1409931 - stylo: Assertion failure: styleFrame->IsImageFrame() in [@ mozilla::ServoRestyleManager::ProcessPostTraversal]

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Assertion failure: styleFrame->IsImageFrame(), at /src/layout/base/ServoRestyleManager.cpp:787

#0 mozilla::ServoRestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoStyleContext*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) /src/layout/base/ServoRestyleManager.cpp:799:5
#1 mozilla::ServoRestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoStyleContext*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) /src/layout/base/ServoRestyleManager.cpp:952:32
#2 mozilla::ServoRestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /src/layout/base/ServoRestyleManager.cpp:1141:28
#3 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /src/layout/base/PresShell.cpp:4147:41
#4 mozilla::PresShell::DoFlushPendingNotifications(mozilla::FlushType) /src/layout/base/PresShell.cpp:4019:3
#5 mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*) /src/dom/events/EventStateManager.cpp:735:5
#6 mozilla::PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*, bool) /src/layout/base/PresShell.cpp:7718:19
#7 mozilla::PresShell::HandlePositionedEvent(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*) /src/layout/base/PresShell.cpp:7516:10
#8 mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*, nsIContent**) /src/layout/base/PresShell.cpp:7314:12
#9 nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) /src/view/nsViewManager.cpp:812:14
#10 nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) /src/view/nsView.cpp:1140:9
#11 mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) /src/widget/PuppetWidget.cpp:395:35
#12 mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&) /src/gfx/layers/apz/util/APZCCallbackHelper.cpp:498:21
#13 mozilla::dom::TabChild::RecvRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /src/dom/ipc/TabChild.cpp:1712:3
#14 mozilla::dom::TabChild::MaybeDispatchCoalescedMouseMoveEvents() /src/dom/ipc/TabChild.cpp:1608:5
#15 mozilla::dom::CoalescedMouseMoveFlusher::WillRefresh(mozilla::TimeStamp) /src/dom/ipc/CoalescedMouseData.cpp:58:14
#16 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:1887:12
#17 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:307:7
#18 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:329:5
#19 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:770:5
#20 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:683:35
#21 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:584:9
#22 mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) /src/layout/ipc/VsyncChild.cpp:67:16
#23 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:155:20
#24 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:1755:28
#25 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /src/ipc/glue/MessageChannel.cpp:2119:25
#26 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /src/ipc/glue/MessageChannel.cpp:2049:17
#27 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /src/ipc/glue/MessageChannel.cpp:1895:5
#28 mozilla::ipc::MessageChannel::MessageTask::Run() /src/ipc/glue/MessageChannel.cpp:1928:15
#29 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14
#30 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:512:10
#31 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:125:5
#32 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#33 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#34 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#35 XRE_RunAppShell() /src/toolkit/xre/nsEmbedFunctions.cpp:877:22
#36 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:269:9
#37 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#38 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#39 XRE_InitChildProcess(int, char**, XREChildData const*) /src/toolkit/xre/nsEmbedFunctions.cpp:703:34
#40 content_process_main(mozilla::Bootstrap*, int, char**) /src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
#41 main /src/browser/app/nsBrowserApp.cpp:280:18
#42 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#43 _start (firefox+0x41ebe4)

Comment 1

[Ryan VanderMeulen [:RyanVM]]

INFO: Last good revision: 11de870775c1c9b395dade9d780afb4183c43fb4
INFO: First bad revision: 15fc474cbc387b9fc8326f18e968651f242587f2
INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=11de870775c1c9b395dade9d780afb4183c43fb4&tochange=15fc474cbc387b9fc8326f18e968651f242587f2

Comment 2

[Emilio Cobos Álvarez (:emilio)]

I just need to also whitelist ImageControlFrame from that assertion... Will do that tomorrow since I don't have a build handy.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1409931: nsImageControlFrame can also be using a <map> element.

This goes with a crashtest, as soon as I get a usable build.

Review commit: https://reviewboard.mozilla.org/r/191530/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/191530/

Comment 4

[Xidorn Quan [:xidorn] UTC+11]

Comment on attachment 8920527 [details]
Bug 1409931: nsImageControlFrame can also be using a <map> element.

https://reviewboard.mozilla.org/r/191530/#review196728

::: layout/base/ServoRestyleManager.cpp:787
(Diff revision 1)
> -    MOZ_ASSERT(styleFrame->IsImageFrame());
> +    MOZ_ASSERT(styleFrame->IsImageFrame() ||
> +               styleFrame->IsImageControlFrame());

Maybe `MOZ_ASSERT(static_cast<nsImageFrame*>(do_QueryFrame(styleFrame)));` is more general than checking two specific frame type.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 8920527 [details]
Bug 1409931: nsImageControlFrame can also be using a <map> element.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/191530/diff/1-2/

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 8920527 [details]
Bug 1409931: nsImageControlFrame can also be using a <map> element.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/191530/diff/2-3/

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a497e53fb0a1
nsImageControlFrame can also be using a <map> element. r=xidorn

Comment 8

[Chris Peterson [:cpeterson]]

We don't need to uplift this fix to Beta 57 because it just fixes a debug assertion failure.

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a497e53fb0a1