1472027 - Assertion failure: !mInStyleRefresh, at src/layout/base/RestyleManager.cpp:3114

Status: RESOLVED FIXED

(Core :: Layout, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20180628100518
SourceStamp=b429b9fb68f1a954c4a9f8dba8e845cf7f569a56

Assertion failure: !mInStyleRefresh, at src/layout/base/RestyleManager.cpp:3114

#0 mozilla::RestyleManager::ContentStateChanged(nsIContent*, mozilla::EventStates) src/layout/base/RestyleManager.cpp:3114:3
#1 mozilla::PresShell::ContentStateChanged(nsIDocument*, nsIContent*, mozilla::EventStates) src/layout/base/PresShell.cpp:4394:37
#2 nsIDocument::ContentStateChanged(nsIContent*, mozilla::EventStates) src/dom/base/nsDocument.cpp:5231:3
#3 mozilla::dom::Element::UpdateState(bool) src/dom/base/Element.cpp:267:14
#4 mozilla::dom::HTMLFormElement::UpdateValidity(bool) src/dom/html/HTMLFormElement.cpp:2083:3
#5 nsIConstraintValidation::SetValidityState(nsIConstraintValidation::ValidityStateType, bool) src/dom/html/nsIConstraintValidation.cpp:217:13
#6 mozilla::dom::HTMLTextAreaElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) src/dom/html/HTMLTextAreaElement.cpp:924:3
#7 mozilla::dom::Element::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) src/dom/base/Element.cpp:1741:17
#8 nsGenericHTMLElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) src/dom/html/nsGenericHTMLElement.cpp:427:43
#9 mozilla::dom::HTMLFormElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) src/dom/html/HTMLFormElement.cpp:290:39
#10 mozilla::dom::Element::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) src/dom/base/Element.cpp:1741:17
#11 nsSVGElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) src/dom/svg/nsSVGElement.cpp:241:35
#12 mozilla::dom::Element::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) src/dom/base/Element.cpp:1741:17
#13 nsSVGElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) src/dom/svg/nsSVGElement.cpp:241:35
#14 nsCSSFrameConstructor::GetAnonymousContent(nsIContent*, nsIFrame*, nsTArray<nsIAnonymousContentCreator::ContentInfo>&) src/layout/base/nsCSSFrameConstructor.cpp:4189:19
#15 nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*) src/layout/base/nsCSSFrameConstructor.cpp:10237:3
#16 nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) src/layout/base/nsCSSFrameConstructor.cpp:4037:9
#17 nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) src/layout/base/nsCSSFrameConstructor.cpp:6047:3
#18 nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameItems&) src/layout/base/nsCSSFrameConstructor.cpp:10115:5
#19 nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*) src/layout/base/nsCSSFrameConstructor.cpp:10308:3
#20 nsCSSFrameConstructor::ConstructFrameWithAnonymousChild(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsFrameItems&, nsContainerFrame* (*)(nsIPresShell*, mozilla::ComputedStyle*), nsContainerFrame* (*)(nsIPresShell*, mozilla::ComputedStyle*), nsICSSAnonBoxPseudo*, bool) src/layout/base/nsCSSFrameConstructor.cpp:5173:5
#21 nsCSSFrameConstructor::ConstructOuterSVG(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&) src/layout/base/nsCSSFrameConstructor.cpp:5190:10
#22 nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) src/layout/base/nsCSSFrameConstructor.cpp:3853:7
#23 nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) src/layout/base/nsCSSFrameConstructor.cpp:6047:3
#24 nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameItems&) src/layout/base/nsCSSFrameConstructor.cpp:10115:5
#25 nsCSSFrameConstructor::ContentAppended(nsIContent*, nsCSSFrameConstructor::InsertionKind) src/layout/base/nsCSSFrameConstructor.cpp:7247:3
#26 mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) src/layout/base/RestyleManager.cpp:1404:27
#27 mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) src/layout/base/RestyleManager.cpp:2997:9
#28 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4287:41
#29 nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1897:18
#30 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:301:7
#31 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:320:5
#32 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:760:5
#33 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:673:35
#34 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:574:9
#35 mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) src/layout/ipc/VsyncChild.cpp:68:16
#36 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:167:20
#37 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:1988:28
#38 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2134:25
#39 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2064:17
#40 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1910:5
#41 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1943:15
#42 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1051:14
#43 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:519:10
#44 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#45 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10
#46 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3
#47 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27
#48 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:896:22
#49 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:269:9
#50 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10
#51 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3
#52 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:722:34
#53 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30
#54 main src/browser/app/nsBrowserApp.cpp:287:18
#55 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#56 _start (firefox+0x4236e4)

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Gah, <svg:use> :(fffffffffffff

Comment 2

[Emilio Cobos Álvarez (:emilio)]

s/f\+//

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Tentative fix in bug 1472169. I'll keep ni? to land the crashtest if that goes well. If that's not the right fix I'm out of ideas, except bug 1450250.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Per bug 1472169 comment 4, fixing that bug will probably not help with this one.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

(In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from comment #4)
> Per bug 1472169 comment 4, fixing that bug will probably not help with this
> one.

How not? if the fieldset is in different anonymous subtrees, we shouldn't look at it (and I think we don't).

Comment 6

[Boris Zbarsky [:bzbarsky]]

Oh, because this is specific to <use> anonymous content?

In that case it's probably OK for now, until someone adds something where validity state is affected merely by being document-connected...  And nothing prevents that, really.

I guess for now we should fix bug 1472169 and then work on bug 1450250 for the long term...

Comment 7

[Emilio Cobos Álvarez (:emilio)]

Fixed by bug 1450250.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/27d7219730e3
Crashtest. r=emilio

Comment 10

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/27d7219730e3