1428080 - thread '<unnamed>' panicked at 'assertion failed: `(left == right)`

Status: RESOLVED DUPLICATE of bug 1427789

(Core :: CSS Parsing and Computation, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev f78a83244fbe.  Testcase requires the fuzzpriv extension which can be found at:
https://github.com/MozillaSecurity/fuzzpriv

thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
  left: `0`,
 right: `7`', /builds/worker/workspace/build/src/servo/components/style/traversal.rs:584:12
stack backtrace:
   0:     0x7fe1940664f3 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::h8ed7485deb8ab958
   1:     0x7fe194060c40 - std::sys_common::backtrace::_print::h3d4f9ea58578e60f
   2:     0x7fe1940739f3 - std::panicking::default_hook::{{closure}}::h0088fe51b67c687c
   3:     0x7fe194073762 - std::panicking::default_hook::hf425c768c5ffbbad
   4:     0x7fe194073ef6 - std::panicking::rust_panic_with_hook::h25b934bb4484e9e0
   5:     0x7fe194073d84 - std::panicking::begin_panic::h59483e27e93d7bc6
   6:     0x7fe194073c89 - std::panicking::begin_panic_fmt::h5f221297e8a3dbdb
   7:     0x7fe193806ed1 - style::traversal::compute_style::ha9cb6f4766192801
   8:     0x7fe1938fcedf - <style::gecko::traversal::RecalcStyleOnly<'recalc> as style::traversal::DomTraversal<style::gecko::wrapper::GeckoElement<'le>>>::process_preorder::hbbca5940e4e2dea0
   9:     0x7fe1938964fe - style::driver::traverse_dom::hd18d92ff2c9561e7
  10:     0x7fe1938569dc - geckoservo::glue::traverse_subtree::h60192e7d0616e386
  11:     0x7fe193856eed - Servo_TraverseSubtree
  12:     0x7fe191e5ee60 - _ZN7mozilla13ServoStyleSet15StyleNewSubtreeEPNS_3dom7ElementE
  13:     0x7fe191bced9e - _ZN12nsXBLService12LoadBindingsEPN7mozilla3dom7ElementEP6nsIURIP12nsIPrincipalPP12nsXBLBindingPb
  14:     0x7fe191f7f938 - _ZN21nsCSSFrameConstructor33AddFrameConstructionItemsInternalER23nsFrameConstructorStateP10nsIContentP16nsContainerFrameP6nsAtomibP14nsStyleContextjP8nsTArrayIN26nsIAnonymousContentCreator11ContentInfoEERNS_25FrameConstructionItemListE
  15:     0x7fe191f80f76 - _ZN21nsCSSFrameConstructor27DoAddFrameConstructionItemsER23nsFrameConstructorStateP10nsIContentP14nsStyleContextbP16nsContainerFrameP8nsTArrayIN26nsIAnonymousContentCreator11ContentInfoEERNS_25FrameConstructionItemListE
  16:     0x7fe191f81012 - _ZN21nsCSSFrameConstructor25AddFrameConstructionItemsER23nsFrameConstructorStateP10nsIContentbRKNS_14InsertionPointERNS_25FrameConstructionItemListE
  17:     0x7fe191f90c6a - _ZN21nsCSSFrameConstructor15ContentAppendedEP10nsIContentS1_NS_13InsertionKindEP16TreeMatchContext
  18:     0x7fe191f35ec6 - _ZN7mozilla14RestyleManager21ProcessRestyledFramesER17nsStyleChangeList
  19:     0x7fe191f42437 - _ZN7mozilla19ServoRestyleManager24DoProcessPendingRestylesENS_19ServoTraversalFlagsE
  20:     0x7fe191f432aa - _ZN7mozilla9PresShell27DoFlushPendingNotificationsENS_14ChangesToFlushE
  21:     0x7fe191f12644 - _ZN15nsRefreshDriver4TickElN7mozilla9TimeStampE
  22:     0x7fe191f137b1 - _ZN7mozilla18RefreshDriverTimer18TickRefreshDriversElNS_9TimeStampER8nsTArrayI6RefPtrI15nsRefreshDriverEE
  23:     0x7fe191f1388a - _ZN7mozilla18RefreshDriverTimer4TickElNS_9TimeStampE
  24:     0x7fe191f13a44 - _ZN7mozilla23VsyncRefreshDriverTimer26RefreshDriverVsyncObserver17TickRefreshDriverENS_9TimeStampE
  25:     0x7fe191f13d99 - _ZN7mozilla23VsyncRefreshDriverTimer26RefreshDriverVsyncObserver26ParentProcessVsyncNotifier3RunEv
  26:     0x7fe1900d95c4 - _ZN8nsThread16ProcessNextEventEbPb.part.279
  27:     0x7fe1900da304 - _Z19NS_ProcessNextEventP9nsIThreadb
  28:     0x7fe1904a231b - _ZN7mozilla3ipc11MessagePump3RunEPN4base11MessagePump8DelegateE
  29:     0x7fe190476ac4 - _ZN11MessageLoop11RunInternalEv
  30:     0x7fe190476af0 - _ZN11MessageLoop3RunEv
  31:     0x7fe191d04166 - _ZN14nsBaseAppShell3RunEv
  32:     0x7fe192c42136 - _ZN12nsAppStartup3RunEv
  33:     0x7fe192cd9039 - _ZN7XREMain11XRE_mainRunEv
  34:     0x7fe192cd9861 - _ZN7XREMain8XRE_mainEiPPcRKN7mozilla15BootstrapConfigE
  35:     0x7fe192cd9b46 - _Z8XRE_mainiPPcRKN7mozilla15BootstrapConfigE
  36:           0x406bcc - _ZL7do_mainiPPcS0_
  37:           0x406473 - main
  38:     0x7fe1a14d982f - __libc_start_main
  39:           0x4066d0 - <unknown>

