Closed Bug 1618564 Opened 4 years ago Closed 4 years ago

Assertion failure: &aStyleBorder == aForFrame->StyleBorder() || aForFrame->Style()->GetStyleIfVisited(), at /builds/worker/workspace/build/src/layout/painting/nsCSSRenderingBorders.cpp:3395

Tracking

()

Status:

RESOLVED FIXED

Milestone:

mozilla75

Tracking Flags:

Tracking

Status

firefox-esr68

---

unaffected

firefox73

---

unaffected

firefox74

---

wontfix

firefox75

---

fixed

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:confirmed])

Attachments

(4 files)

testcase.html 4 years ago Jason Kratzer [:jkratzer] 383 bytes, text/html		Details
6f032149dafce76db93e38cf5fc27db62392d14c.gif 4 years ago Jason Kratzer [:jkratzer] 402 bytes, image/gif		Details
prefs.js 4 years ago Jason Kratzer [:jkratzer] 12.82 KB, application/x-javascript		Details
Bug 1618564 - Adjust an assertion to check for what it really wants to check. r=tnikkel 4 years ago Emilio Cobos Álvarez (:emilio) 47 bytes, text/x-phabricator-request		Details \| Review

Jason Kratzer [:jkratzer]

Reporter

Description

•

4 years ago

Attached file testcase.html — Details

Testcase found while fuzzing mozilla-central rev 9e8d5431c412 (built with --enable-debug).

Assertion failure: &aStyleBorder == aForFrame->StyleBorder() || aForFrame->Style()->GetStyleIfVisited(), at /builds/worker/workspace/build/src/layout/painting/nsCSSRenderingBorders.cpp:3395

rax = 0x000055be79a76340   rdx = 0x0000000000000000
rcx = 0x00007f392bd043f9   rbx = 0x00007ffe5f81aad8
rsi = 0x00007f39376c28b0   rdi = 0x00007f39376c1680
rbp = 0x00007ffe5f81aca0   rsp = 0x00007ffe5f81aac0
r8 = 0x00007f39376c28b0    r9 = 0x00007f3938828780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007ffe5f81ad18   r13 = 0x00007ffe5f81ad08
r14 = 0x00007f391cc301f8   r15 = 0x00007ffe5f81aeb8
rip = 0x00007f3928346881
OS|Linux|0.0.0 Linux 5.3.0-28-generic #30~18.04.1-Ubuntu SMP Fri Jan 17 06:14:09 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsCSSBorderImageRenderer::CreateBorderImageRenderer(nsPresContext*, nsIFrame*, nsRect const&, nsStyleBorder const&, nsRect const&, mozilla::Sides, unsigned int, mozilla::image::ImgDrawResult*)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsCSSRenderingBorders.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|3394|0x44
0|1|libxul.so|nsCSSRendering::PaintBorderWithStyleBorder(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, mozilla::ComputedStyle*, mozilla::PaintBorderFlags, mozilla::Sides)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsCSSRendering.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|861|0x5
0|2|libxul.so|nsDisplaymtdBorder::Paint(nsDisplayListBuilder*, gfxContext*)|hg:hg.mozilla.org/mozilla-central:layout/mathml/nsMathMLmtableFrame.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|313|0x24
0|3|libxul.so|mozilla::FrameLayerBuilder::PaintItems(std::vector<mozilla::AssignedDisplayItem, std::allocator<mozilla::AssignedDisplayItem> >&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|7122|0x1b
0|4|libxul.so|mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|7282|0x78
0|5|libxul.so|mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*)|hg:hg.mozilla.org/mozilla-central:gfx/layers/client/ClientPaintedLayer.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|159|0x2a
0|6|libxul.so|mozilla::layers::ClientContainerLayer::RenderLayer()|hg:hg.mozilla.org/mozilla-central:gfx/layers/client/ClientContainerLayer.h:9e8d5431c4121a4bd70d440c98b50444aee60dd9|53|0x6
0|7|libxul.so|mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags)|hg:hg.mozilla.org/mozilla-central:gfx/layers/client/ClientLayerManager.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|352|0x9
0|8|libxul.so|mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags)|hg:hg.mozilla.org/mozilla-central:gfx/layers/client/ClientLayerManager.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|404|0x26
0|9|libxul.so|nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|3130|0x7
0|10|libxul.so|nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|4095|0x5
0|11|libxul.so|mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|6052|0x1b
0|12|libxul.so|nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*)|hg:hg.mozilla.org/mozilla-central:view/nsViewManager.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|461|0x2c
0|13|libxul.so|nsViewManager::ProcessPendingUpdatesForView(nsView*, bool)|hg:hg.mozilla.org/mozilla-central:view/nsViewManager.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|396|0x15
0|14|libxul.so|nsViewManager::ProcessPendingUpdates()|hg:hg.mozilla.org/mozilla-central:view/nsViewManager.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|1005|0x43
0|15|libxul.so|nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|2188|0x5
0|16|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|351|0xb
0|17|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|368|0x12
0|18|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|743|0xf
0|19|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|642|0xf
0|20|libxul.so|mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|64|0x8
0|21|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:40b57a5f11db1f2975fc13c74f20fea3c72418dd5cc7be16b1724f135b6995163d22588c816f1fb7f6cdadad80e8ed2fcea1ccf234f0788643e6a5e4e1859c1e/ipc/ipdl/PVsyncChild.cpp:|187|0xb
0|22|libxul.so|mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:2c00c6e8fe94c4488d1fca390aff0552cb4c3ce40484b98f953b8e69d8f06e217c2149c17ee88489855e4d63a022e5bc503c37aacdd686847caea60851863176/ipc/ipdl/PBackgroundChild.cpp:|5806|0xd
0|23|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|2214|0x6
0|24|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|2136|0xe
0|25|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|1975|0xb
0|26|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|2006|0xc
0|27|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|1220|0xe
0|28|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|481|0x11
0|29|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|109|0xd
0|30|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9e8d5431c4121a4bd70d440c98b50444aee60dd9|315|0x19
0|31|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9e8d5431c4121a4bd70d440c98b50444aee60dd9|290|0x8
0|32|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|137|0xd
0|33|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|944|0x6
0|34|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|237|0x5
0|35|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9e8d5431c4121a4bd70d440c98b50444aee60dd9|315|0x19
0|36|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9e8d5431c4121a4bd70d440c98b50444aee60dd9|290|0x8
0|37|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|779|0x8
0|38|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|56|0x14
0|39|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|303|0x13
0|40|libc-2.27.so||||0x21b97
0|41|firefox-bin|__cxa_throw_bad_array_new_length|hg:hg.mozilla.org/mozilla-central:build/unix/stdc++compat/stdc++compat.cpp:9e8d5431c4121a4bd70d440c98b50444aee60dd9|82|0x12
0|42|firefox-bin||||0x10ea0
0|43|ld-2.27.so||||0x10733
0|44|libdl-2.27.so||||0x202d80
0|45|libpthread-2.27.so||||0x219bb0
0|46|firefox-bin||||0x10ea0
0|47|firefox-bin|_start|||0x29

Flags: in-testsuite?

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

4 years ago

Attached image 6f032149dafce76db93e38cf5fc27db62392d14c.gif — Details

Jason Kratzer [:jkratzer]

Reporter

Comment 2

•

4 years ago

Attached file prefs.js — Details

Emilio Cobos Álvarez (:emilio)

Assignee

Comment 3

•

4 years ago

Ugh, mathml :(

Assignee: nobody → emilio

Emilio Cobos Álvarez (:emilio)

Assignee

Updated

•

4 years ago

Flags: needinfo?(emilio)

Jason Kratzer [:jkratzer]

Reporter

Comment 4

•

4 years ago

BugMon: Verified bug as reproducible on 9e8d5431c4121a4bd70d440c98b50444aee60dd9

Jason Kratzer [:jkratzer]

Reporter

Comment 5

•

4 years ago

BugMon: Reduced build range to...
> Start: 882200a11bcf4629de8c589f954c73bd02300645 (20200207215354)
> End: cb56699431a0f051c40a8d0c765826e710de0aad (20200208092503)
> Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=882200a11bcf4629de8c589f954c73bd02300645&tochange=cb56699431a0f051c40a8d0c765826e710de0aad

Jason Kratzer [:jkratzer]

Reporter

Updated

•

4 years ago

Whiteboard: [bugmon:confirm] → [bugmon:confirmed]

Emilio Cobos Álvarez (:emilio)

Assignee

Updated

•

4 years ago

Flags: needinfo?(emilio)

Emilio Cobos Álvarez (:emilio)

Assignee

Comment 6

•

4 years ago

Attached file Bug 1618564 - Adjust an assertion to check for what it really wants to check. r=tnikkel — Details

There's more stuff that creates nsStyleBorder structs on the stack (like MathML
tables).

Check for what we really mean to check, which is that the image request is the
one of our border-image-source. Otherwise we'd need to setup the association and
so on somehow.

Pulsebot

Comment 7

•

4 years ago

Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/df0d58ec8020
Adjust an assertion to check for what it really wants to check. r=tnikkel

Arthur Iakab [arthur_iakab]

Comment 8

•

4 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/df0d58ec8020

Status: NEW → RESOLVED

Closed: 4 years ago

status-firefox75: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla75

Ryan VanderMeulen [:RyanVM]

Updated

•

4 years ago

status-firefox73: --- → unaffected

status-firefox74: --- → wontfix

status-firefox-esr68: --- → unaffected

Flags: in-testsuite? → in-testsuite+

Regressed by: 1606628

BMO Automation

Updated

•

4 years ago

Has Regression Range: --- → yes

Keywords: regression

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Quick Search

Assertion failure: &aStyleBorder == aForFrame->StyleBorder() || aForFrame->Style()->GetStyleIfVisited(), at /builds/worker/workspace/build/src/layout/painting/nsCSSRenderingBorders.cpp:3395

Categories

(Core :: Web Painting, defect)

Tracking

()

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:confirmed])

Crash Data

Security

(public)

User Story

Attachments

(4 files)

Description

Comment 1

Comment 2

Comment 3

Updated

Comment 4

Comment 5

Updated

Updated

Comment 6

Comment 7

Comment 8

Updated

Updated

Attachment

General

Description

File Name

Content Type