Closed Bug 1659729 Opened 5 years ago Closed 3 years ago

Assertion failure: !mInStyleRefresh, at /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3144

Categories

(Core :: CSS Parsing and Computation, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
88 Branch
Tracking Status
firefox81 --- wontfix

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed][no-nag])

Crash Data

Attachments

(1 file)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 1891b1e3fa34 (built with --enable-debug).

Assertion failure: !mInStyleRefresh, at /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3144

    #0 0x7fcd971226f8 in AnnotateMozCrashReason /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:42:19
    #1 0x7fcd971226f8 in mozilla::RestyleManager::ContentStateChanged(nsIContent*, mozilla::EventStates) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3144:3
    #2 0x7fcd9712225a in mozilla::PresShell::ContentStateChanged(mozilla::dom::Document*, nsIContent*, mozilla::EventStates) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4317:37
    #3 0x7fcd9459e0c5 in mozilla::dom::Document::ContentStateChanged(nsIContent*, mozilla::EventStates) /builds/worker/checkouts/gecko/dom/base/Document.cpp:7440:3
    #4 0x7fcd945d0307 in mozilla::dom::Element::UpdateState(bool) /builds/worker/checkouts/gecko/dom/base/Element.cpp:290:14
    #5 0x7fcd95ebfde1 in mozilla::TextControlState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int) /builds/worker/checkouts/gecko/dom/html/TextControlState.cpp:2667:47
    #6 0x7fcd95ea58fa in SetValue /builds/worker/checkouts/gecko/dom/html/TextControlState.h:223:12
    #7 0x7fcd95ea58fa in mozilla::TextControlState::UnbindFromFrame(nsTextControlFrame*) /builds/worker/checkouts/gecko/dom/html/TextControlState.cpp:2458:26
    #8 0x7fcd973a1dc8 in nsTextControlFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /builds/worker/checkouts/gecko/layout/forms/nsTextControlFrame.cpp:144:23
    #9 0x7fcd97326502 in nsLineBox::DeleteLineList(nsPresContext*, nsLineList&, nsIFrame*, nsFrameList*, mozilla::layout::PostFrameDestroyData&) /builds/worker/checkouts/gecko/layout/generic/nsLineBox.cpp:387:14
    #10 0x7fcd97213397 in nsBlockFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:438:3
    #11 0x7fcd9726c789 in nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /builds/worker/checkouts/gecko/layout/generic/nsFrameList.cpp:51:12
    #12 0x7fcd972138cc in nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:216:11
    #13 0x7fcd9723cffb in nsCanvasFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:230:21
    #14 0x7fcd9726c789 in nsFrameList::DestroyFramesFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /builds/worker/checkouts/gecko/layout/generic/nsFrameList.cpp:51:12
    #15 0x7fcd972138cc in nsContainerFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:216:11
    #16 0x7fcd9720d44d in Destroy /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h:739:5
    #17 0x7fcd9720d44d in nsContainerFrame::RemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:170:19
    #18 0x7fcd9717a9b3 in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7585:5
    #19 0x7fcd971725e9 in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8569:7
    #20 0x7fcd9717b303 in nsCSSFrameConstructor::MaybeRecreateContainerForFrameRemoval(nsIFrame*) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp
    #21 0x7fcd97172556 in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8558:16
    #22 0x7fcd97179384 in nsCSSFrameConstructor::WipeContainingBlock(nsFrameConstructorState&, nsIFrame*, nsIFrame*, nsCSSFrameConstructor::FrameConstructionItemList&, bool, nsIFrame*) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp
    #23 0x7fcd97177c0c in nsCSSFrameConstructor::ContentAppended(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:6765:7
    #24 0x7fcd97140015 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1380:27
    #25 0x7fcd97146a5a in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3037:9
    #26 0x7fcd97120c59 in ProcessPendingRestyles /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3116:3
    #27 0x7fcd97120c59 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4196:39
    #28 0x7fcd970ec434 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1412:5
    #29 0x7fcd970ec434 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2112:22
    #30 0x7fcd970f4181 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:373:13
    #31 0x7fcd970f4181 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:352:7
    #32 0x7fcd970f405c in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:5
    #33 0x7fcd970f976b in RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:819:5
    #34 0x7fcd970f976b in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:737:16
    #35 0x7fcd970f902f in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:639:7
    #36 0x7fcd970f224d in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:538:20
    #37 0x7fcd92685124 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:242:16
    #38 0x7fcd92682eed in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:512:26
    #39 0x7fcd92681eb4 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:371:15
    #40 0x7fcd92682067 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:168:36
    #41 0x7fcd92689c56 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:83:37
    #42 0x7fcd92689c56 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #43 0x7fcd9269d0a8 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1242:14
    #44 0x7fcd926a2a7a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #45 0x7fcd92fc17af in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #46 0x7fcd92f32043 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #47 0x7fcd92f31f5d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #48 0x7fcd92f31f5d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #49 0x7fcd96e5ee18 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #50 0x7fcd98686b03 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #51 0x7fcd92fc2577 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #52 0x7fcd92f32043 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #53 0x7fcd92f31f5d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #54 0x7fcd92f31f5d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #55 0x7fcd986866a2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #56 0x55847acff09f in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #57 0x55847acff09f in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
    #58 0x7fcdadf29b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310
Flags: in-testsuite?

Got a crash from the attached testcase

Crash Signature: [@ mozilla::PresShell::ContentStateChanged ]
See Also: → 1656590
Keywords: crash
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Bugmon Analysis: Verified bug as reproducible on mozilla-central 20200818153308-c38fb352aacf. The bug appears to have been introduced in the following build range: > Start: 6b2ed41d571480f067b6c83a843c417731ad2111 (20200420180549) > End: 06366bae59660d6019a3f5bb08f0c618cf6a2ab9 (20200420180752) > Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=6b2ed41d571480f067b6c83a843c417731ad2111&tochange=06366bae59660d6019a3f5bb08f0c618cf6a2ab9

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20201212092303-8491ac4866e8) but not with tip (mozilla-central 20211210215852-9eb74149f75b.)
The bug appears to have been fixed in the following build range:

Start: 9c6887577e850ed150dc928683bac6cc153e616c (20210223112813)
End: 70d457e2ca37cd439c6d4bc1b90656ee2bfb26c6 (20210223112918)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=9c6887577e850ed150dc928683bac6cc153e616c&tochange=70d457e2ca37cd439c6d4bc1b90656ee2bfb26c6
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon

Yep, that range makes sense to me.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---

Setting regressed_by field after analyzing regression range found by bugmon.

Regressed by: 1630819

Set release status flags based on info from the regressing bug 1630819

:TYLin, since you are the author of the regressor, bug 1630819, could you take a look?
For more information, please visit auto_nag documentation.

Flags: needinfo?(aethanyc)

Shouldn't this fixed by bug 1693969 per comment 3. It there something we should do other than keeping this bug open to track the intermittent on CI?

Flags: needinfo?(aethanyc) → needinfo?(emilio)

Yes, can we use a new/separate bug for the intermittents cosmin? This was about a very specific test-case in comment 0, which no longer reproduces.

Flags: needinfo?(emilio) → needinfo?(csabou)

Filed Bug 1773935 to track the latest failures from here.

Status: REOPENED → RESOLVED
Closed: 4 years ago3 years ago
Flags: needinfo?(csabou)
Resolution: --- → WORKSFORME
Assignee: nobody → emilio
Depends on: 1693969
Resolution: WORKSFORME → FIXED
Target Milestone: --- → 88 Branch

Set release status flags based on info from the regressing bug 1630819

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed][no-nag]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: