04:40 INFO - 43 xul.dll!Interpret [Interpreter.cpp:325ab1b04aba : 3084 + 0x10]
08:04:40 INFO - eip = 0x5e1af2a6 esp = 0x0015c3a0 ebp = 0x0015c9c8
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 44 xul.dll!js::SetNewObjectMetadata<js::NativeObject> [jsobjinlines.h:325ab1b04aba : 373 + 0x11]
08:04:40 INFO - eip = 0x5ddd4cac esp = 0x0015c438 ebp = 0x0015c9c8
08:04:40 INFO - Found by: stack scanning
08:04:40 INFO - 45 xul.dll!js::RunScript(JSContext *,js::RunState &) [Interpreter.cpp:325ab1b04aba : 435 + 0xd]
08:04:40 INFO - eip = 0x5e1b6b5c esp = 0x0015c9d0 ebp = 0x0015c468
08:04:40 INFO - Found by: call frame info
08:04:40 INFO - 46 xul.dll!mozilla::CycleCollectedJSContext::InitializeNonPrimary(mozilla::CycleCollectedJSContext *) [CycleCollectedJSContext.cpp:325ab1b04aba : 166 + 0x5]
08:04:40 INFO - eip = 0x5ad5c100 esp = 0x0015cac4 ebp = 0x0015ca88
08:04:40 INFO - Found by: call frame info with scanning
Flags: needinfo?(bobbyholley)
Assignee | ||
Comment 16•7 years ago
|
||
Need a null check in the assertion:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=a458bf175926212971506d93d492ac9be5760af1
Comment 17•7 years ago
|
||
Pushed by bholley@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a7053520bcdc
Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. r=emilio
https://hg.mozilla.org/integration/autoland/rev/369b409b1129
Crashtest. r=me
Assignee | ||
Updated•7 years ago
|
Flags: needinfo?(bobbyholley)
Comment 18•7 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/a7053520bcdc
https://hg.mozilla.org/mozilla-central/rev/369b409b1129
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox58:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
Assignee | ||
Comment 19•7 years ago
|
||
Approval Request Comment
[Feature/Bug causing the regression]: Stylo
[User impact if declined]: Potential crashes or rendering issues
[Is this code covered by automated tests?]: yes
[Has the fix been verified in Nightly?]: No
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: Pretty low risk.
[Why is the change risky/not risky?]: At the time this code was written, we didn't have a general utility method for finding all the NAC, and so we hand-rolled it. Later, we added more sources of NAC, and implemented the utility method for finding it all. But we forgot to update this code, and so there's a mismatch between what this code considers to be NAC and what the rest of the code considers to be NAC, which can lead to inconsistencies. This patch basically just removes a lot of code, and most of the added code is debug-only checking which gives us extra confidence we're getting it right.
[String changes made/needed]: None
Attachment #8914417 -
Flags: approval-mozilla-beta?
Updated•7 years ago
|
status-firefox56:
--- → unaffected
status-firefox57:
--- → affected
status-firefox-esr52:
--- → unaffected
Flags: in-testsuite? → in-testsuite+
Comment on attachment 8914417 [details]
revisions for uplift (same as comment 18)
Stylo related, has automated tests, Beta57+
Attachment #8914417 -
Flags: approval-mozilla-beta? → approval-mozilla-beta+
Comment 21•7 years ago
|
||
bugherder uplift |
Comment 22•7 years ago
|
||
(In reply to Bobby Holley (:bholley) (busy with Stylo) from comment #19)
> [Is this code covered by automated tests?]: yes
> [Has the fix been verified in Nightly?]: No
> [Needs manual test from QE? If yes, steps to reproduce]: No
Setting qe-verify- based on Bobby's assessment on manual testing needs and the fact that this fix has automated coverage.
Flags: qe-verify-
You need to log in
before you can comment on or make changes to this bug.
Description
•