Closed Bug 1449401 Opened 7 years ago Closed 5 years ago

thread '<unnamed>' panicked at 'assertion failed: inherited_styles.is_none() || ptr::eq(inherited_styles.unwrap(), &**styles.primary())', servo/ports/geckolib/glue.rs:2461:13

Categories

(Core :: CSS Parsing and Computation, defect, P3)

Product:
Core
Component:
CSS Parsing and Computation
Version:
59 Branch
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla80
Tracking Flags:
Tracking Status
firefox-esr68 --- wontfix
firefox-esr78 --- wontfix
firefox78 --- wontfix
firefox79 --- wontfix
firefox80 --- fixed

People

(Reporter: jkratzer, Assigned: emilio)

References

(Depends on 1 open bug, Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files, 1 obsolete file)

testcase.html
313 bytes, text/html
Details
Bug 1449401 - Remove moz-math-anonymous ua-only pseudo. r=#style
47 bytes, text/x-phabricator-request
Details | Review
Attached file trigger.html (obsolete) —
Testcase found while fuzzing mozilla-central rev f0d13136b358. rax = 0x0000000000000000 rdx = 0x0000000000000000 rcx = 0x00007fa75e2d52dd rbx = 0x00007fa75e5a3700 rsi = 0x00007fa75e5a4770 rdi = 0x00007fa75e5a3540 rbp = 0x00007fff5d6d9d90 rsp = 0x00007fff5d6d9d80 r8 = 0x00007fa75e5a4770 r9 = 0x00007fa75f66f740 r10 = 0x0000000000000058 r11 = 0x00007fa75e24b7a0 r12 = 0x00007fa7519adcc0 r13 = 0x000000000000001c r14 = 0x000000000000099d r15 = 0x000000000000000d rip = 0x000000000041c788 OS|Linux|0.0.0 Linux 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV|0x0|0 0|0|firefox|mozalloc_abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|33|0x5 0|1|firefox|abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|80|0x5 0|2|libxul.so|panic_abort::__rust_start_panic|git:github.com/rust-lang/rust:src/libpanic_abort/lib.rs:4d90ac38c0b61bb69470b61ea2cccea0df48d9e5|59|0x5 0|3|libxul.so|std::panicking::rust_panic|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4d90ac38c0b61bb69470b61ea2cccea0df48d9e5|608|0x9 0|4|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4d90ac38c0b61bb69470b61ea2cccea0df48d9e5|593|0xd 0|5|libxul.so|std::panicking::begin_panic<&str>|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4d90ac38c0b61bb69470b61ea2cccea0df48d9e5|538|0x12 0|6|libxul.so|geckoservo::glue::get_pseudo_style|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:f0d13136b3580182df241674cf97a3fbf1543c2a|2461|0x18 0|7|libxul.so|geckoservo::glue::Servo_ResolvePseudoStyle|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:f0d13136b3580182df241674cf97a3fbf1543c2a|2281|0x11 0|8|libxul.so|mozilla::ServoStyleSet::ResolvePseudoElementStyle|hg:hg.mozilla.org/mozilla-central:layout/style/ServoStyleSet.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|624|0x5 0|9|libxul.so|nsMathMLFrame::ResolveMathMLCharStyle|hg:hg.mozilla.org/mozilla-central:layout/style/StyleSetHandleInlines.h:f0d13136b3580182df241674cf97a3fbf1543c2a|111|0xd 0|10|libxul.so|nsMathMLmoFrame::ProcessTextData|hg:hg.mozilla.org/mozilla-central:layout/mathml/nsMathMLmoFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|185|0x17 0|11|libxul.so|nsMathMLmoFrame::MarkIntrinsicISizesDirty|hg:hg.mozilla.org/mozilla-central:layout/mathml/nsMathMLmoFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1015|0x5 0|12|libxul.so|nsLayoutUtils::MarkDescendantsDirty|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|5839|0xc 0|13|libxul.so|ReparentChildListStyle|hg:hg.mozilla.org/mozilla-central:layout/generic/nsInlineFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|308|0x10 0|14|libxul.so|nsFirstLineFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsInlineFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1094|0x15 0|15|libxul.so|nsLineLayout::ReflowFrame|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|924|0x30 0|16|libxul.so|nsBlockFrame::ReflowInlineFrame|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|4158|0x14 0|17|libxul.so|nsBlockFrame::DoReflowInlineFrames|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|3958|0x29 0|18|libxul.so|nsBlockFrame::ReflowInlineFrames|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|3835|0x41 0|19|libxul.so|nsBlockFrame::ReflowLine|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|2816|0x1a 0|20|libxul.so|nsBlockFrame::ReflowDirtyLines|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|2352|0x20 0|21|libxul.so|nsBlockFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1225|0xf 0|22|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|940|0x1a 0|23|libxul.so|nsCanvasFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|714|0x4d 0|24|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|940|0x1a 0|25|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|556|0x5 0|26|libxul.so|nsHTMLScrollFrame::ReflowContents|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|678|0x14 0|27|libxul.so|nsHTMLScrollFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1054|0x5 0|28|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|984|0x19 0|29|libxul.so|mozilla::ViewportFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|336|0x2b 0|30|libxul.so|mozilla::PresShell::DoReflow|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|8838|0x25 0|31|libxul.so|mozilla::PresShell::ProcessReflowCommands|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|9011|0xe 0|32|libxul.so|mozilla::PresShell::DoFlushPendingNotifications|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|4309|0x15 0|33|libxul.so|nsRefreshDriver::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1939|0x5 0|34|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|308|0xf 0|35|libxul.so|mozilla::RefreshDriverTimer::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|330|0x12 0|36|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|771|0x5 0|37|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|585|0xc 0|38|libxul.so|mozilla::layout::VsyncChild::RecvNotify|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|68|0x9 0|39|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived|s3:gecko-generated-sources:668ae60ab945c9f59521cbd54f26b8fa229f96b8af45937bd735d86a432f1cf35482c0014090f530c334ca11ea7389383a8632cd0e23daddc7575da11217aca5/ipc/ipdl/PVsyncChild.cpp:|156|0xf 0|40|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|2135|0x6 0|41|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|2065|0xb 0|42|libxul.so|mozilla::ipc::MessageChannel::RunMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1911|0xb 0|43|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1944|0xc 0|44|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1096|0x15 0|45|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|519|0x11 0|46|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|97|0xa 0|47|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|326|0x17 0|48|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|319|0x8 0|49|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|157|0xd 0|50|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|893|0x11 0|51|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|269|0x5 0|52|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|326|0x17 0|53|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|319|0x8 0|54|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|719|0x8 0|55|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|50|0x14 0|56|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|280|0x11 0|57|libc-2.23.so||||0x20830 0|58|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:f0d13136b3580182df241674cf97a3fbf1543c2a|164|0x5
Flags: in-testsuite?
::first-line and ruby and mathml... crazy combination...
Flags: needinfo?(emilio)
I don't have better ideas to fix this than bug 1403865 or rewriting first-line.
Depends on: 1403865
Flags: needinfo?(emilio)
Priority: -- → P3

We are seeing this much more frequently lately. Perhaps recently fixed fuzz-blockers have unblocked this?

A Pernosco session is available here: https://pernos.co/debug/rA9V4yQIHB1tzpH87Tu3aQ/index.html

status-firefox80: --- → affected
Attached file testcase.html —
Attachment #8962987 - Attachment is obsolete: true

We do not expose it nor ever style it. Just use the parent style all the
time. This avoids problematic style resolution calls during reflow.

Assignee: nobody → emilio
Status: NEW → ASSIGNED

(In reply to Tyson Smith [:tsmith] from comment #4)

We are seeing this much more frequently lately. Perhaps recently fixed fuzz-blockers have unblocked this?

A Pernosco session is available here: https://pernos.co/debug/rA9V4yQIHB1tzpH87Tu3aQ/index.html

This was still a problem, but I realized that all this code is basically useless given I hid this from content in bug 1439837. So we should be good to remove it, and MathML should become a bit faster as well, which is nice.

Pushed by ealvarez@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/6a9bd9bf5891 Remove moz-math-anonymous ua-only pseudo. r=heycam

https://hg.mozilla.org/mozilla-central/rev/6a9bd9bf5891

Status: ASSIGNED → RESOLVED
Closed: 5 years ago
status-firefox80: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla80
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: