1600635 - Assertion failure: cachedStyles[i]->EqualForCachedAnonymousContentStyle(*cs) (cached anonymous content styles should be identical to those we would compute normally), at /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:3954

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev caf55914ccdd.

Assertion failure: cachedStyles[i]->EqualForCachedAnonymousContentStyle(*cs) (cached anonymous content styles should be identical to those we would compute normally), at /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:3954

 rax = 0x000055629e99f340   rdx = 0x0000000000000000
rcx = 0x00007f9bdfcbe46f   rbx = 0x00007fffa4d83db8
rsi = 0x00007f9beb59d8b0   rdi = 0x00007f9beb59c680
rbp = 0x00007fffa4d83e30   rsp = 0x00007fffa4d83d40
r8 = 0x00007f9beb59d8b0    r9 = 0x00007f9bec706780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x0000000000000000   r13 = 0x00007fffa4d83d98
r14 = 0x0000000000000001   r15 = 0x00007f9bb73ec978
rip = 0x00007f9bdc152b24
OS|Linux|0.0.0 Linux 5.0.0-35-generic #38~18.04.1-Ubuntu SMP Mon Nov 11 09:16:10 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsCSSFrameConstructor::GetAnonymousContent(nsIContent*, nsIFrame*, nsTArray<nsIAnonymousContentCreator::ContentInfo>&)|s3:gecko-generated-sources:891c87f48a1b3282d171be8345b4ebe311d17b01c10f574ce7f6bd44dfe87a46991a36777251a157f2cd816f02278166af51ab4f1e929d28afafc0f5d990f104/modules/libpref/init/StaticPrefList_layout.h:|164|0x0
0|1|libxul.so|nsCSSFrameConstructor::BeginBuildingScrollFrame(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, mozilla::PseudoStyleType, bool, nsContainerFrame*&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|4193|0x11
0|2|libxul.so|nsCSSFrameConstructor::ConstructScrollableBlockWithConstructor(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&, nsBlockFrame* (*)(mozilla::PresShell*, mozilla::ComputedStyle*))|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|4553|0x2a
0|3|libxul.so|nsCSSFrameConstructor::ConstructScrollableBlock(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|4542|0xa
0|4|libxul.so|nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|3566|0x24
0|5|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|5647|0x15
0|6|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|9519|0x15
0|7|libxul.so|nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameList&, bool, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|9686|0x2d
0|8|libxul.so|nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|3720|0x10
0|9|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|5647|0x15
0|10|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|9519|0x15
0|11|libxul.so|nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameList&, bool, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|9686|0x2d
0|12|libxul.so|nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|3720|0x10
0|13|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|5647|0x15
0|14|libxul.so|nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|9519|0x15
0|15|libxul.so|nsCSSFrameConstructor::ContentAppended(nsIContent*, nsCSSFrameConstructor::InsertionKind)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:caf55914ccddba34d462a1206530d7868b6c4992|6815|0x1e
0|16|libxul.so|mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:caf55914ccddba34d462a1206530d7868b6c4992|1434|0xe
0|17|libxul.so|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:caf55914ccddba34d462a1206530d7868b6c4992|3085|0xf
0|18|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:caf55914ccddba34d462a1206530d7868b6c4992|4074|0x1c
0|19|libxul.so|nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:caf55914ccddba34d462a1206530d7868b6c4992|1992|0xe
0|20|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:caf55914ccddba34d462a1206530d7868b6c4992|350|0xb
0|21|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:caf55914ccddba34d462a1206530d7868b6c4992|366|0xf
0|22|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:caf55914ccddba34d462a1206530d7868b6c4992|727|0xf
0|23|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run()|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:caf55914ccddba34d462a1206530d7868b6c4992|525|0x15
0|24|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:caf55914ccddba34d462a1206530d7868b6c4992|1225|0x15
0|25|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:caf55914ccddba34d462a1206530d7868b6c4992|486|0x11
0|26|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:caf55914ccddba34d462a1206530d7868b6c4992|88|0xa
0|27|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:caf55914ccddba34d462a1206530d7868b6c4992|315|0x17
0|28|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:caf55914ccddba34d462a1206530d7868b6c4992|290|0x8
0|29|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:caf55914ccddba34d462a1206530d7868b6c4992|137|0xd
0|30|libxul.so|nsAppStartup::Run()|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:caf55914ccddba34d462a1206530d7868b6c4992|276|0xe
0|31|libxul.so|XREMain::XRE_mainRun()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:caf55914ccddba34d462a1206530d7868b6c4992|4586|0x11
0|32|libxul.so|XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:caf55914ccddba34d462a1206530d7868b6c4992|4721|0x8
0|33|libxul.so|XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:caf55914ccddba34d462a1206530d7868b6c4992|4802|0x5
0|34|firefox-bin|do_main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:caf55914ccddba34d462a1206530d7868b6c4992|218|0x26
0|35|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:caf55914ccddba34d462a1206530d7868b6c4992|300|0xf
0|36|libc-2.27.so||||0x21b97
0|37|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:caf55914ccddba34d462a1206530d7868b6c4992|203|0x5

Comment 1

[Jonathan Kew [:jfkthame]]

Cameron, this looks related to bug 1554571.

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/ZOXrpHkHjp-1i7JMKg3llg/index.html

Comment 3

[Intermittent Failures Robot]

4 failures in 3773 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 4

Platform breakdown:

• linux1804-64: 4

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1600635&startday=2020-01-13&endday=2020-01-19&tree=all

Comment 4

[Tyson Smith [:tsmith]]

This has been open for a while and fuzzers are tripping over this fairly frequently. It would be great to get it out of the way.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Thanks Jason, sorry. When you're blocked on any of these let me know and I'll put them in my queue.

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1600635 - Fix two minor issues with scrollbar style caching. r=heycam,#style

Add -moz-inert and -moz-script-level to the set of internal properties
that aren't included in "all".

-moz-inert may need to be uncacheable in the future if we make it not
change the pointer-events computed value. Left a comment to that effect.

Comment 7

[Cameron McCormack (:heycam)]

Sorry I haven't been tending my needinfo queue well lately.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f035432a86b8
Fix two minor issues with scrollbar style caching. r=heycam

Comment 9

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/f035432a86b8