1429961 - Assertion failure: IsInUncomposedDoc() || IsInShadowTree() (This will end badly!), at /src/dom/base/nsIContentInlines.h:34

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

SourceStamp=ca379fcca95b1f4a3744242ea8647004b99b3507

Assertion failure: IsInUncomposedDoc() || IsInShadowTree() (This will end badly!), at /src/dom/base/nsIContentInlines.h:34

#0 0x7f5e07fc2f21 in nsIContent::SetPrimaryFrame(nsIFrame*) /src/dom/base/nsIContentInlines.h:34:3
#1 0x7f5e0812dc27 in nsFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /src/layout/generic/nsFrame.cpp:829:15
#2 0x7f5e080f006a in nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /src/layout/generic/nsFrameList.cpp:59:12
#3 0x7f5e080f321b in nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /src/layout/generic/nsContainerFrame.cpp:223:11
#4 0x7f5e080f006a in nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /src/layout/generic/nsFrameList.cpp:59:12
#5 0x7f5e080f321b in nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /src/layout/generic/nsContainerFrame.cpp:223:11
#6 0x7f5e08008cd8 in nsIFrame::Destroy() /src/layout/generic/nsIFrame.h:687:5
#7 0x7f5e080e8336 in nsContainerFrame::RemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*) /src/layout/generic/nsContainerFrame.cpp:171:16
#8 0x7f5e07fdd7b1 in nsFrameManager::RemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*) /src/layout/base/nsFrameManager.cpp:536:18
#9 0x7f5e07fdc23a in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /src/layout/base/nsCSSFrameConstructor.cpp:8675:5
#10 0x7f5e07f4c6ed in mozilla::PresShell::ContentRemoved(nsIDocument*, nsIContent*, nsIContent*, nsIContent*) /src/layout/base/PresShell.cpp:4540:22
#11 0x7f5e047249b8 in nsNodeUtils::ContentRemoved(nsINode*, nsIContent*, nsIContent*) /src/dom/base/nsNodeUtils.cpp:252:3
#12 0x7f5e046d5e35 in nsINode::doRemoveChildAt(unsigned int, bool, nsIContent*, nsAttrAndChildArray&) /src/dom/base/nsINode.cpp:1951:5
#13 0x7f5e044a8afd in mozilla::dom::FragmentOrElement::RemoveChildAt_Deprecated(unsigned int, bool) /src/dom/base/FragmentOrElement.cpp:1168:5
#14 0x7f5e046d6bd0 in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) /src/dom/base/nsINode.cpp:2263:18
#15 0x7f5e04c32954 in mozilla::dom::NodeBinding::appendChild(JSContext*, JS::Handle<JSObject*>, nsINode*, JSJitMethodCallArgs const&) /src/obj-firefox/dom/bindings/NodeBinding.cpp:898:45
#16 0x7f5e05f94d0b in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /src/dom/bindings/BindingUtils.cpp:3042:13
#17 0x7f5e0b0f141f in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /src/js/src/jscntxtinlines.h:291:15
#18 0x7f5e0b0f0db1 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:473:16
#19 0x7f5e0b0f21ac in InternalCall(JSContext*, js::AnyInvokeArgs const&) /src/js/src/vm/Interpreter.cpp:522:12
#20 0x7f5e0b0e6bb0 in Interpret(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:3096:18
#21 0x7f5e0b0d1efb in js::RunScript(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:423:12
#22 0x7f5e0b0f0f78 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:495:15
#23 0x7f5e0b0f21ac in InternalCall(JSContext*, js::AnyInvokeArgs const&) /src/js/src/vm/Interpreter.cpp:522:12
#24 0x7f5e0b0f23b5 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /src/js/src/vm/Interpreter.cpp:541:10
#25 0x7f5e0ba1386d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /src/js/src/jsapi.cpp:3029:12
#26 0x7f5e05a0c741 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /src/obj-firefox/dom/bindings/EventListenerBinding.cpp:47:8
#27 0x7f5e0634c2fa in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JSCompartment*) /src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:65:12
#28 0x7f5e0634bde6 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /src/dom/events/EventListenerManager.cpp:1108:9
#29 0x7f5e0634d449 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /src/dom/events/EventListenerManager.cpp:1286:20
#30 0x7f5e0633f03b in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:343:17
#31 0x7f5e0633e6f0 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:496:16
#32 0x7f5e063403e6 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /src/dom/events/EventDispatcher.cpp:865:9
#33 0x7f5e06341639 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) /src/dom/events/EventDispatcher.cpp:932:12
#34 0x7f5e046d3349 in nsINode::DispatchEvent(nsIDOMEvent*, bool*) /src/dom/base/nsINode.cpp:1359:5
#35 0x7f5e042ea42b in nsContentUtils::DispatchEvent(nsIDocument*, nsISupports*, nsTSubstring<char16_t> const&, bool, bool, bool, bool*, bool) /src/dom/base/nsContentUtils.cpp:4533:18
#36 0x7f5e042ea1a4 in nsContentUtils::DispatchTrustedEvent(nsIDocument*, nsISupports*, nsTSubstring<char16_t> const&, bool, bool, bool*) /src/dom/base/nsContentUtils.cpp:4501:10
#37 0x7f5e04612714 in nsDocument::DispatchContentLoadedEvents() /src/dom/base/nsDocument.cpp:5506:3
#38 0x7f5e04674095 in mozilla::detail::RunnableMethodImpl<nsDocument*, void (nsDocument::*)(), true, (mozilla::RunnableKind)0>::Run() /src/obj-firefox/dist/include/nsThreadUtils.h:1192:13
#39 0x7f5e01d0a809 in mozilla::SchedulerGroup::Runnable::Run() /src/xpcom/threads/SchedulerGroup.cpp:395:25
#40 0x7f5e01d416e7 in nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1040:14
#41 0x7f5e01d64128 in NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:517:10
#42 0x7f5e0297f743 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#43 0x7f5e028c5848 in MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#44 0x7f5e028c56cc in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#45 0x7f5e07997eaa in nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:157:27
#46 0x7f5e0ae94e60 in XRE_RunAppShell() /src/toolkit/xre/nsEmbedFunctions.cpp:875:22
#47 0x7f5e02980365 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:269:9
#48 0x7f5e028c5848 in MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#49 0x7f5e028c56cc in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#50 0x7f5e0ae945be in XRE_InitChildProcess(int, char**, XREChildData const*) /src/toolkit/xre/nsEmbedFunctions.cpp:701:34
#51 0x4ef5f6 in content_process_main(mozilla::Bootstrap*, int, char**) /src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
#52 0x4ef87e in main /src/browser/app/nsBrowserApp.cpp:280:18
#53 0x7f5e2136382f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#54 0x41f3d4 in _start (firefox+0x41f3d4)

Comment 1

[Andreas Farre [:farre]]

Mozregression points to the regression range https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=4f5a502acbe831a1d17d5af06efd63c0b3081a8e&tochange=cd9f14f9ea6d4bcd175874352c402613503a86d8 which is bug 1400618.

Mats, do you have an idea of what's happening?

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1429961: Make sure to remove all the continuations with the same PostDestroyData.

If we remove the first continuation of the ::after content before the last,
before this patch unbind the generated content ASAP. Part of the generated
content (the second counter) in the test-case ends up in a continuation of that
frame.

That text node would already be unbound from the tree when destroying its
frame.

Review commit: https://reviewboard.mozilla.org/r/212922/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/212922/

Comment 3

[Mats Palmgren (inactive)]

Comment on attachment 8942671 [details]
Bug 1429961: Make sure to remove all the continuations with the same PostDestroyData.

https://reviewboard.mozilla.org/r/212922/#review218600

This looks fine, but I wonder if we should bite the bullet and destroy
the continuations in last-to-first order instead?  I think that's
desirable in general.  Perhaps share the DeleteNextInFlowChild code
somehow? the only missing piece is to optionally call FrameNeedsReflow
on each parent.

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1429961: Destroy continuations last-to-first.

Review commit: https://reviewboard.mozilla.org/r/212996/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/212996/

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1429961: Avoid copying PostDestroyData.

We don't want that to happen.

Review commit: https://reviewboard.mozilla.org/r/212998/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/212998/

Comment 6

[Mats Palmgren (inactive)]

Comment on attachment 8942738 [details]
Bug 1429961: Destroy continuations last-to-first.

https://reviewboard.mozilla.org/r/212996/#review218658

LGTM, thanks!

Comment 7

[Mats Palmgren (inactive)]

Comment on attachment 8942739 [details]
Bug 1429961: Avoid copying PostDestroyData.

https://reviewboard.mozilla.org/r/212998/#review218660

Comment 8

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 8942738 [details]
Bug 1429961: Destroy continuations last-to-first.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/212996/diff/1-2/

Comment 9

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 8942739 [details]
Bug 1429961: Avoid copying PostDestroyData.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/212998/diff/1-2/

Comment 10

[Emilio Cobos Álvarez (:emilio)]

Attachment: Patch for crashtest

Gah, autoland is closed. Will land this tomorrow.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/467cbbd4d160
Make sure to remove all the continuations with the same PostDestroyData. r=mats
https://hg.mozilla.org/integration/autoland/rev/5bceb041669b
Destroy continuations last-to-first. r=mats
https://hg.mozilla.org/integration/autoland/rev/2cb5c90e995c
Avoid copying PostDestroyData. r=mats

Comment 12

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/467cbbd4d160
https://hg.mozilla.org/mozilla-central/rev/5bceb041669b
https://hg.mozilla.org/mozilla-central/rev/2cb5c90e995c

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/39c2900483af
Crashtest. r=me

Comment 14

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/39c2900483af