OS|Linux|0.0.0 Linux 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|firefox|mozalloc_abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:f78a83244fbe|33|0x5
0|1|firefox|abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:f78a83244fbe|80|0x5
0|2|libxul.so|panic_abort::__rust_start_panic|git:github.com/rust-lang/rust:src/libpanic_abort/lib.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|59|0x5
0|3|libxul.so|std::panicking::rust_panic|git:github.com/rust-lang/rust:src/libstd/panicking.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|608|0x9
0|4|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|593|0xd
0|5|libxul.so|std::panicking::begin_panic<alloc::string::String>|git:github.com/rust-lang/rust:src/libstd/panicking.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|538|0x12
0|6|libxul.so|std::panicking::begin_panic_fmt|git:github.com/rust-lang/rust:src/libstd/panicking.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|522|0x1c
0|7|libxul.so|style::traversal::compute_style<style::gecko::wrapper::GeckoElement>|hg:hg.mozilla.org/mozilla-central:obj-firefox/toolkit/library/gtest/rust/<panic macros>:f78a83244fbe|7|0x13
0|8|libxul.so|style::gecko::traversal::{{impl}}::process_preorder<closure>|hg:hg.mozilla.org/mozilla-central:servo/components/style/traversal.rs:f78a83244fbe|422|0x13
0|9|libxul.so|style::driver::traverse_dom<style::gecko::wrapper::GeckoElement,style::gecko::traversal::RecalcStyleOnly>|hg:hg.mozilla.org/mozilla-central:servo/components/style/driver.rs:f78a83244fbe|77|0x40
0|10|libxul.so|geckoservo::glue::traverse_subtree|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:f78a83244fbe|274|0xe
0|11|libxul.so|geckoservo::glue::Servo_TraverseSubtree|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:f78a83244fbe|341|0xe
0|12|libxul.so|mozilla::ServoStyleSet::StyleNewSubtree|hg:hg.mozilla.org/mozilla-central:layout/style/ServoStyleSet.cpp:f78a83244fbe|1015|0x8
0|13|libxul.so|nsXBLService::LoadBindings|hg:hg.mozilla.org/mozilla-central:dom/xbl/nsXBLService.cpp:f78a83244fbe|420|0x13
0|14|libxul.so|nsCSSFrameConstructor::AddFrameConstructionItemsInternal|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:f78a83244fbe|5912|0x23
0|15|libxul.so|nsCSSFrameConstructor::DoAddFrameConstructionItems|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:f78a83244fbe|5828|0x2f
0|16|libxul.so|nsCSSFrameConstructor::AddFrameConstructionItems|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:f78a83244fbe|5846|0x1e
0|17|libxul.so|nsCSSFrameConstructor::ContentAppended|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:f78a83244fbe|7675|0x45
0|18|libxul.so|mozilla::RestyleManager::ProcessRestyledFrames|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:f78a83244fbe|1408|0x11
0|19|libxul.so|mozilla::ServoRestyleManager::DoProcessPendingRestyles|hg:hg.mozilla.org/mozilla-central:layout/base/ServoRestyleManager.cpp:f78a83244fbe|1161|0xb
0|20|libxul.so|mozilla::PresShell::DoFlushPendingNotifications|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f78a83244fbe|4225|0x18
0|21|libxul.so|nsRefreshDriver::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f78a83244fbe|1891|0x5
0|22|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f78a83244fbe|306|0xf
0|23|libxul.so|mozilla::RefreshDriverTimer::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f78a83244fbe|327|0x12
0|24|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f78a83244fbe|769|0x5
0|25|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f78a83244fbe|528|0x11
0|26|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:f78a83244fbe|1040|0x15
0|27|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:f78a83244fbe|510|0x11
0|28|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f78a83244fbe|97|0xa
0|29|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f78a83244fbe|326|0x17
0|30|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f78a83244fbe|319|0x8
0|31|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:f78a83244fbe|157|0xd
0|32|libxul.so|nsAppStartup::Run|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:f78a83244fbe|288|0xe
0|33|libxul.so|XREMain::XRE_mainRun|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:f78a83244fbe|4709|0x15
0|34|libxul.so|XREMain::XRE_main|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:f78a83244fbe|4871|0x8
0|35|libxul.so|XRE_main|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:f78a83244fbe|4963|0x5
0|36|firefox|do_main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:f78a83244fbe|231|0x22
0|37|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:f78a83244fbe|304|0xd
0|38|libc-2.23.so||||0x20830
0|39|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:f78a83244fbe|165|0x5

Comment 1

[Emilio Cobos Álvarez (:emilio)]

This is effectively bug 1427789, creating a ShadowRoot in a <marquee>, and all the XBL stuff getting super confused.