1621273 - Crash in [@ mozilla::RestyleManager::ContentStateChanged] | Assertion failure: !mInStyleRefresh

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Bob Clary [:bc] (inactive)]

This bug is for crash report bp-ebc37786-7af1-4900-958c-c0f0d0200310.

Top 10 frames of crashing thread:

0 libxul.so mozilla::RestyleManager::ContentStateChanged layout/base/RestyleManager.cpp:3173
1 libxul.so <name omitted> layout/base/PresShell.cpp:4200
2 libxul.so mozilla::dom::HTMLFormElement::UpdateValidity dom/html/HTMLFormElement.cpp:1993
3 libxul.so mozilla::dom::HTMLInputElement::UpdateAllValidityStatesButNotElementState dom/html/HTMLInputElement.cpp:6532
4 libxul.so mozilla::dom::HTMLInputElement::OnValueChanged dom/html/HTMLInputElement.cpp:6616
5 libxul.so mozilla::TextControlState::SetValue dom/html/TextControlState.cpp:2696
6 libxul.so mozilla::TextControlState::UnbindFromFrame dom/html/TextControlState.cpp:2485
7 libxul.so nsTextControlFrame::DestroyFrom layout/forms/nsTextControlFrame.cpp:145
8 libxul.so nsFrameList::DestroyFramesFrom layout/generic/nsFrameList.cpp:51
9 libxul.so nsContainerFrame::DestroyFrom layout/generic/nsContainerFrame.cpp:215

1. https://www.vergleiche.ch/search/?search=Bratensauce
2. Crash [@ mozilla::RestyleManager::ContentStateChanged] in opt. MOZ_DIAGNOSTIC_ASSERT(!mInStyleRefresh) in debug

Assertion failure: !mInStyleRefresh, at z:/build/build/src/layout/base/RestyleManager.cpp:3170
#01: mozilla::dom::Document::ContentStateChanged(nsIContent*, mozilla::EventStates) [dom/base/Document.cpp:7420]
#02: mozilla::dom::Element::UpdateState(bool) [dom/base/Element.cpp:291]
#03: mozilla::dom::HTMLFormElement::UpdateValidity(bool) [dom/html/HTMLFormElement.cpp:1994]
#04: nsIConstraintValidation::SetValidityState(nsIConstraintValidation::ValidityStateType, bool) [dom/html/nsIConstraintValidation.cpp:202]
#05: mozilla::dom::HTMLInputElement::UpdateAllValidityStatesButNotElementState() [dom/html/HTMLInputElement.cpp:6535]
#06: mozilla::dom::HTMLInputElement::OnValueChanged(bool, mozilla::TextControlElement::ValueChangeKind) [dom/html/HTMLInputElement.cpp:6618]
#07: mozilla::TextControlState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int) [dom/html/TextControlState.cpp:2696]
#08: mozilla::TextControlState::UnbindFromFrame(nsTextControlFrame*) [dom/html/TextControlState.cpp:2487]
#09: nsTextControlFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) [layout/forms/nsTextControlFrame.cpp:147]
#10: nsNumberControlFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) [layout/forms/nsNumberControlFrame.cpp:47]
#11: nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) [layout/generic/nsFrameList.cpp:50]
#12: nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) [layout/generic/nsContainerFrame.cpp:218]
#13: static nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*, mozilla::layout::PostFrameDestroyData&) [layout/generic/nsLineBox.cpp:374]
#14: nsBlockFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) [layout/generic/nsBlockFrame.cpp:441]
#15: static nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*, mozilla::layout::PostFrameDestroyData&) [layout/generic/nsLineBox.cpp:374]
#16: nsBlockFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) [layout/generic/nsBlockFrame.cpp:441]
#17: nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) [layout/generic/nsFrameList.cpp:50]
#18: nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) [layout/generic/nsContainerFrame.cpp:218]
#19: nsBlockFrame::DoRemoveFrameInternal(nsIFrame*, unsigned int, mozilla::layout::PostFrameDestroyData&) [layout/generic/nsBlockFrame.cpp:6263]
#20: nsBlockFrame::RemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*) [layout/generic/nsBlockFrame.cpp:5574]
#21: nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) [layout/base/nsCSSFrameConstructor.cpp:7579]
#22: nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) [layout/base/nsCSSFrameConstructor.cpp:8589]
#23: mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) [layout/base/RestyleManager.cpp:1395]
#24: mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) [layout/base/RestyleManager.cpp:3064]
#25: mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) [layout/base/PresShell.cpp:4078]
#26: nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) [layout/base/nsRefreshDriver.cpp:2040]
#27: mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) [layout/base/nsRefreshDriver.cpp:345]
#28: mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) [layout/base/nsRefreshDriver.cpp:370]
#29: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) [layout/base/nsRefreshDriver.cpp:743]
#30: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NormalPriorityNotify() [layout/base/nsRefreshDriver.cpp:662]
#31: mozilla::detail::RunnableMethodImpl<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver *,void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(),1,mozilla::RunnableKind::Standard>::Run() [xpcom/threads/nsThreadUtils.h:1213]
#32: nsThread::ProcessNextEvent(bool, bool*) [xpcom/threads/nsThread.cpp:1222]
#33: NS_ProcessNextEvent(nsIThread*, bool) [xpcom/threads/nsThreadUtils.cpp:481]

Didn't crash 74.0b4/75.0b1 on Fedora locally -> regression

Comment 1

[Emilio Cobos Álvarez (:emilio)]

I can repro on nightly 74, fwiw. But anyhow we should take a look.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Reduced test-case.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1621273 - Value attribute changes can affect step validity even if the input value doesn't change. r=smaug,masayuki

If the actual input value didn't change, we'd skip updating form validity, but
that's not always correct because GetStepBase() depends on the value attribute.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/154ae422fd33
Value attribute changes can affect step validity even if the input value doesn't change. r=smaug

Comment 5

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/22256 for changes under testing/web-platform/tests

Comment 6

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream web-platform-tests status checks passed, PR will merge once commit reaches central.

Comment 7

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/154ae422fd33

Comment 8

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:emilio, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Comment 10

[Emilio Cobos Álvarez (:emilio)]

(This won't crash or cause issues in release)