Closed Bug 1438210 Opened 3 years ago Closed 3 years ago

thread '<unnamed>' panicked at 'Resolving style on unstyled element', src/libcore/option.rs:874:4

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla61
Tracking Flags:
Tracking Status
firefox61 --- fixed

People

(Reporter: jdescottes, Assigned: emilio)

References

Details

Attachments

(2 files)

shadowdom-delete-crash.html
614 bytes, text/html
Details
Bug 1438210: Make slot assignment sound with layout after bug 1409975. r=smaug
45 bytes, text/x-phabricator-request
smaug
: review+
Details | Review 
STRs:

- set dom.webcomponents.shadowdom.enabled to true 
- load attached document
- click on button 

The document contains a host with two slotted nodes. Clicking on the button will delete both nodes nodes. Firefox crashes when deleting the second one.

Stacktrace:

thread '<unnamed>' panicked at 'Resolving style on unstyled element', src/libcore/option.rs:874:4
stack backtrace:
   0:        0x1146f0d23 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::h3421d74c3554d1d6
   1:        0x1146ef0ce - std::panicking::default_hook::{{closure}}::h046b82ccd70886b8
   2:        0x1146eeba4 - std::panicking::default_hook::h00ff9adc172e30f9
   3:        0x1146ee606 - std::panicking::rust_panic_with_hook::hb58bab85cf8f73f4
   4:        0x1146f58e5 - std::panicking::begin_panic::hf76e4af07ba1dfa4
   5:        0x1146f5862 - std::panicking::begin_panic_fmt::hf59ff9d53a059895
   6:        0x1147003aa - core::panicking::panic_fmt::h176261287ccbcf04
   7:        0x1147055b8 - core::option::expect_failed::hda9669588576f55b
   8:        0x11424e205 - Servo_ResolveStyle
   9:        0x112432806 - _ZN7mozilla13ServoStyleSet15ResolveStyleForEPNS_3dom7ElementEPNS_17ServoStyleContextENS_19LazyComputeBehaviorE
  10:        0x1125867fa - _ZN21nsCSSFrameConstructor19ResolveStyleContextEP14nsStyleContextP10nsIContentP23nsFrameConstructorStatePN7mozilla3dom7ElementE
  11:        0x11257ae19 - _ZN21nsCSSFrameConstructor33AddFrameConstructionItemsInternalER23nsFrameConstructorStateP10nsIContentP16nsContainerFrameP6nsAtomibP14nsStyleContextjP8nsTArrayIN26nsIAnonymousContentCreator11ContentInfoEERNS_25FrameConstructionItemListE
  12:        0x112588809 - _ZN21nsCSSFrameConstructor21BuildInlineChildItemsER23nsFrameConstructorStateRNS_21FrameConstructionItemEbb
  13:        0x11257b67e - _ZN21nsCSSFrameConstructor33AddFrameConstructionItemsInternalER23nsFrameConstructorStateP10nsIContentP16nsContainerFrameP6nsAtomibP14nsStyleContextjP8nsTArrayIN26nsIAnonymousContentCreator11ContentInfoEERNS_25FrameConstructionItemListE
  14:        0x112588247 - _ZN21nsCSSFrameConstructor25AddFrameConstructionItemsER23nsFrameConstructorStateP10nsIContentbRKNS_14InsertionPointERNS_25FrameConstructionItemListE
  15:        0x11257c6de - _ZN21nsCSSFrameConstructor15ProcessChildrenER23nsFrameConstructorStateP10nsIContentP14nsStyleContextP16nsContainerFramebR12nsFrameItemsbP14PendingBindingP8nsIFrame
  16:        0x1125800fd - _ZN21nsCSSFrameConstructor14ConstructBlockER23nsFrameConstructorStateP10nsIContentP16nsContainerFrameS5_P14nsStyleContextPS5_R12nsFrameItemsP8nsIFrameP14PendingBinding
  17:        0x112582f70 - _ZN21nsCSSFrameConstructor42ConstructNonScrollableBlockWithConstructorER23nsFrameConstructorStateRNS_21FrameConstructionItemEP16nsContainerFramePK14nsStyleDisplayR12nsFrameItemsPFP12nsBlockFrameP12nsIPresShellP14nsStyleContextE
  18:        0x112586047 - _ZN21nsCSSFrameConstructor27ConstructNonScrollableBlockER23nsFrameConstructorStateRNS_21FrameConstructionItemEP16nsContainerFramePK14nsStyleDisplayR12nsFrameItems
