Closed Bug 1439016 Opened 2 years ago Closed 2 years ago

Tab crashes after deleting a shadow-dom element and reloading the page (debug build)

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla60
Tracking Status
firefox60 --- fixed

People

(Reporter: jdescottes, Assigned: emilio)

References

Details

Attachments

(5 files)

Attached file testcase.html
STRs:
- Build with ac_add_options --enable-debug
- set dom.webcomponents.shadowdom.enabled to true 
- load attached document
- click on button 
- reload the page (ctrl+R)

I usually get to a Tab Crashed or the page loads infinitely and Firefox crashes.

The stacktrace is:

Assertion failure: !node->AsElement()->HasServoData(), at /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:4105
#01: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x37774b2]
#02: DumpBidiLine[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x37efb66]
#03: DumpBidiLine[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x37e893f]
#04: DumpBidiLine[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x37f0a27]
#05: DumpBidiLine[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3836dff]
#06: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x37843f6]
#07: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3785f6c]
#08: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3785901]
#09: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x377dcfe]
#10: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3785ee0]
#11: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3785901]
#12: DumpBidiLine[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x37ec4d8]
#13: av1_temporal_filter_apply_sse2[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x49ed623]
#14: av1_temporal_filter_apply_sse2[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x49eb230]
#15: av1_temporal_filter_apply_sse2[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x49eefe0]
#16: DumpCompleteHeap[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0xe410cf]
#17: DumpCompleteHeap[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0xe40935]
#18: DumpCompleteHeap[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0xe3f1eb]
#19: DumpCompleteHeap[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0xe3ff08]
#20: DumpCompleteHeap[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0xe406ad]
#21: nsXPTCStubBase::Stub249()[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1d9f7e]
#22: mozilla_dump_image[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x15d0022]
#23: mozilla_dump_image[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x15c51f5]
#24: mozilla_dump_image[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x15f6bcc]
#25: thread-local wrapper routine for mozilla::SchedulerGroup::sTlsValidatingAccess[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0xec34b]
#26: thread-local wrapper routine for mozilla::SchedulerGroup::sTlsValidatingAccess[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1029d1]
#27: thread-local wrapper routine for mozilla::SchedulerGroup::sTlsValidatingAccess[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x111993]
#28: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x33c3fd1]
#29: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x343028e]
#30: __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0xa3721]
#31: __CFRunLoopDoSource0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x15d0ac]
#32: __CFRunLoopDoSources0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x86260]
#33: __CFRunLoopRun[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x856dd]
#34: CFRunLoopRunSpecific[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x84f43]
#35: RunCurrentEventLoopInMode[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x2fe26]
#36: ReceiveNextEventCommon[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x2fb96]
#37: _BlockUntilNextEventMatchingListInModeWithFilter[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x2f914]
#38: _DPSNextEvent[/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x41f5f]
#39: -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x7d7b4c]
#40: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x342f486]
#41: -[NSApplication run][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x36d6d]
#42: thread-local wrapper routine for mozilla::dom::FlushRejections::sDispatched[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3430ad3]
#43: catch_exception_raise[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4e3adc9]
#44: nsXPTCStubBase::Stub249()[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x705372]
#45: nsXPTCStubBase::Stub249()[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6b6207]
#46: catch_exception_raise[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/XUL +0x4e3a923]
#47: start[/Users/jdescottes/Development/hg/fx-team/objdir-frontend.noindex/dist/NightlyDebug.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container +0xee9]

###!!! [Parent][MessageChannel] Error: (msgtype=0x150081,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv


###!!! [Parent][MessageChannel] Error: (msgtype=0x150081,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv
Attachment #8951783 - Attachment mime type: text/plain → text/html
Thanks.

FWIW, stack traces without symbols aren't really useful.
Blocks: shadowdom-layout
No longer blocks: shadowdom-dom
Flags: needinfo?(emilio)
Well, so the element with servo data is the <div>, and it's obvious why. Will write something.
I've got two different fixes, not sure which one is the best... We'll see.
Assignee: nobody → emilio
See Also: → 1439395
Comment on attachment 8952174 [details]
Bug 1439016: Clear servo data on slot changes too.

https://reviewboard.mozilla.org/r/221410/#review227266
Attachment #8952174 - Flags: review?(bobbyholley) → review+
Comment on attachment 8952175 [details]
Bug 1439016: Assert that there's no stale servo data in shadow roots either.

https://reviewboard.mozilla.org/r/221412/#review227268
Attachment #8952175 - Flags: review?(bobbyholley) → review+
Comment on attachment 8952176 [details]
Bug 1439016: Crashtest.

https://reviewboard.mozilla.org/r/221414/#review227270

::: commit-message-877e7:3
(Diff revision 1)
> +The crashtest will crash whenever the shell is destroyed, which is annoying,
> +but...

Add this as a comment to the crashtest so that it's apparent to whoever looks at it later?

::: layout/base/crashtests/1439016.html:2
(Diff revision 1)
> +<!DOCTYPE html>
> +<host>

There's no actual HTML element called <host>, right? Assuming that's the case, could you make this <div id="host"> instead to make it clearer?
Attachment #8952176 - Flags: review?(bobbyholley) → review+
Comment on attachment 8952177 [details]
Bug 1439016: Remove dead code from Shadow DOM v0.

https://reviewboard.mozilla.org/r/221416/#review227272
Attachment #8952177 - Flags: review?(bobbyholley) → review+
Thanks for the reviews Bobby!
Flags: needinfo?(emilio)
Comment on attachment 8952176 [details]
Bug 1439016: Crashtest.

https://reviewboard.mozilla.org/r/221414/#review227270

> Add this as a comment to the crashtest so that it's apparent to whoever looks at it later?

Sure thing :)

> There's no actual HTML element called <host>, right? Assuming that's the case, could you make this <div id="host"> instead to make it clearer?

Yup, done.
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/577a507f9ee1
Clear servo data on slot changes too. r=bholley
https://hg.mozilla.org/integration/autoland/rev/6ec2d0d818ce
Assert that there's no stale servo data in shadow roots either. r=bholley
https://hg.mozilla.org/integration/autoland/rev/b8cd6601b753
Crashtest. r=bholley
https://hg.mozilla.org/integration/autoland/rev/84dbe2d215f7
Remove dead code from Shadow DOM v0. r=bholley
Pushed by ecoal95@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/d32d276d2917
followup: Reuse AssertNoStaleServoDataIn in CreateShell too. r=me
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.