1420533 - Assertion failure: ancestor (display: contents on the root?), at /src/layout/base/nsCSSFrameConstructor.cpp:8513

Status: RESOLVED DUPLICATE of bug 1420547

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Assertion failure: ancestor (display: contents on the root?), at /src/layout/base/nsCSSFrameConstructor.cpp:8513

#0 nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /src/layout/base/nsCSSFrameConstructor.cpp:8603:33
#1 mozilla::PresShell::ContentRemoved(nsIDocument*, nsIContent*, nsIContent*, nsIContent*) /src/layout/base/PresShell.cpp:4551:22
#2 nsNodeUtils::ContentRemoved(nsINode*, nsIContent*, nsIContent*) /src/dom/base/nsNodeUtils.cpp:221:3
#3 nsINode::doRemoveChildAt(unsigned int, bool, nsIContent*, nsAttrAndChildArray&) /src/dom/base/nsINode.cpp:1947:5
#4 mozilla::dom::FragmentOrElement::RemoveChildAt(unsigned int, bool) /src/dom/base/FragmentOrElement.cpp:1376:5
#5 nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) /src/dom/base/nsINode.cpp:2259:18
#6 mozilla::dom::NodeBinding::appendChild(JSContext*, JS::Handle<JSObject*>, nsINode*, JSJitMethodCallArgs const&) /src/obj-firefox/dom/bindings/NodeBinding.cpp:885:45
#7 mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /src/dom/bindings/BindingUtils.cpp:3040:13
#8 js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /src/js/src/jscntxtinlines.h:291:15
#9 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:473:16
#10 InternalCall(JSContext*, js::AnyInvokeArgs const&) /src/js/src/vm/Interpreter.cpp:522:12
#11 Interpret(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:3098:18
#12 js::RunScript(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:423:12
#13 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:495:15
#14 InternalCall(JSContext*, js::AnyInvokeArgs const&) /src/js/src/vm/Interpreter.cpp:522:12
#15 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /src/js/src/vm/Interpreter.cpp:541:10
#16 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /src/js/src/jsapi.cpp:3034:12
#17 mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:260:37
#18 void mozilla::dom::EventHandlerNonNull::Call<nsISupports*>(nsISupports* const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JSCompartment*) /src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:362:12
#19 mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) /src/dom/events/JSEventHandler.cpp:215:12
#20 mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /src/dom/events/EventListenerManager.cpp:1117:51
#21 mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /src/dom/events/EventListenerManager.cpp:1292:20
#22 mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:313:17
#23 mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:462:16
#24 mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /src/dom/events/EventDispatcher.cpp:826:9
#25 nsDocumentViewer::LoadComplete(nsresult) /src/layout/base/nsDocumentViewer.cpp:1064:7
#26 nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /src/docshell/base/nsDocShell.cpp:7783:21
#27 nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /src/docshell/base/nsDocShell.cpp:7581:7
#28 non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /src/docshell/base/nsDocShell.cpp:7478:13
#29 nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /src/uriloader/base/nsDocLoader.cpp:1321:3
#30 nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /src/uriloader/base/nsDocLoader.cpp:862:14
#31 nsDocLoader::DocLoaderIsEmpty(bool) /src/uriloader/base/nsDocLoader.cpp:751:9
#32 nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /src/uriloader/base/nsDocLoader.cpp:633:5
#33 non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /src/uriloader/base/nsDocLoader.cpp:489:14
#34 mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /src/netwerk/base/nsLoadGroup.cpp:629:28
#35 nsDocument::DoUnblockOnload() /src/dom/base/nsDocument.cpp:9395:18
#36 nsDocument::UnblockOnload(bool) /src/dom/base/nsDocument.cpp:9317:9
#37 nsDocument::DispatchContentLoadedEvents() /src/dom/base/nsDocument.cpp:5684:3
#38 mozilla::detail::RunnableMethodImpl<nsDocument*, void (nsDocument::*)(), true, (mozilla::RunnableKind)0>::Run() /src/obj-firefox/dist/include/nsThreadUtils.h:1192:13
#39 mozilla::SchedulerGroup::Runnable::Run() /src/xpcom/threads/SchedulerGroup.cpp:396:25
#40 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14
#41 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:513:10
#42 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#43 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#44 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#45 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:159:27
#46 XRE_RunAppShell() /src/toolkit/xre/nsEmbedFunctions.cpp:877:22
#47 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:269:9
#48 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#49 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#50 XRE_InitChildProcess(int, char**, XREChildData const*) /src/toolkit/xre/nsEmbedFunctions.cpp:703:34
#51 content_process_main(mozilla::Bootstrap*, int, char**) /src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
#52 main /src/browser/app/nsBrowserApp.cpp:280:18
#53 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#54 _start (firefox+0x41e424)

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Of course it is <marquee>... Sigh. Thanks a lot for the test-case, will take a look.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

I took a look at why this was happening and filed bug 1420547. It's not clear what to do if that doesn't progress, because otherwise we have basically no way of fixing this...

We need to reach from the display: contents to the ancestor where the pseudo lives, and that right now cannot happen in any way.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

We could try to delete individually the frame of the pseudos and the descendants of the display: contents subtree I guess...

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

This bug and the duplicate bug 1420764 are marked with only 59 affected, but there are crashes with the same signature in the duplicate for 57.

Comment 6

[Emilio Cobos Álvarez (:emilio)]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #5)
> This bug and the duplicate bug 1420764 are marked with only 59 affected, but
> there are crashes with the same signature in the duplicate for 57.

It's not clear that all the crashes are due to this. Indeed I'd be kinda surprised.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/38d0846ab899
Add crashtest. r=me

Comment 8

[Emilio Cobos Álvarez (:emilio)]

Fixed by bug 1420547.

Comment 9

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/38d0846ab899