1415663 - stylo: Shadow DOM: thread '<unnamed>' panicked at 'assertion failed: `(left == right)`

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P4)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev f63559d7e6a5.

thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
  left: `0`,
 right: `7`', /builds/worker/workspace/build/src/servo/components/style/traversal.rs:666:12
stack backtrace:
   0:     0x7f2adb81bb83 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::hfc7985b08e763a82
   1:     0x7f2adb8163c4 - std::sys_common::backtrace::_print::h16a1db02a59ead63
   2:     0x7f2adb8292a3 - std::panicking::default_hook::{{closure}}::h48ecee46f2eefc30
   3:     0x7f2adb829012 - std::panicking::default_hook::hb4c92ae8d005ca44
   4:     0x7f2adb8297a6 - std::panicking::rust_panic_with_hook::h25d461655d60b1a5
   5:     0x7f2adb8295c4 - std::panicking::begin_panic::h0f6fdd9abfd7dfb9
   6:     0x7f2adb829539 - std::panicking::begin_panic_fmt::ha31e26b280c9e878
   7:     0x7f2adb89af12 - style::traversal::compute_style::hb1c18cb61e3b45ed
   8:     0x7f2adb1c5925 - <style::gecko::traversal::RecalcStyleOnly<'recalc> as style::traversal::DomTraversal<style::gecko::wrapper::GeckoElement<'le>>>::process_preorder::h8e5b82ff2bd82f37
   9:     0x7f2adb8978ee - style::driver::traverse_dom::h25345f88fe7354a4
  10:     0x7f2adb1778f2 - geckoservo::glue::traverse_subtree::h185e3a4b911f53a6
  11:     0x7f2adb177c8f - Servo_TraverseSubtree
  12:     0x7f2ad9825170 - _ZN7mozilla13ServoStyleSet16StyleNewChildrenEPNS_3dom7ElementE
  13:     0x7f2ad95605c0 - _ZN20AutoStyleNewChildrenD1Ev
  14:     0x7f2ad9579153 - _ZN12nsXBLService12LoadBindingsEP10nsIContentP6nsIURIP12nsIPrincipalPP12nsXBLBindingPb
  15:     0x7f2ad9944b20 - _ZN21nsCSSFrameConstructor33AddFrameConstructionItemsInternalER23nsFrameConstructorStateP10nsIContentP16nsContainerFrameP6nsAtomibP14nsStyleContextjP8nsTArrayIN26nsIAnonymousContentCreator11ContentInfoEERNS_25FrameConstructionItemListE
  16:     0x7f2ad99461da - _ZN21nsCSSFrameConstructor27DoAddFrameConstructionItemsER23nsFrameConstructorStateP10nsIContentP14nsStyleContextbP16nsContainerFrameP8nsTArrayIN26nsIAnonymousContentCreator11ContentInfoEERNS_25FrameConstructionItemListE
  17:     0x7f2ad9946276 - _ZN21nsCSSFrameConstructor25AddFrameConstructionItemsER23nsFrameConstructorStateP10nsIContentbRKNS_14InsertionPointERNS_25FrameConstructionItemListE
  18:     0x7f2ad9952ee5 - _ZN21nsCSSFrameConstructor20ContentRangeInsertedEP10nsIContentS1_S1_P21nsILayoutHistoryStateNS_13InsertionKindEP16TreeMatchContext
  19:     0x7f2ad99541be - _ZN21nsCSSFrameConstructor24RecreateFramesForContentEP10nsIContentNS_13InsertionKindE
  20:     0x7f2ad98fc597 - _ZN7mozilla14RestyleManager21ProcessRestyledFramesER17nsStyleChangeList
  21:     0x7f2ad9908577 - _ZN7mozilla19ServoRestyleManager24DoProcessPendingRestylesENS_19ServoTraversalFlagsE
  22:     0x7f2ad99095ec - _ZN7mozilla9PresShell27DoFlushPendingNotificationsENS_14ChangesToFlushE
  23:     0x7f2ad98d8f3d - _ZN15nsRefreshDriver4TickElN7mozilla9TimeStampE
  24:     0x7f2ad98da05b - _ZN7mozilla18RefreshDriverTimer18TickRefreshDriversElNS_9TimeStampER8nsTArrayI6RefPtrI15nsRefreshDriverEE
  25:     0x7f2ad98da134 - _ZN7mozilla18RefreshDriverTimer4TickElNS_9TimeStampE
  26:     0x7f2ad98da2ee - _ZN7mozilla23VsyncRefreshDriverTimer26RefreshDriverVsyncObserver17TickRefreshDriverENS_9TimeStampE
  27:     0x7f2ad98da643 - _ZN7mozilla23VsyncRefreshDriverTimer26RefreshDriverVsyncObserver26ParentProcessVsyncNotifier3RunEv
  28:     0x7f2ad7af66cb - _ZN8nsThread16ProcessNextEventEbPb.part.267
  29:     0x7f2ad7af7484 - _Z19NS_ProcessNextEventP9nsIThreadb
  30:     0x7f2ad7eb558b - _ZN7mozilla3ipc11MessagePump3RunEPN4base11MessagePump8DelegateE
  31:     0x7f2ad7e8a9ee - _ZN11MessageLoop11RunInternalEv
  32:     0x7f2ad7e8aa1a - _ZN11MessageLoop3RunEv
  33:     0x7f2ad96cff5e - _ZN14nsBaseAppShell3RunEv
  34:     0x7f2ada60247c - _ZN12nsAppStartup3RunEv
  35:     0x7f2ada689a23 - _ZN7XREMain11XRE_mainRunEv
  36:     0x7f2ada68a21f - _ZN7XREMain8XRE_mainEiPPcRKN7mozilla15BootstrapConfigE
  37:     0x7f2ada68a504 - _Z8XRE_mainiPPcRKN7mozilla15BootstrapConfigE
  38:           0x4073ac - _ZL7do_mainiPPcS0_
  39:           0x406c5c - main
  40:     0x7f2ae8d9682f - __libc_start_main
  41:           0x406ebc - <unknown>
Redirecting call to abort() to mozalloc_abort

