Closed
Bug 1449401
Opened 6 years ago
Closed 4 years ago
thread '<unnamed>' panicked at 'assertion failed: inherited_styles.is_none() || ptr::eq(inherited_styles.unwrap(), &**styles.primary())', servo/ports/geckolib/glue.rs:2461:13
Categories
(Core :: CSS Parsing and Computation, defect, P3)
Tracking
()
RESOLVED
FIXED
mozilla80
People
(Reporter: jkratzer, Assigned: emilio)
References
(Depends on 1 open bug, Blocks 1 open bug)
Details
(Keywords: assertion, testcase)
Attachments
(2 files, 1 obsolete file)
Testcase found while fuzzing mozilla-central rev f0d13136b358. rax = 0x0000000000000000 rdx = 0x0000000000000000 rcx = 0x00007fa75e2d52dd rbx = 0x00007fa75e5a3700 rsi = 0x00007fa75e5a4770 rdi = 0x00007fa75e5a3540 rbp = 0x00007fff5d6d9d90 rsp = 0x00007fff5d6d9d80 r8 = 0x00007fa75e5a4770 r9 = 0x00007fa75f66f740 r10 = 0x0000000000000058 r11 = 0x00007fa75e24b7a0 r12 = 0x00007fa7519adcc0 r13 = 0x000000000000001c r14 = 0x000000000000099d r15 = 0x000000000000000d rip = 0x000000000041c788 OS|Linux|0.0.0 Linux 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV|0x0|0 0|0|firefox|mozalloc_abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|33|0x5 0|1|firefox|abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|80|0x5 0|2|libxul.so|panic_abort::__rust_start_panic|git:github.com/rust-lang/rust:src/libpanic_abort/lib.rs:4d90ac38c0b61bb69470b61ea2cccea0df48d9e5|59|0x5 0|3|libxul.so|std::panicking::rust_panic|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4d90ac38c0b61bb69470b61ea2cccea0df48d9e5|608|0x9 0|4|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4d90ac38c0b61bb69470b61ea2cccea0df48d9e5|593|0xd 0|5|libxul.so|std::panicking::begin_panic<&str>|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4d90ac38c0b61bb69470b61ea2cccea0df48d9e5|538|0x12 0|6|libxul.so|geckoservo::glue::get_pseudo_style|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:f0d13136b3580182df241674cf97a3fbf1543c2a|2461|0x18 0|7|libxul.so|geckoservo::glue::Servo_ResolvePseudoStyle|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:f0d13136b3580182df241674cf97a3fbf1543c2a|2281|0x11 0|8|libxul.so|mozilla::ServoStyleSet::ResolvePseudoElementStyle|hg:hg.mozilla.org/mozilla-central:layout/style/ServoStyleSet.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|624|0x5 0|9|libxul.so|nsMathMLFrame::ResolveMathMLCharStyle|hg:hg.mozilla.org/mozilla-central:layout/style/StyleSetHandleInlines.h:f0d13136b3580182df241674cf97a3fbf1543c2a|111|0xd 0|10|libxul.so|nsMathMLmoFrame::ProcessTextData|hg:hg.mozilla.org/mozilla-central:layout/mathml/nsMathMLmoFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|185|0x17 0|11|libxul.so|nsMathMLmoFrame::MarkIntrinsicISizesDirty|hg:hg.mozilla.org/mozilla-central:layout/mathml/nsMathMLmoFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1015|0x5 0|12|libxul.so|nsLayoutUtils::MarkDescendantsDirty|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|5839|0xc 0|13|libxul.so|ReparentChildListStyle|hg:hg.mozilla.org/mozilla-central:layout/generic/nsInlineFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|308|0x10 0|14|libxul.so|nsFirstLineFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsInlineFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1094|0x15 0|15|libxul.so|nsLineLayout::ReflowFrame|hg:hg.mozilla.org/mozilla-central:layout/generic/nsLineLayout.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|924|0x30 0|16|libxul.so|nsBlockFrame::ReflowInlineFrame|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|4158|0x14 0|17|libxul.so|nsBlockFrame::DoReflowInlineFrames|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|3958|0x29 0|18|libxul.so|nsBlockFrame::ReflowInlineFrames|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|3835|0x41 0|19|libxul.so|nsBlockFrame::ReflowLine|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|2816|0x1a 0|20|libxul.so|nsBlockFrame::ReflowDirtyLines|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|2352|0x20 0|21|libxul.so|nsBlockFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1225|0xf 0|22|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|940|0x1a 0|23|libxul.so|nsCanvasFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|714|0x4d 0|24|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|940|0x1a 0|25|libxul.so|nsHTMLScrollFrame::ReflowScrolledFrame|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|556|0x5 0|26|libxul.so|nsHTMLScrollFrame::ReflowContents|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|678|0x14 0|27|libxul.so|nsHTMLScrollFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1054|0x5 0|28|libxul.so|nsContainerFrame::ReflowChild|hg:hg.mozilla.org/mozilla-central:layout/generic/nsContainerFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|984|0x19 0|29|libxul.so|mozilla::ViewportFrame::Reflow|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|336|0x2b 0|30|libxul.so|mozilla::PresShell::DoReflow|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|8838|0x25 0|31|libxul.so|mozilla::PresShell::ProcessReflowCommands|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|9011|0xe 0|32|libxul.so|mozilla::PresShell::DoFlushPendingNotifications|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|4309|0x15 0|33|libxul.so|nsRefreshDriver::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1939|0x5 0|34|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|308|0xf 0|35|libxul.so|mozilla::RefreshDriverTimer::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|330|0x12 0|36|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|771|0x5 0|37|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|585|0xc 0|38|libxul.so|mozilla::layout::VsyncChild::RecvNotify|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|68|0x9 0|39|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived|s3:gecko-generated-sources:668ae60ab945c9f59521cbd54f26b8fa229f96b8af45937bd735d86a432f1cf35482c0014090f530c334ca11ea7389383a8632cd0e23daddc7575da11217aca5/ipc/ipdl/PVsyncChild.cpp:|156|0xf 0|40|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|2135|0x6 0|41|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|2065|0xb 0|42|libxul.so|mozilla::ipc::MessageChannel::RunMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1911|0xb 0|43|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1944|0xc 0|44|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1096|0x15 0|45|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|519|0x11 0|46|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|97|0xa 0|47|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|326|0x17 0|48|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|319|0x8 0|49|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|157|0xd 0|50|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|893|0x11 0|51|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|269|0x5 0|52|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|326|0x17 0|53|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|319|0x8 0|54|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|719|0x8 0|55|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|50|0x14 0|56|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|280|0x11 0|57|libc-2.23.so||||0x20830 0|58|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:f0d13136b3580182df241674cf97a3fbf1543c2a|164|0x5
Flags: in-testsuite?
|
||
Comment 1•6 years ago
|
||
::first-line and ruby and mathml... crazy combination...
|
Assignee | |
Updated•6 years ago
|
Flags: needinfo?(emilio)
|
|
Assignee | |
Comment 2•6 years ago
|
||
I don't have better ideas to fix this than bug 1403865 or rewriting first-line.
Depends on: 1403865
Flags: needinfo?(emilio)
|
||
Updated•6 years ago
|
Priority: -- → P3
|
||
Comment 4•4 years ago
•
|
||
We are seeing this much more frequently lately. Perhaps recently fixed fuzz-blockers have unblocked this?
A Pernosco session is available here: https://pernos.co/debug/rA9V4yQIHB1tzpH87Tu3aQ/index.html
status-firefox80:
--- → affected
|
|
||
Comment 5•4 years ago
|
||
Attachment #8962987 -
Attachment is obsolete: true
|
|
Assignee | |
Comment 6•4 years ago
|
||
We do not expose it nor ever style it. Just use the parent style all the
time. This avoids problematic style resolution calls during reflow.
|
||
Updated•4 years ago
|
Assignee: nobody → emilio
Status: NEW → ASSIGNED
|
|
Assignee | |
Comment 7•4 years ago
|
||
(In reply to Tyson Smith [:tsmith] from comment #4)
We are seeing this much more frequently lately. Perhaps recently fixed fuzz-blockers have unblocked this?
A Pernosco session is available here: https://pernos.co/debug/rA9V4yQIHB1tzpH87Tu3aQ/index.html
This was still a problem, but I realized that all this code is basically useless given I hid this from content in bug 1439837. So we should be good to remove it, and MathML should become a bit faster as well, which is nice.
Pushed by ealvarez@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/6a9bd9bf5891 Remove moz-math-anonymous ua-only pseudo. r=heycam
|
||
Comment 9•4 years ago
|
||
| bugherder | ||
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla80
|
||
Updated•4 years ago
|
status-firefox78:
--- → wontfix
status-firefox79:
--- → wontfix
status-firefox-esr68:
--- → wontfix
status-firefox-esr78:
--- → wontfix
You need to log in
before you can comment on or make changes to this bug.
Description
•