1415353 - stylo: Assertion failure: content->GetFlattenedTreeParentNodeForStyle() == &aContent [@ mozilla::VerifyFlatTree]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Assertion failure: content->GetFlattenedTreeParentNodeForStyle() == &aContent, at /src/layout/base/ServoRestyleManager.cpp:1220

#0 mozilla::VerifyFlatTree(nsIContent const&) /builds/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:1223:1
#1 mozilla::VerifyFlatTree(nsIContent const&) /builds/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:1221:5
#2 mozilla::VerifyFlatTree(nsIContent const&) /builds/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:1221:5
#3 mozilla::ServoRestyleManager::ProcessPendingRestyles() /builds/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:1231:5
#4 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:4216:39
#5 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:1882:18
#6 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:306:7
#7 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:327:5
#8 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:769:5
#9 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:682:35
#10 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:528:20
#11 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14
#12 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:513:10
#13 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21
#14 MessageLoop::RunInternal() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
#15 MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299:3
#16 nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:158:27
#17 nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:288:30
#18 XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4675:22
#19 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4837:8
#20 XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4932:21
#21 do_main(int, char**, char**) /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:231:22
#22 main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:304:16
#23 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#24 _start (firefox+0x41ebe4)

Comment 1

[Ryan VanderMeulen [:RyanVM]]

INFO: Last good revision: 627e043ba274a983ffe9a22bdf842f76c47719ec
INFO: First bad revision: 2011b90ddb79817efddb3ac8c9feb0b6ed4b24a9
INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=627e043ba274a983ffe9a22bdf842f76c47719ec&tochange=2011b90ddb79817efddb3ac8c9feb0b6ed4b24a9

Bug 1404789, the bug that keeps on giving.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

I mean, I guess that's what I get for adding the assertion... Not that this one is my fault though, this is just NAC getting confused about the flattened tree when there's a shadow root on the parent...

Comment 3

[Emilio Cobos Álvarez (:emilio)]

I looked a bit into this. textareas have an XBL binding, and we override it with the shadow root binding, which messes up... Not sure what the best solution is yet though.

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1415353: Don't allow creating shadow roots for elements with XBL bindings.

It breaks all sorts of invariants.

Review commit: https://reviewboard.mozilla.org/r/197632/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/197632/

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8926354 [details]
Bug 1415353: Don't allow creating shadow roots for elements with XBL bindings.

https://reviewboard.mozilla.org/r/197632/#review202884

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bacc66989ae8
Don't allow creating shadow roots for elements with XBL bindings. r=smaug

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c4f23e11b58f
Crashtest. r=me

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/bacc66989ae8
https://hg.mozilla.org/mozilla-central/rev/c4f23e11b58f