Closed Bug 1428053 Opened 7 years ago Closed 7 years ago

Assertion failure: aContent != (*this)[i].mContent || !((*this)[i].mHint & nsChangeHint_ReconstructFrame) (Should not append a non-ReconstructFrame hint after appending a ReconstructFrame hint for the same content.), at /builds/worker/workspace/build/src/

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
59 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla59
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox57 --- unaffected
firefox58 --- unaffected
firefox59 --- fixed

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

trigger.html
1.46 KB, text/html
Details
Bug 1428053: Use Maybe<uint32_t> instead of an integer and a bool.
59 bytes, text/x-review-board-request
jessica
: review+
Details
Bug 1428053: Fix ShadowRoot::ContentAppended.
59 bytes, text/x-review-board-request
jessica
: review+
Details
Attached file trigger.html —
Testcase found while fuzzing mozilla-central rev f78a83244fbe. OS|Linux|0.0.0 Linux 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV|0x0|0 0|0|libxul.so|nsStyleChangeList::AppendChange|hg:hg.mozilla.org/mozilla-central:layout/base/nsStyleChangeList.cpp:f78a83244fbe|23|0x18 0|1|libxul.so|mozilla::ServoRestyleManager::ProcessPostTraversalForText|hg:hg.mozilla.org/mozilla-central:layout/base/ServoRestyleManager.cpp:f78a83244fbe|1014|0x17 0|2|libxul.so|mozilla::ServoRestyleManager::ProcessPostTraversal|hg:hg.mozilla.org/mozilla-central:layout/base/ServoRestyleManager.cpp:f78a83244fbe|960|0x20 0|3|libxul.so|mozilla::ServoRestyleManager::DoProcessPendingRestyles|hg:hg.mozilla.org/mozilla-central:layout/base/ServoRestyleManager.cpp:f78a83244fbe|1144|0xf 0|4|libxul.so|mozilla::PresShell::DoFlushPendingNotifications|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f78a83244fbe|4225|0x18 0|5|libxul.so|mozilla::PresShell::DoFlushPendingNotifications|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f78a83244fbe|4098|0x7 0|6|libxul.so|nsDocument::FlushPendingNotifications|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:f78a83244fbe|8230|0x8 0|7|libxul.so|nsDocLoader::DocLoaderIsEmpty|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:f78a83244fbe|704|0x16 0|8|libxul.so|nsDocLoader::OnStopRequest|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:f78a83244fbe|633|0x16 0|9|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:f78a83244fbe|629|0x1f 0|10|libxul.so|mozilla::net::nsLoadGroup::Cancel|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:f78a83244fbe|258|0x14 0|11|libxul.so|nsDocLoader::Stop|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:f78a83244fbe|247|0x1a 0|12|libxul.so|nsDocShell::Stop|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:f78a83244fbe|5775|0x8 0|13|libxul.so|nsDocShell::InternalLoad|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:f78a83244fbe|10925|0xd 0|14|libxul.so|nsDocShell::LoadHistoryEntry|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:f78a83244fbe|13089|0x7a 0|15|libxul.so|nsDocShell::Reload|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:f78a83244fbe|5657|0xe 0|16|libxul.so|mozilla::dom::Location::Reload|hg:hg.mozilla.org/mozilla-central:dom/base/Location.cpp:f78a83244fbe|871|0x5 0|17|libxul.so|mozilla::dom::LocationBinding::reload|hg:hg.mozilla.org/mozilla-central:dom/base/Location.h:f78a83244fbe|56|0x8 0|18|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:f78a83244fbe|3042|0x9 0|19|libxul.so|js::CallJSNative|hg:hg.mozilla.org/mozilla-central:js/src/jscntxtinlines.h:f78a83244fbe|291|0x6 0|20|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f78a83244fbe|473|0xf 0|21|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f78a83244fbe|522|0xd 0|22|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f78a83244fbe|528|0xf 0|23|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f78a83244fbe|423|0xb 0|24|libxul.so|js::ExecuteKernel|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f78a83244fbe|706|0x5 0|25|libxul.so|js::Execute|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f78a83244fbe|739|0x5 0|26|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:f78a83244fbe|4693|0x11 0|27|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:f78a83244fbe|4712|0x8 