1429458 - thread '<unnamed>' panicked at '<p id=id0> (0x7f955b9620d0) has still dirty bit true or animation-only dirty bit false', /builds/worker/workspace/build/src/servo/ports/geckolib/glue.rs:3949:8

Status: RESOLVED WORKSFORME

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev d5f42a23909e.

thread '<unnamed>' panicked at '<p id=id0> (0x7f955b9620d0) has still dirty bit true or animation-only dirty bit false', /builds/worker/workspace/build/src/servo/ports/geckolib/glue.rs:3949:8
stack backtrace:
   0:     0x7f95800470f3 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::h8ed7485deb8ab958
   1:     0x7f9580041840 - std::sys_common::backtrace::_print::h3d4f9ea58578e60f
   2:     0x7f95800545f3 - std::panicking::default_hook::{{closure}}::h0088fe51b67c687c
   3:     0x7f9580054362 - std::panicking::default_hook::hf425c768c5ffbbad
   4:     0x7f9580054af6 - std::panicking::rust_panic_with_hook::h25b934bb4484e9e0
   5:     0x7f9580054984 - std::panicking::begin_panic::h59483e27e93d7bc6
   6:     0x7f9580054889 - std::panicking::begin_panic_fmt::h5f221297e8a3dbdb
   7:     0x7f957f83da6b - geckoservo::glue::Servo_AssertTreeIsClean::assert_subtree_is_clean::h1c2f41a86fc0675d
   8:     0x7f957f83d94d - geckoservo::glue::Servo_AssertTreeIsClean::assert_subtree_is_clean::h1c2f41a86fc0675d
   9:     0x7f957f83d94d - geckoservo::glue::Servo_AssertTreeIsClean::assert_subtree_is_clean::h1c2f41a86fc0675d
  10:     0x7f957f83d856 - Servo_AssertTreeIsClean
  11:     0x7f957de5070b - _ZN7mozilla13ServoStyleSet17AssertTreeIsCleanEv
  12:     0x7f957df389ec - _ZN7mozilla19ServoRestyleManager24DoProcessPendingRestylesENS_19ServoTraversalFlagsE
  13:     0x7f957df39728 - _ZN7mozilla9PresShell27DoFlushPendingNotificationsENS_14ChangesToFlushE
  14:     0x7f957df08ad0 - _ZN15nsRefreshDriver4TickElN7mozilla9TimeStampE
  15:     0x7f957df0a2fa - _ZN15nsRefreshDriver6DoTickEv
  16:     0x7f957df0893d - _ZN15nsRefreshDriver4TickElN7mozilla9TimeStampE
  17:     0x7f957df0a2fa - _ZN15nsRefreshDriver6DoTickEv
  18:     0x7f957df0a44f - _ZN15nsRefreshDriver29FinishedWaitingForTransactionEv
  19:     0x7f957cadb971 - _ZN7mozilla6layers18ClientLayerManager12DidCompositeEmRKNS_9TimeStampES4_
  20:     0x7f957cb20e7d - _ZN7mozilla6layers21CompositorBridgeChild16RecvDidCompositeERKmS3_RKNS_9TimeStampES6_
  21:     0x7f957c6e9809 - _ZN7mozilla6layers22PCompositorBridgeChild17OnMessageReceivedERKN3IPC7MessageE
  22:     0x7f957c4788e9 - _ZN7mozilla3ipc14MessageChannel20DispatchAsyncMessageERKN3IPC7MessageE
  23:     0x7f957c482647 - _ZN7mozilla3ipc14MessageChannel15DispatchMessageEON3IPC7MessageE
  24:     0x7f957c483727 - _ZN7mozilla3ipc14MessageChannel10RunMessageERNS1_11MessageTaskE
  25:     0x7f957c483797 - _ZN7mozilla3ipc14MessageChannel11MessageTask3RunEv
  26:     0x7f957c0af608 - _ZN8nsThread16ProcessNextEventEbPb.part.279
  27:     0x7f957c0b0348 - _Z19NS_ProcessNextEventP9nsIThreadb
  28:     0x7f957c479bcf - _ZN7mozilla3ipc11MessagePump3RunEPN4base11MessagePump8DelegateE
  29:     0x7f957c44e472 - _ZN11MessageLoop11RunInternalEv
  30:     0x7f957c44e49e - _ZN11MessageLoop3RunEv
  31:     0x7f957dcfaa34 - _ZN14nsBaseAppShell3RunEv
  32:     0x7f957ec3be0e - _ZN12nsAppStartup3RunEv
  33:     0x7f957ecd2c5b - _ZN7XREMain11XRE_mainRunEv
  34:     0x7f957ecd3483 - _ZN7XREMain8XRE_mainEiPPcRKN7mozilla15BootstrapConfigE
  35:     0x7f957ecd3768 - _Z8XRE_mainiPPcRKN7mozilla15BootstrapConfigE
  36:           0x406bcc - _ZL7do_mainiPPcS0_
  37:           0x406473 - main
  38:     0x7f958d47a82f - __libc_start_main
  39:           0x4066d0 - <unknown>
Redirecting call to abort() to mozalloc_abort

OS|Linux|0.0.0 Linux 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|firefox|mozalloc_abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:d5f42a23909e|33|0x5
0|1|firefox|abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:d5f42a23909e|80|0x5
0|2|libxul.so|panic_abort::__rust_start_panic|git:github.com/rust-lang/rust:src/libpanic_abort/lib.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|59|0x5
0|3|libxul.so|std::panicking::rust_panic|git:github.com/rust-lang/rust:src/libstd/panicking.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|608|0x9
0|4|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|593|0xd
0|5|libxul.so|std::panicking::begin_panic<alloc::string::String>|git:github.com/rust-lang/rust:src/libstd/panicking.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|538|0x12
0|6|libxul.so|std::panicking::begin_panic_fmt|git:github.com/rust-lang/rust:src/libstd/panicking.rs:05e2e1c41414e8fc73d0f267ea8dab1a3eeeaa99|522|0x1c
0|7|libxul.so|geckoservo::glue::Servo_AssertTreeIsClean::assert_subtree_is_clean|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:d5f42a23909e|3949|0x13
0|8|libxul.so|geckoservo::glue::Servo_AssertTreeIsClean::assert_subtree_is_clean|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:d5f42a23909e|3954|0x8
0|9|libxul.so|geckoservo::glue::Servo_AssertTreeIsClean::assert_subtree_is_clean|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:d5f42a23909e|3954|0x8
0|10|libxul.so|geckoservo::glue::Servo_AssertTreeIsClean|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:d5f42a23909e|3959|0x8
0|11|libxul.so|mozilla::ServoStyleSet::AssertTreeIsClean|hg:hg.mozilla.org/mozilla-central:layout/style/ServoStyleSet.cpp:d5f42a23909e|1107|0x8
0|12|libxul.so|mozilla::ServoRestyleManager::DoProcessPendingRestyles|hg:hg.mozilla.org/mozilla-central:layout/base/ServoRestyleManager.cpp:d5f42a23909e|1203|0xc
0|13|libxul.so|mozilla::PresShell::DoFlushPendingNotifications|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:d5f42a23909e|4215|0x18
0|14|libxul.so|nsRefreshDriver::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:d5f42a23909e|1891|0x5
0|15|libxul.so|nsRefreshDriver::DoTick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:d5f42a23909e|1484|0x1b
0|16|libxul.so|nsRefreshDriver::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:d5f42a23909e|1862|0xd
0|17|libxul.so|nsRefreshDriver::DoTick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:d5f42a23909e|1484|0x1b
0|18|libxul.so|nsRefreshDriver::FinishedWaitingForTransaction|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:d5f42a23909e|2154|0x8
0|19|libxul.so|mozilla::layers::ClientLayerManager::DidComposite|hg:hg.mozilla.org/mozilla-central:gfx/layers/client/ClientLayerManager.cpp:d5f42a23909e|526|0x18
0|20|libxul.so|mozilla::layers::CompositorBridgeChild::RecvDidComposite|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorBridgeChild.cpp:d5f42a23909e|543|0x21
0|21|libxul.so|mozilla::layers::PCompositorBridgeChild::OnMessageReceived|s3:gecko-generated-sources:5cd429a42457c8d00871ed8205be9f48de56ab63b6c6aced2ad78d0087d0eac685532879a16ac97aa549835e7450ba3d97dc6364c83a9dc63ab0a4ffe7787d84/ipc/ipdl/PCompositorBridgeChild.cpp:|1441|0x24
0|22|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:d5f42a23909e|2110|0x6
0|23|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:d5f42a23909e|2040|0xb
0|24|libxul.so|mozilla::ipc::MessageChannel::RunMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:d5f42a23909e|1886|0xb
0|25|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:d5f42a23909e|1919|0xc
0|26|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:d5f42a23909e|1040|0x15
0|27|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:d5f42a23909e|517|0x11
0|28|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:d5f42a23909e|97|0xa
0|29|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:d5f42a23909e|326|0x17
0|30|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:d5f42a23909e|319|0x8
0|31|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:d5f42a23909e|157|0xd
0|32|libxul.so|nsAppStartup::Run|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:d5f42a23909e|288|0xe
0|33|libxul.so|XREMain::XRE_mainRun|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:d5f42a23909e|4709|0x15
0|34|libxul.so|XREMain::XRE_main|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:d5f42a23909e|4871|0x8
0|35|libxul.so|XRE_main|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:d5f42a23909e|4963|0x5
0|36|firefox|do_main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:d5f42a23909e|231|0x22
0|37|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:d5f42a23909e|304|0xd
0|38|libc-2.23.so||||0x20830
0|39|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:d5f42a23909e|165|0x5

Comment 1

[Tyson Smith [:tsmith]]

The attached test case no longer reproduces the issue and this was last seen by fuzzers targeting m-c 20181114-b0a40093b6b7.