  19:        0x112584086 - _ZN21nsCSSFrameConstructor30ConstructFrameFromItemInternalERNS_21FrameConstructionItemER23nsFrameConstructorStateP16nsContainerFrameR12nsFrameItems
  20:        0x112588b02 - _ZN21nsCSSFrameConstructor23ConstructFramesFromItemER23nsFrameConstructorStateRNS_25FrameConstructionItemList8IteratorEP16nsContainerFrameR12nsFrameItems
  21:        0x11257bfcd - _ZN21nsCSSFrameConstructor27ConstructFramesFromItemListER23nsFrameConstructorStateRNS_25FrameConstructionItemListEP16nsContainerFramebR12nsFrameItems
  22:        0x11258bd01 - _ZN21nsCSSFrameConstructor20ContentRangeInsertedEP10nsIContentS1_S1_P21nsILayoutHistoryStateNS_13InsertionKindEP16TreeMatchContext
  23:        0x112589152 - _ZN21nsCSSFrameConstructor24RecreateFramesForContentEP10nsIContentNS_13InsertionKindE
  24:        0x112545c5a - _ZN7mozilla14RestyleManager21ProcessRestyledFramesER17nsStyleChangeList
  25:        0x1125692ea - _ZN7mozilla19ServoRestyleManager24DoProcessPendingRestylesENS_19ServoTraversalFlagsE
  26:        0x1125551ef - _ZN7mozilla9PresShell27DoFlushPendingNotificationsENS_14ChangesToFlushE
  27:        0x11252d70b - _ZN15nsRefreshDriver4TickExN7mozilla9TimeStampE
  28:        0x112531982 - _ZN7mozilla18RefreshDriverTimer18TickRefreshDriversExNS_9TimeStampER8nsTArrayI6RefPtrI15nsRefreshDriverEE
  29:        0x112531798 - _ZN7mozilla18RefreshDriverTimer4TickExNS_9TimeStampE
  30:        0x1125327bf - _ZN7mozilla23VsyncRefreshDriverTimer26RefreshDriverVsyncObserver17TickRefreshDriverENS_9TimeStampE
  31:        0x1125325d8 - _ZN7mozilla23VsyncRefreshDriverTimer26RefreshDriverVsyncObserver11NotifyVsyncENS_9TimeStampE
  32:        0x1127ba51d - _ZN7mozilla6layout10VsyncChild10RecvNotifyERKNS_9TimeStampE
  33:        0x11081b78e - _ZN7mozilla6layout11PVsyncChild17OnMessageReceivedERKN3IPC7MessageE
  34:        0x11065b918 - _ZN7mozilla3ipc14MessageChannel20DispatchAsyncMessageERKN3IPC7MessageE
  35:        0x11065aa91 - _ZN7mozilla3ipc14MessageChannel15DispatchMessageEON3IPC7MessageE
  36:        0x11065b3dd - _ZN7mozilla3ipc14MessageChannel11MessageTask3RunEv
  37:        0x1101c0fd2 - _ZN8nsThread16ProcessNextEventEbPb
  38:        0x1101ca875 - _Z23NS_ProcessPendingEventsP9nsIThreadj
  39:        0x1122ae800 - _ZN14nsBaseAppShell19NativeEventCallbackEv
  40:        0x112306686 - _ZN10nsAppShell18ProcessGeckoEventsEPv
  41:     0x7fff3e35d720 - __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
  42:     0x7fff3e4170ab - __CFRunLoopDoSource0
  43:     0x7fff3e34025f - __CFRunLoopDoSources0
  44:     0x7fff3e33f6dc - __CFRunLoopRun
  45:     0x7fff3e33ef42 - CFRunLoopRunSpecific
  46:     0x7fff3d656e25 - RunCurrentEventLoopInMode
  47:     0x7fff3d656b95 - ReceiveNextEventCommon
  48:     0x7fff3d656913 - _BlockUntilNextEventMatchingListInModeWithFilter
  49:     0x7fff3b921f5e - _DPSNextEvent
  50:     0x7fff3c0b7b4b - -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
  51:        0x112305cd5 - -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
  52:     0x7fff3b916d6c - -[NSApplication run]
  53:        0x112306c45 - _ZN10nsAppShell3RunEv
  54:        0x11383e4f4 - _Z15XRE_RunAppShellv
  55:        0x1106262da - _ZN11MessageLoop3RunEv
  56:        0x11383e283 - _Z20XRE_InitChildProcessiPPcPK12XREChildData
  57:        0x10fdccee8 - main
Redirecting call to abort() to mozalloc_abort
Emilio: since you fixed my other crash report about shadow DOM (Bug 1439016), maybe you are interested in this one :) (just checked and I still repro on central)