0|28|libxul.so|nsJSUtils::ExecutionContext::CompileAndExec|hg:hg.mozilla.org/mozilla-central:dom/base/nsJSUtils.cpp:f78a83244fbe|266|0xc 0|29|libxul.so|mozilla::dom::ScriptLoader::EvaluateScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:f78a83244fbe|2310|0x12 0|30|libxul.so|mozilla::dom::ScriptLoader::ProcessRequest|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:f78a83244fbe|1952|0xb 0|31|libxul.so|mozilla::dom::ScriptLoader::ProcessScriptElement|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:f78a83244fbe|1650|0xf 0|32|libxul.so|mozilla::dom::ScriptElement::MaybeProcessScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptElement.cpp:f78a83244fbe|147|0x13 0|33|libxul.so|nsIScriptElement::AttemptToExecute|hg:hg.mozilla.org/mozilla-central:dom/script/nsIScriptElement.h:f78a83244fbe|226|0x3 0|34|libxul.so|nsHtml5TreeOpExecutor::RunScript|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeOpExecutor.cpp:f78a83244fbe|736|0x10 0|35|libxul.so|nsHtml5TreeOpExecutor::RunFlushLoop|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeOpExecutor.cpp:f78a83244fbe|540|0x8 0|36|libxul.so|nsHtml5ExecutorFlusher::Run|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5StreamParser.cpp:f78a83244fbe|131|0x10 0|37|libxul.so|mozilla::SchedulerGroup::Runnable::Run|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:f78a83244fbe|395|0x1c 0|38|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:f78a83244fbe|1040|0x15 0|39|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:f78a83244fbe|510|0x11 0|40|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f78a83244fbe|97|0xa 0|41|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f78a83244fbe|326|0x17 0|42|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f78a83244fbe|319|0x8 0|43|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:f78a83244fbe|157|0xd 0|44|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f78a83244fbe|875|0x11 0|45|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f78a83244fbe|269|0x5 0|46|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f78a83244fbe|326|0x17 0|47|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f78a83244fbe|319|0x8 0|48|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f78a83244fbe|701|0x8 0|49|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:f78a83244fbe|63|0x14 0|50|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:f78a83244fbe|280|0x11 0|51|libc-2.23.so||||0x20830 0|52|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:f78a83244fbe|165|0x5
Flags: in-testsuite?
This is a Shadow DOM bug, somehow the slot ends up with the same node assigned twice: (rr) p mozilla::dom::HTMLSlotElement::FromContent(aElement) $15 = (mozilla::dom::HTMLSlotElement *) 0x7f0b6925f280 (rr) p $15->mAssignedNodes $16 = nsTArray<RefPtr<nsINode> > = {[(nsTextNode *) 0x7f0b59715c00], [(nsTextNode *) 0x7f0b59715c00]}
Blocks: shadowdom-initial-release
Component: CSS Parsing and Computation → DOM: Core & HTML
Whoopsies, this one is my fault.
Assignee: nobody → emilio
Comment on attachment 8939879 [details] Bug 1428053: Use Maybe<uint32_t> instead of an integer and a bool. https://reviewboard.mozilla.org/r/210190/#review216040
Attachment #8939879 - Flags: review?(jjong) → review+
Comment on attachment 8939880 [details] Bug 1428053: Fix ShadowRoot::ContentAppended. https://reviewboard.mozilla.org/r/210192/#review216046 The patch looks goot to me, however, the newly added test passes with or without the fix for me, can you confirm?
Attachment #8939880 - Flags: review?(jjong) → review+
Welp, indeed. I'll just land the crashtest.
Pushed by ecoal95@gmail.com: https://hg.mozilla.org/integration/autoland/rev/638e6870de94 Use Maybe<uint32_t> instead of an integer and a bool. r=jessica https://hg.mozilla.org/integration/autoland/rev/07467c83fe96 Fix ShadowRoot::ContentAppended. r=jessica
https://hg.mozilla.org/mozilla-central/rev/638e6870de94 https://hg.mozilla.org/mozilla-central/rev/07467c83fe96
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox59: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
status-firefox57: --- → unaffected
status-firefox58: --- → unaffected
status-firefox-esr52: --- → unaffected
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: