Closed Bug 1488898 Opened 6 years ago Closed 3 years ago

thread '<unnamed>' panicked at 'Resolving style without current styles'

Categories

(Core :: CSS Parsing and Computation, defect, P3)

Product:
Core
Component:
CSS Parsing and Computation
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox64 --- affected
firefox65 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

testcase.html
333 bytes, text/html
Details
Attached file testcase.html — 
Testcase found while fuzzing mozilla-central rev 26990836dc5c.

Assertion: thread '<unnamed>' panicked at 'Resolving style on <html id="id76" style="" hidden=""> (0x7f6f92096b80) without current styles: ElementData { styles: ElementStyles { primary: Some(Some(StrongRuleNode { p: 0x7f6f93656740 })), pseudos: EagerPseudoStyles(None) }, damage: GeckoRestyleDamage(nsChangeHint(0)), hint: (empty), flags: (empty) }', servo/ports/geckolib/glue.rs:4449:5

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007f6fabf58840
rsi = 0x00007f6fabf598b0   rdi = 0x00007f6fabf58680
rbp = 0x00007ffe93337800   rsp = 0x00007ffe933377f0
r8 = 0x00007f6fabf598b0    r9 = 0x00007f6fad0d1740
r10 = 0x0000000000000056   r11 = 0x00007f6fabbea7e0
r12 = 0x00007f6fa1229030   r13 = 0x00007ffe93337948
r14 = 0x00007f6fab94a6e0   r15 = 0x0000000000000001
rip = 0x000000000041c22d
OS|Linux|0.0.0 Linux 4.15.0-33-generic #36-Ubuntu SMP Wed Aug 15 16:00:05 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|firefox|mozalloc_abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|35|0x5
0|1|firefox|abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|82|0x5
0|2|libxul.so|panic_abort::__rust_start_panic::abort|git:github.com/rust-lang/rust:src/libpanic_abort/lib.rs:9634041f0e8c0f3191d2867311276f19d0a42564|61|0x6
0|3|libxul.so|__rust_start_panic|git:github.com/rust-lang/rust:src/libpanic_abort/lib.rs:9634041f0e8c0f3191d2867311276f19d0a42564|56|0x6
0|4|libxul.so|rust_panic|git:github.com/rust-lang/rust:src/libstd/panicking.rs:9634041f0e8c0f3191d2867311276f19d0a42564|559|0x5
0|5|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:9634041f0e8c0f3191d2867311276f19d0a42564|531|0xb
0|6|libxul.so|std::panicking::continue_panic_fmt|git:github.com/rust-lang/rust:src/libstd/panicking.rs:9634041f0e8c0f3191d2867311276f19d0a42564|426|0x17
0|7|libxul.so|std::panicking::begin_panic_fmt|git:github.com/rust-lang/rust:src/libstd/panicking.rs:9634041f0e8c0f3191d2867311276f19d0a42564|413|0x5
0|8|libxul.so|Servo_ResolveStyle|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:26990836dc5cc3cd1b8027392b79210e71094dc3|4449|0x11
0|9|libxul.so|mozilla::ServoStyleSet::ResolveServoStyle(mozilla::dom::Element const&)|hg:hg.mozilla.org/mozilla-central:layout/style/ServoStyleSetInlines.h:26990836dc5cc3cd1b8027392b79210e71094dc3|26|0x9
0|10|libxul.so|nsLayoutUtils::StyleForScrollbar(nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|10270|0xf
0|11|libxul.so|nsNativeThemeGTK::ThemeSupportsWidget(nsPresContext*, nsIFrame*, mozilla::StyleAppearance)|hg:hg.mozilla.org/mozilla-central:widget/gtk/nsNativeThemeGTK.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|1870|0x8
0|12|libxul.so|nsIFrame::IsThemed(nsStyleDisplay const*, nsITheme::Transparency*) const|hg:hg.mozilla.org/mozilla-central:layout/generic/nsIFrame.h:26990836dc5cc3cd1b8027392b79210e71094dc3|1701|0x16
0|13|libxul.so|nsDisplayBackgroundImage::AppendBackgroundItemsToTop(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsDisplayList*, bool, mozilla::ComputedStyle*, nsRect const&, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3767|0x15
0|14|libxul.so|nsFrame::DisplayBackgroundUnconditional(nsDisplayListBuilder*, nsDisplayListSet const&, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2411|0x2d
0|15|libxul.so|nsFrame::DisplayBorderBackgroundOutline(nsDisplayListBuilder*, nsDisplayListSet const&, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2435|0xe
0|16|libxul.so|nsBoxFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/xul/nsBoxFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|1173|0xa
0|17|libxul.so|nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3080|0x16
0|18|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3746|0x15
0|19|libxul.so|mozilla::ScrollFrameHelper::AppendScrollPartsTo(nsDisplayListBuilder*, nsDisplayListSet const&, bool, bool)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3247|0x1c
0|20|libxul.so|mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3531|0x21
0|21|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3784|0x17
0|22|libxul.so|mozilla::ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|66|0x11
0|23|libxul.so|nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3080|0x16
0|24|libxul.so|nsLayoutUtils::GetFramesForArea(nsIFrame*, nsRect const&, nsTArray<nsIFrame*>&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3157|0x5
0|25|libxul.so|nsLayoutUtils::GetFrameForPoint(nsIFrame*, nsPoint, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|3118|0x1d
0|26|libxul.so|mozilla::FindFrameTargetedByInputEvent(mozilla::WidgetGUIEvent*, nsIFrame*, nsPoint const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/base/PositionedEventTargeting.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|550|0x5
0|27|libxul.so|mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|7110|0x12
0|28|libxul.so|nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:view/nsViewManager.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|812|0x20
0|29|libxul.so|nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool)|hg:hg.mozilla.org/mozilla-central:view/nsView.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|1141|0x1a
0|30|libxul.so|mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&)|hg:hg.mozilla.org/mozilla-central:widget/PuppetWidget.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|409|0x20
0|31|libxul.so|mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/apz/util/APZCCallbackHelper.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|537|0x1f
0|32|libxul.so|mozilla::dom::TabChild::HandleRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|1736|0x8
0|33|libxul.so|mozilla::dom::TabChild::RecvRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|1708|0x8
0|34|libxul.so|mozilla::dom::TabChild::RecvSynthMouseMoveEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/TabChild.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|1669|0x5
0|35|libxul.so|mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:0e43f1bff49da52b3e4b5eb0c6289f7a78d4ac499c6652613a28d157a7575447ee4464fc43f57144d6a3653eeb5963e5a2d3ba35d1c3fdb7cfb8bec0456d0519/ipc/ipdl/PBrowserChild.cpp:|3513|0x1d
0|36|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2248|0x6
0|37|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2175|0xb
0|38|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2012|0xb
0|39|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|2045|0xc
0|40|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|337|0x15
0|41|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|1161|0x15
0|42|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|519|0x11
0|43|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|125|0xd
0|44|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:26990836dc5cc3cd1b8027392b79210e71094dc3|325|0x17
0|45|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:26990836dc5cc3cd1b8027392b79210e71094dc3|318|0x8
0|46|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|158|0xd
0|47|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|944|0x11
0|48|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|269|0x5
0|49|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:26990836dc5cc3cd1b8027392b79210e71094dc3|325|0x17
0|50|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:26990836dc5cc3cd1b8027392b79210e71094dc3|318|0x8
0|51|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|770|0x8
0|52|firefox|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|50|0x14
0|53|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:26990836dc5cc3cd1b8027392b79210e71094dc3|287|0x11
0|54|libc-2.27.so||||0x21b97
0|55|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:26990836dc5cc3cd1b8027392b79210e71094dc3|164|0x5
Flags: in-testsuite?
Wow, this test-case is gold, thanks Jason!

So this is because for hit-testing we might go and do display-list building without flushing layout, which looks kinda wrong... But if we _need_ to do that, we may want to use the non-asserting version of that function (GetPrimaryComputedValues) for that...

ni? Xidorn since this is the scrollbars code which is asserting when getting the style of the document element. I guess it makes sense to hit-test with the state the user is seeing...
Flags: needinfo?(xidorn+moz)
I think it's fine to use the non-asserting version of getting computed style in nsLayoutUtils::StyleForScrollbar given that it can be invoked via hit-testing. The problem is that GetPrimaryComputedValues currently returns a strong reference which is not necessary in this case, and we probably should weaken it.
Flags: needinfo?(xidorn+moz)
Priority: -- → P3
And I cannot reproduce this on Windows, probably because the Windows widget doesn't check that in ThemeSupportsWidget...

The attached test case is no longer reproducible. This was last reported by fuzzers running m-c 20181114-b0a40093b6b7.

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: