1464936 - Crash in mozilla::dom::ShadowRoot::StyleSheetApplicableStateChanged

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-94948627-4040-40d7-93aa-46e680180528.
=============================================================

Seen while looking at nightly crash stats: https://bit.ly/2sdfA0k. All seem to have MOZ_RELEASE_ASSERT(index >= 0). Crashes started using 20180528100448.

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6b9076ac236cb0f9f301bc601eac03f9ec4205df&tochange=a466172aed4bc2afc21169b749b8068a4b98c93f. Looks as if Shadow DOM landed during that timeframe - Bug 1460069.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::ShadowRoot::StyleSheetApplicableStateChanged dom/base/ShadowRoot.cpp:400
1 xul.dll mozilla::StyleSheet::SetComplete layout/style/StyleSheet.cpp:248
2 xul.dll mozilla::css::Loader::DoSheetComplete layout/style/Loader.cpp:1781
3 xul.dll mozilla::css::Loader::SheetComplete layout/style/Loader.cpp:1709
4 xul.dll static void <lambda_0db49724c66295b7e2c98b5ac318dcd2>::operator layout/style/Loader.cpp:1678
5 xul.dll void mozilla::MozPromise<bool, bool, 1>::ThenValue<<lambda_0db49724c66295b7e2c98b5ac318dcd2>, <lambda_3e8034714f8fb4524838768933f1f0f7> >::DoResolveOrRejectInternal xpcom/threads/MozPromise.h:765
6 xul.dll mozilla::MozPromise<bool, nsresult, 0>::ThenValueBase::DoResolveOrReject xpcom/threads/MozPromise.h:497
7 xul.dll mozilla::MozPromise<bool, bool, 1>::ThenValueBase::ResolveOrRejectRunnable::Run xpcom/threads/MozPromise.h:402
8 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:337
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1088

=============================================================

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Attachment: Testcase.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1464936: Avoid crashing with @import in Shadow DOM.

Our behavior is correct, this uses the same setup that nsDocument and the
stylesets use, which I may look into fixing up / making more explicit in
bug 1465031.

Review commit: https://reviewboard.mozilla.org/r/247506/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/247506/

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8981376 [details]
Bug 1464936: Avoid crashing with @import in Shadow DOM.

https://reviewboard.mozilla.org/r/247506/#review253474

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b796e93632f1
Avoid crashing with @import in Shadow DOM. r=smaug

Comment 5

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/11224 for changes under testing/web-platform/tests

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream web-platform-tests status checks passed, PR will merge once commit reaches central.

Comment 7

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/b796e93632f1

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged