1502893 - thread '<unnamed>' panicked at 'assertion failed: `(left == right)` left: `9`, right: `6`', servo/components/style/sharing/checks.rs:125:5

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev f7a97b344fa5.

[Child 31285, Main Thread] WARNING: Failed to remove transaction listener from the editor: 'removedTransactionListener', file /builds/worker/workspace/build/src/editor/composer/nsEditingSession.cpp, line 500
thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
  left: `6`,
 right: `5`', servo/components/style/sharing/checks.rs:125:5
stack backtrace:
[Parent 31133, Main Thread] WARNING: Cannot set transparency mode on non-popup windows.: file /builds/worker/workspace/build/src/widget/gtk/nsWindow.cpp, line 4573
[Parent 31133, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x804B000A: file /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIURIMutator.h, line 450
[Parent 31133, Main Thread] WARNING: NS_ENSURE_SUCCESS(mStatus, *this) failed with result 0x804B000A: file /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIURIMutator.h, line 605
[Parent 31133, Main Thread] WARNING: NS_ENSURE_SUCCESS(mStatus, mStatus) failed with result 0x804B000A: file /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIURIMutator.h, line 644
[Parent 31133, Main Thread] WARNING: Cannot set transparency mode on non-popup windows.: file /builds/worker/workspace/build/src/widget/gtk/nsWindow.cpp, line 4573
   0:     0x7fab49cfeace - std::sys::unix::backtrace::tracing::imp::unwind_backtrace::h4e8f20df13e312d1
   1:     0x7fab49cdea96 - std::sys_common::backtrace::print::ha948e198817dc736
   2:     0x7fab49cd91ad - std::panicking::default_hook::{{closure}}::hbce70b8b8e9560c0
   3:     0x7fab49cd8f20 - std::panicking::default_hook::h445b4bc93ff2c15f
   4:     0x7fab49cd98b3 - std::panicking::rust_panic_with_hook::h542dacac3f3a20d8
   5:     0x7fab49cd9419 - std::panicking::continue_panic_fmt::hd989cd729c0c5a4b
   6:     0x7fab49cd937d - std::panicking::begin_panic_fmt::h4e9d19762deb3325
   7:     0x7fab4985a426 - <unknown>
Redirecting call to abort() to mozalloc_abort

