Closed Bug 1409183 Opened 3 years ago Closed 2 years ago

stylo: Assertion failure: !mInStyleRefresh in [@ mozilla::ServoRestyleManager::ContentStateChanged]

Categories

(Core :: CSS Parsing and Computation, defect, P3)

55 Branch
defect

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox-esr52 --- unaffected
firefox56 --- disabled
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- wontfix
firefox60 --- wontfix
firefox61 --- fixed

People

(Reporter: tsmith, Assigned: emilio)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file test_case.html
Assertion failure: !mInStyleRefresh, at /src/layout/base/ServoRestyleManager.cpp:1253

#0 mozilla::ServoRestyleManager::ContentStateChanged(nsIContent*, mozilla::EventStates) /src/layout/base/ServoRestyleManager.cpp:1253:3
#1 mozilla::PresShell::ContentStateChanged(nsIDocument*, nsIContent*, mozilla::EventStates) /src/layout/base/PresShell.cpp:4255:37
#2 nsDocument::ContentStateChanged(nsIContent*, mozilla::EventStates) /src/dom/base/nsDocument.cpp:5708:3
#3 mozilla::dom::Element::UpdateState(bool) /src/dom/base/Element.cpp:273:14
#4 mozilla::dom::HTMLInputElement::SetCheckedInternal(bool, bool) /src/dom/html/HTMLInputElement.cpp:3344:3
#5 mozilla::dom::HTMLInputElement::RadioSetChecked(bool) /src/dom/html/HTMLInputElement.cpp:3234:9
#6 mozilla::dom::HTMLInputElement::AddedToRadioGroup() /src/dom/html/HTMLInputElement.cpp:6749:5
#7 mozilla::dom::HTMLInputElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/html/HTMLInputElement.cpp:4846:5
#8 mozilla::dom::Element::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/base/Element.cpp:1710:17
#9 nsGenericHTMLElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/html/nsGenericHTMLElement.cpp:482:43
#10 mozilla::dom::Element::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/base/Element.cpp:1710:17
#11 nsSVGElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/svg/nsSVGElement.cpp:268:35
#12 mozilla::dom::SVGTitleElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/svg/SVGTitleElement.cpp:82:38
#13 mozilla::dom::Element::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/base/Element.cpp:1710:17
#14 nsSVGElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/svg/nsSVGElement.cpp:268:35
#15 mozilla::dom::SVGSVGElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/svg/SVGSVGElement.cpp:515:37
#16 nsCSSFrameConstructor::GetAnonymousContent(nsIContent*, nsIFrame*, nsTArray<nsIAnonymousContentCreator::ContentInfo>&) /src/layout/base/nsCSSFrameConstructor.cpp:4395:19
#17 nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsStyleContext*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*) /src/layout/base/nsCSSFrameConstructor.cpp:11288:3
#18 nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) /src/layout/base/nsCSSFrameConstructor.cpp:4206:9
#19 nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) /src/layout/base/nsCSSFrameConstructor.cpp:6411:3
#20 nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameItems&) /src/layout/base/nsCSSFrameConstructor.cpp:11060:5
#21 nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, nsCSSFrameConstructor::InsertionKind, TreeMatchContext*) /src/layout/base/nsCSSFrameConstructor.cpp:8434:3
#22 nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /src/layout/base/nsCSSFrameConstructor.cpp:10096:9
#23 mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /src/layout/base/RestyleManager.cpp:1513:25
#24 mozilla::ServoRestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /src/layout/base/ServoRestyleManager.cpp:1158:9
#25 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /src/layout/base/PresShell.cpp:4146:41
#26 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:1926:18
#27 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:307:7
#28 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:328:5
#29 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:770:5
#30 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:683:35
#31 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /src/layout/base/nsRefreshDriver.cpp:529:20
#32 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14
#33 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:524:10
#34 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#35 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#36 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#37 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#38 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30
#39 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4694:22
#40 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4856:8
#41 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4951:21
#42 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:231:22
#43 main /src/browser/app/nsBrowserApp.cpp:304:16
#44 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#45 _start (firefox+0x41ebe4)
Flags: in-testsuite?
Similar to bug 1404180.
Summary: Assertion failure: !mInStyleRefresh in [@ mozilla::ServoRestyleManager::ContentStateChanged] → stylo: Assertion failure: !mInStyleRefresh in [@ mozilla::ServoRestyleManager::ContentStateChanged]
Priority: -- → P3
See Also: → 1404180
Indeed, is does look similar.  This time associating with a radio group across the SVG <use> element shadow boundary.
Assignee: nobody → cam
INFO: Last good revision: aab0dfdae32f14246e3bed8824a5f7ce309276cd
INFO: First bad revision: 3e6477d932037d6026ac13bd8c988dc0a51935d4
INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=aab0dfdae32f14246e3bed8824a5f7ce309276cd&tochange=3e6477d932037d6026ac13bd8c988dc0a51935d4
Blocks: 1361766
Has Regression Range: --- → yes
Version: Trunk → 55 Branch
Assignee: cam → emilio
Attachment #8959649 - Flags: review?(bugs)
Probably we should switch <svg:use> to Shadow DOM...
Comment on attachment 8959649 [details]
Bug 1409183: Don't consider anonymous checkboxes as part of the document radio group. r=smaug

Olli Pettay [:smaug] has approved the revision.

https://phabricator.services.mozilla.com/D741
Attachment #8959649 - Flags: review+
Attachment #8959649 - Flags: review?(bugs)
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f930f3eafde5
Don't consider anonymous checkboxes as part of the document radio group. r=smaug
https://hg.mozilla.org/mozilla-central/rev/f930f3eafde5
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Emilio, should we uplift this fix to Beta 60? Or is this a fuzzing corner case that is unlikely to affect web content?
Flags: needinfo?(emilio)
I think it's very hard to hit this, you need a checkbox in an <svg:use> subtree... It can be a footgun though, so given I don't think it's very risky, and there's still time, I think we can try to uplift it, your call.

We've shipped this since forever btw, the bug blocked only added the assertion.
Flags: needinfo?(emilio)
(In reply to Emilio Cobos Álvarez [:emilio] from comment #10)
> We've shipped this since forever btw, the bug blocked only added the
> assertion.

Sounds like there's no need to rush this then.

firefox60=wontfix
You need to log in before you can comment on or make changes to this bug.