Closed
Bug 1488817
Opened 6 years ago
Closed 6 years ago
Assertion failure: mOwner == ExpectedOwnerForChild(aFrame) (Missed some frame in the hierarchy?), at /builds/worker/workspace/build/src/layout/base/RestyleManager.cpp:2045
Categories
(Core :: CSS Parsing and Computation, defect, P3)
Core
CSS Parsing and Computation
Tracking
()
RESOLVED
FIXED
mozilla64
People
(Reporter: jkratzer, Assigned: emilio)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase)
Attachments
(2 files)
Testcase found while fuzzing mozilla-central rev 26990836dc5c. rax = 0x0000000000000000 rdx = 0x0000000000000000 rcx = 0x0000000000000b40 rbx = 0x00007fffcac53218 rsi = 0x00007f144067d8b0 rdi = 0x00007f144067c680 rbp = 0x00007fffcac53040 rsp = 0x00007fffcac53030 r8 = 0x00007f144067d8b0 r9 = 0x00007f14417f5740 r10 = 0x00000000ffffffc7 r11 = 0x0000000000000000 r12 = 0x00007f1426799a50 r13 = 0x00007f1426764508 r14 = 0x00007fffcac53218 r15 = 0x00007fffcac530d0 rip = 0x00007f143106fdee OS|Linux|0.0.0 Linux 4.15.0-33-generic #36-Ubuntu SMP Wed Aug 15 16:00:05 UTC 2018 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV /SEGV_MAPERR|0x0|0 0|0|libxul.so|mozilla::ServoRestyleState::ChangesHandledFor(nsIFrame const&) const|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2044|0x18 0|1|libxul.so|nsIFrame::UpdateStyleOfOwnedChildFrame(nsIFrame*, mozilla::ComputedStyle*, mozilla::ServoRestyleState&, mozilla::Maybe<mozilla::ComputedStyle*> const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|10801|0xb 0|2|libxul.so|nsBlockFrame::UpdateFirstLetterStyle(mozilla::ServoRestyleState&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|5724|0x5 0|3|libxul.so|nsBlockFrame::UpdatePseudoElementStyles(mozilla::ServoRestyleState&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|7629|0x5 0|4|libxul.so|mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ComputedStyle*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2555|0xf 0|5|libxul.so|mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ComputedStyle*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2833|0x25 0|6|libxul.so|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3040|0xf 0|7|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|4301|0x19 0|8|libxul.so|nsRefreshDriver::Tick(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|1900|0x5 0|9|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|324|0x8 0|10|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|317|0xc 0|11|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|755|0xc 0|12|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|571|0xc 0|13|libxul.so|mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&)|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|78|0x9 0|14|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:2c36fa176485b987fd1c1ce548d1f34c4c8bfdea36ff5dd016400feb13d3c5c0c7f99d5a56d13733937c9483a48617af010c09f521533a5ce0fc1f74c50b86a2/ipc/ipdl/PVsyncChild.cpp:|167|0xc 0|15|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2248|0x6 0|16|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2175|0xb 0|17|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2012|0xb 0|18|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2045|0xc 0|19|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|1161|0x15 0|20|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|519|0x11 0|21|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|125|0xd 0|22|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:26990836dc5cc3cd1b8027392b79210e71094dc3|325|0x17 0|23|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:26990836dc5cc3cd1b8027392b79210e71094dc3|318|0x8 0|24|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|158|0xd 0|25|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|944|0x11 0|26|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|269|0x5 0|27|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:26990836dc5cc3cd1b8027392b79210e71094dc3|325|0x17 0|28|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:26990836dc5cc3cd1b8027392b79210e71094dc3|318|0x8 0|29|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|770|0x8 0|30|firefox|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|50|0x14 0|31|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|287|0x11 0|32|libc-2.27.so||||0x21b97 0|33|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:26990836dc5cc3cd1b8027392b79210e71094dc3|164|0x5
Flags: in-testsuite?
Assignee | ||
Updated•6 years ago
|
Flags: needinfo?(emilio)
Assignee | ||
Comment 1•6 years ago
|
||
Always new reasons to remove the first-line frame and this reparenting stuff... I hope I can get to it.
Assignee | ||
Updated•6 years ago
|
Assignee: nobody → emilio
Flags: needinfo?(emilio)
Updated•6 years ago
|
Priority: -- → P3
Comment 2•6 years ago
|
||
Comment on attachment 9006686 [details]
Remove the has-first-letter-child bit from the block when the first-letter is removed from a first-line.
Boris Zbarsky [:bzbarsky, bz on IRC] has approved the revision.
Attachment #9006686 -
Flags: review+
Pushed by emilio@crisal.io: https://hg.mozilla.org/integration/autoland/rev/84bade5ed574 Remove the has-first-letter-child bit from the block when the first-letter is removed from a first-line. r=bzbarsky
Comment 4•6 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/84bade5ed574
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
Comment 5•6 years ago
|
||
Is there a user impact here which warrants uplift consideration or can this ride the trains?
status-firefox62:
--- → wontfix
status-firefox63:
--- → affected
status-firefox-esr60:
--- → wontfix
Flags: needinfo?(emilio)
Flags: in-testsuite?
Flags: in-testsuite+
Assignee | ||
Comment 6•6 years ago
|
||
Very unlikely... I think this can ride the trains.
Flags: needinfo?(emilio)
Updated•6 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•