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007fab575a7840
rsi = 0x00007fab575a88b0   rdi = 0x00007fab575a7680
rbp = 0x00007ffc7dd03520   rsp = 0x00007ffc7dd03510
r8 = 0x00007fab575a88b0    r9 = 0x00007fab58719740
r10 = 0x0000000000000056   r11 = 0x00007fab572397e0
r12 = 0x00007fab4c8349d0   r13 = 0x00007ffc7dd03668
r14 = 0x00007fab56f4a6e0   r15 = 0x0000000000000001
rip = 0x000056110b6cef3b
OS|Linux|0.0.0 Linux 4.15.0-36-generic #39-Ubuntu SMP Mon Sep 24 16:19:09 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|firefox-bin|mozalloc_abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|35|0x5
0|1|firefox-bin|abort|hg:hg.mozilla.org/mozilla-central:memory/mozalloc/mozalloc_abort.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|82|0x5
0|2|libxul.so|panic_abort::__rust_start_panic::abort|git:github.com/rust-lang/rust:src/libpanic_abort/lib.rs:17a9dc7513b9fea883dc9505f09f97c63d1d601b|61|0x5
0|3|libxul.so|__rust_start_panic|git:github.com/rust-lang/rust:src/libpanic_abort/lib.rs:17a9dc7513b9fea883dc9505f09f97c63d1d601b|56|0x5
0|4|libxul.so|rust_panic|git:github.com/rust-lang/rust:src/libstd/panicking.rs:17a9dc7513b9fea883dc9505f09f97c63d1d601b|523|0x5
0|5|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:17a9dc7513b9fea883dc9505f09f97c63d1d601b|495|0xb
0|6|libxul.so|std::panicking::continue_panic_fmt|git:github.com/rust-lang/rust:src/libstd/panicking.rs:17a9dc7513b9fea883dc9505f09f97c63d1d601b|390|0x17
0|7|libxul.so|std::panicking::begin_panic_fmt|git:github.com/rust-lang/rust:src/libstd/panicking.rs:17a9dc7513b9fea883dc9505f09f97c63d1d601b|345|0x5
0|8|libxul.so|<style::sharing::StyleSharingCache<E>>::test_candidate|hg:hg.mozilla.org/mozilla-central:<panic macros>:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|8|0x5
0|9|libxul.so|<uluru::LRUCache<A>>::lookup|hg:hg.mozilla.org/mozilla-central:servo/components/style/sharing/mod.rs:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|671|0xe
0|10|libxul.so|<style::sharing::StyleSharingTarget<E>>::share_style_if_possible|hg:hg.mozilla.org/mozilla-central:servo/components/style/sharing/mod.rs:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|670|0x8
0|11|libxul.so|style::traversal::compute_style|hg:hg.mozilla.org/mozilla-central:servo/components/style/traversal.rs:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|624|0x8
0|12|libxul.so|<style::gecko::traversal::RecalcStyleOnly<'recalc> as style::traversal::DomTraversal<style::gecko::wrapper::GeckoElement<'le>>>::process_preorder|hg:hg.mozilla.org/mozilla-central:servo/components/style/traversal.rs:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|435|0xb
0|13|libxul.so|style::driver::traverse_dom|hg:hg.mozilla.org/mozilla-central:servo/components/style/driver.rs:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|111|0x1b
0|14|libxul.so|geckoservo::glue::traverse_subtree|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|297|0xe
0|15|libxul.so|Servo_TraverseSubtree|hg:hg.mozilla.org/mozilla-central:servo/ports/geckolib/glue.rs:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|355|0x11
0|16|libxul.so|mozilla::ServoStyleSet::StyleDocument(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/style/ServoStyleSet.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|996|0x1d
0|17|libxul.so|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|3024|0x12
0|18|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|4326|0x19
0|19|libxul.so|nsRefreshDriver::Tick(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|1906|0x5
0|20|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|326|0x8
0|21|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|319|0xc
0|22|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|760|0xc
0|23|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|573|0xc
0|24|libxul.so|mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&)|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|76|0x9
0|25|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:2c36fa176485b987fd1c1ce548d1f34c4c8bfdea36ff5dd016400feb13d3c5c0c7f99d5a56d13733937c9483a48617af010c09f521533a5ce0fc1f74c50b86a2/ipc/ipdl/PVsyncChild.cpp:|167|0xc
0|26|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|2255|0x6
0|27|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|2182|0xb
0|28|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|2019|0xb
0|29|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|2052|0xc
0|30|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|1245|0x15
0|31|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|530|0x11
0|32|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|97|0xa
0|33|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|325|0x17
0|34|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|318|0x8
0|35|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|158|0xd
0|36|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|939|0x11
0|37|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|269|0x5
0|38|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|325|0x17
0|39|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|318|0x8
0|40|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|765|0x8
0|41|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|50|0x14
0|42|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|301|0x11
0|43|libc-2.27.so||||0x21b97
0|44|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:f7a97b344fa59bd3b01ea81ebd5b150aa63bfb12|164|0x5

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1502893 - Don't match document author rules if not needed for revalidation.

When you're in a ShadowRoot and can share style with a sibling, the sharing code
is smart enough to skip document author rules.

But then it could get confused if you also include document rules, since
revalidation selectors are matched against these.

This is not a correctness issue, because we're matching more than what we need,
and avoid sharing if we failed.

Also fix the detection for user rules in any_applicable_rule_data.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9f0e2fbf4d15
Don't match document author rules if not needed for revalidation. r=heycam,firefox-style-system-reviewers

Comment 3

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/9f0e2fbf4d15