Comment 1

[Xidorn Quan [:xidorn] UTC+10]

shadow dom is something we haven't supported... so I'm not sure how much we care about this...

Comment 2

[Chris Peterson [:cpeterson]]

Are the fuzzers explicitly enabling Shadow DOM? Or is the functionality exposed in Nightly, but just not supported?

Comment 3

[Ryan VanderMeulen [:RyanVM]]

This appears to have been fixed by bug 1415353. Emilio, is this testcase worth landing still or is the crashtest from that bug good enough?

Comment 4

[Emilio Cobos Álvarez (:emilio)]

(In reply to Xidorn Quan [:xidorn] UTC-8 (less responsive Nov 5 ~ Dec 16) from comment #1)
> shadow dom is something we haven't supported... so I'm not sure how much we
> care about this...

I implemented most of the bits, so we should support it to some extent. I'm trying to find time to actively work on it too :)

(In reply to Ryan VanderMeulen [:RyanVM] from comment #3)
> This appears to have been fixed by bug 1415353. Emilio, is this testcase
> worth landing still or is the crashtest from that bug good enough?

I think it's worth landing, <marquee> is way more gross than <textarea>, I'll keep ni? to land it tomorrow, but feel free to do that if you have the time.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

I'm queueing up some other crashtests anyway. I'll get it :)

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2557e97345f3
Add crashtest. r=me

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/2557e97345f3

Comment 8

[Jason Kratzer [:jkratzer]]

(In reply to Chris Peterson [:cpeterson] from comment #2)
> Are the fuzzers explicitly enabling Shadow DOM? Or is the functionality
> exposed in Nightly, but just not supported?

We've recently enabled shadow dom in our default fuzzing prefs.  It is not, as far as I'm aware, enabled by default in nightly.