1419554 - Assertion failure: !node->AsElement()->HasServoData(), at /src/dom/base/nsDocument.cpp:4271

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Assertion failure: !node->AsElement()->HasServoData(), at /src/dom/base/nsDocument.cpp:4271

#0 nsDocument::DeleteShell() /src/dom/base/nsDocument.cpp:4262:19
#1 mozilla::PresShell::Destroy() /src/layout/base/PresShell.cpp:1313:16
#2 nsDocumentViewer::DestroyPresShell() /src/layout/base/nsDocumentViewer.cpp:4657:15
#3 nsDocumentViewer::Destroy() /src/layout/base/nsDocumentViewer.cpp:1765:5
#4 nsDocShell::Destroy() /src/docshell/base/nsDocShell.cpp:5981:21
#5 non-virtual thunk to nsDocShell::Destroy() /src/docshell/base/nsDocShell.cpp:5906:13
#6 nsWebBrowser::SetDocShell(nsIDocShell*) /src/toolkit/components/browser/nsWebBrowser.cpp:1711:23
#7 nsWebBrowser::InternalDestroy() /src/toolkit/components/browser/nsWebBrowser.cpp:94:3
#8 nsWebBrowser::Destroy() /src/toolkit/components/browser/nsWebBrowser.cpp:1305:3
#9 non-virtual thunk to nsWebBrowser::Destroy() /src/toolkit/components/browser/nsWebBrowser.cpp:1303:15
#10 mozilla::dom::TabChild::DestroyWindow() /src/dom/ipc/TabChild.cpp:1094:21
#11 mozilla::dom::TabChild::RecvDestroy() /src/dom/ipc/TabChild.cpp:2644:3
#12 mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /src/obj-firefox/ipc/ipdl/PBrowserChild.cpp:4626:20
#13 mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /src/obj-firefox/ipc/ipdl/PContentChild.cpp:4930:28
#14 mozilla::dom::ContentChild::OnMessageReceived(IPC::Message const&) /src/dom/ipc/ContentChild.cpp:3726:25
#15 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /src/ipc/glue/MessageChannel.cpp:2114:25
#16 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /src/ipc/glue/MessageChannel.cpp:2044:17
#17 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /src/ipc/glue/MessageChannel.cpp:1890:5
#18 mozilla::ipc::MessageChannel::MessageTask::Run() /src/ipc/glue/MessageChannel.cpp:1923:15
#19 mozilla::SchedulerGroup::Runnable::Run() /src/xpcom/threads/SchedulerGroup.cpp:396:25
#20 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14
#21 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:513:10
#22 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#23 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#24 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#25 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:159:27
#26 XRE_RunAppShell() /src/toolkit/xre/nsEmbedFunctions.cpp:877:22
#27 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:269:9
#28 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#29 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#30 XRE_InitChildProcess(int, char**, XREChildData const*) /src/toolkit/xre/nsEmbedFunctions.cpp:703:34
#31 content_process_main(mozilla::Bootstrap*, int, char**) /src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
#32 main /src/browser/app/nsBrowserApp.cpp:280:18
#33 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#34 _start (firefox+0x41e424)

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1419554: Teach the restyle root code about elements outside of the flattened tree.

The textarea is inserted under a Shadow host, with no matching insertion point,
so its flattened tree parent node is null.

We're treating this case in the restyle root code as "the parent is the
document", but that's very wrong.

Review commit: https://reviewboard.mozilla.org/r/201988/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/201988/

Comment 3

[Cameron McCormack (:heycam)]

Comment on attachment 8930882 [details]
Bug 1419554: Teach the restyle root code about elements outside of the flattened tree.

https://reviewboard.mozilla.org/r/201988/#review207634

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c009848f854e
Teach the restyle root code about elements outside of the flattened tree. r=heycam

Comment 5

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/c009848f854e