The code of the attached page is:

> <test-component>
>   <div slot="slot1" id="el1">el1</div>
>   <div slot="slot1" id="el2">el2</div>
> </test-component>
> 
> <button onclick= "deleteNodes()">Click to remove() #el1 and #el2</button>
> 
> <script>
>   'use strict';
>   window.deleteNodes = function () {
>     document.getElementById("el1").remove();
>     document.getElementById("el2").remove();
>   }
>   customElements.define('test-component', class extends HTMLElement {
>     constructor() {
>       super();
>       let shadowRoot = this.attachShadow({mode: 'open'});
>       shadowRoot.innerHTML = '<slot name="slot1"><div>default content</div></slot>';
>     }
>   });
> </script>
>
Flags: needinfo?(emilio)
Sure, this one looks interesting. If you see more stuff like this mind filing them in the CSS parsing and computation component and / or blocking bug 1405937? Thanks!
Assignee: nobody → emilio
Blocks: shadowdom-layout
Component: DOM → CSS Parsing and Computation
Ugh, this is pretty broken :(
Flags: needinfo?(emilio)
Attachment #8958480 - Flags: review?(bugs)
Need to write a bunch of tests for everything that was broken ;_;
Comment on attachment 8958480 [details]
Bug 1438210: Make slot assignment sound with layout after bug 1409975. r=smaug

A new patch with some more documentation will be uploaded.
Attachment #8958480 - Flags: review?(bugs)
Comment on attachment 8958480 [details]
Bug 1438210: Make slot assignment sound with layout after bug 1409975. r=smaug

Added docs + tests
Attachment #8958480 - Flags: review?(bugs)
Comment on attachment 8958480 [details]
Bug 1438210: Make slot assignment sound with layout after bug 1409975. r=smaug

Olli Pettay [:smaug] has approved the revision.

https://phabricator.services.mozilla.com/D724
Attachment #8958480 - Flags: review+
Attachment #8958480 - Flags: review?(bugs)
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6b06d0446007
Make slot assignment sound with layout after bug 1409975. r=smaug
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4685e6927a0c
followup: Add a constructor to unbust builds on older toolchains. r=me
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/834986ac1667
another followup: Avoid the previous patch busting new toolchains (sigh). r=me
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c3e0367e2d90
another followup: Appease the static analysis. r=me
Created web-platform-tests PR https://github.com/w3c/web-platform-tests/pull/10039 for changes under testing/web-platform/tests
Upstream web-platform-tests status checks passed, PR will merge once commit reaches central.
You need to log in before you can comment on or make changes to this bug.