1441221 - Assertion failure: !node->AsElement()->HasServoData(), at src/dom/base/nsDocument.cpp:3863

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found in m-c 20180224-fb85f0866cb8

Assertion failure: !node->AsElement()->HasServoData(), at src/dom/base/nsDocument.cpp:3863

#0 AssertNoStaleServoDataIn(nsINode const&) src/dom/base/nsDocument.cpp:3863:7
#1 AssertNoStaleServoDataIn(nsINode const&) src/dom/base/nsDocument.cpp:3865:9
#2 mozilla::PresShell::Destroy() src/layout/base/PresShell.cpp:1363:16
#3 nsDocumentViewer::DestroyPresShell() src/layout/base/nsDocumentViewer.cpp:4614:15
#4 nsDocumentViewer::Hide() src/layout/base/nsDocumentViewer.cpp:2264:3
#5 nsDocShell::SetVisibility(bool) src/docshell/base/nsDocShell.cpp
#6 non-virtual thunk to nsDocShell::SetVisibility(bool) src/docshell/base/nsDocShell.cpp
#7 nsFrameLoader::Hide() src/dom/base/nsFrameLoader.cpp:1062:12
#8 nsHideViewer::Run() src/layout/generic/nsSubDocumentFrame.cpp:983:21
#9 nsContentUtils::RemoveScriptBlocker() src/dom/base/nsContentUtils.cpp:5783:15
#10 nsAutoScriptBlocker::~nsAutoScriptBlocker() src/dom/base/nsContentUtils.h:3584:5
#11 nsDocumentViewer::Destroy() src/layout/base/nsDocumentViewer.cpp:1819:1
#12 nsDocShell::Destroy() src/docshell/base/nsDocShell.cpp:5532:21
#13 nsXULWindow::Destroy() src/xpfe/appshell/nsXULWindow.cpp:491:17
#14 nsWebShellWindow::Destroy() src/xpfe/appshell/nsWebShellWindow.cpp:780:23
#15 nsGlobalWindowOuter::ReallyCloseWindow() src/dom/base/nsGlobalWindowOuter.cpp:6121:27
#16 nsCloseEvent::Run() src/dom/base/nsGlobalWindowOuter.cpp:5892:16
#17 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1040:14
#18 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:517:10
#19 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#20 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10
#21 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3
#22 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:157:27
#23 nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:288:30
#24 XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4679:22
#25 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4814:8
#26 XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4906:21
#27 do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:231:22
#28 main src/browser/app/nsBrowserApp.cpp:304:16
#29 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#30 _start (firefox+0x423444)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

Comment 2

[Emilio Cobos Álvarez [:emilio]]

This relies on create a shadow root with createShadowRoot on an <input> element, so we end up messing up, since the <input> also has an XBL binding.

Tyson, could fuzzers please use attachShadow instead of createShadowRoot? Thanks!

Comment 3

[Tyson Smith [:tsmith]]

Done. :)