1665796 - Assertion failure: !OwnerDoc()->IsScrollingElement(this) (How can we have a scrollframe if we're the scrollingElement for our document?), at src/dom/base/Element.cpp:557

Status: VERIFIED FIXED

(Core :: Layout: Scrolling and Overflow, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Assertion failure: !OwnerDoc()->IsScrollingElement(this) (How can we have a scrollframe if we're the scrollingElement for our document?), at src/dom/base/Element.cpp:557

#0 0x7f469c016ee9 in mozilla::dom::Element::GetScrollFrame(nsIFrame**, mozilla::FlushType) src/dom/base/Element.cpp:555:9
#1 0x7f469c0177c3 in mozilla::dom::Element::ScrollTop() src/dom/base/Element.cpp:733:28
#2 0x7f469d029b45 in mozilla::dom::Element_Binding::get_scrollTop(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/ElementBinding.cpp:3042:39
#3 0x7f469d315303 in bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3111:13
#4 0x7f46a00fe451 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:508:13
#5 0x7f46a00fdbc9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:600:12
#6 0x7f46a00ff721 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:665:10
#7 0x7f46a0100640 in Call src/js/src/vm/Interpreter.cpp:682:8
#8 0x7f46a0100640 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:806:10
#9 0x7f46a0458f0e in CallGetter src/js/src/vm/NativeObject.cpp:2374:12
#10 0x7f46a0458f0e in bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::Shape*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) src/js/src/vm/NativeObject.cpp:2426:12
#11 0x7f46a0459b30 in bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) src/js/src/vm/NativeObject.cpp:2566:14
#12 0x7f46a010506f in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) src/js/src/vm/ObjectOperations-inl.h:124:10
#13 0x7f46a01044cf in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:4730:10
#14 0x7f46a00f0eee in GetPropertyOperation src/js/src/vm/Interpreter.cpp:221:10
#15 0x7f46a00f0eee in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3017:12
#16 0x7f46a00eab23 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:469:13
#17 0x7f46a00fdb9a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:637:13
#18 0x7f46a00ff721 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:665:10
#19 0x7f46a00ff95f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:682:8
#20 0x7f46a0204487 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2821:10
#21 0x7f469d04cf33 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:278:37
#22 0x7f469d6bb691 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:367:12
#23 0x7f469d6ba753 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:201:12
#24 0x7f469d69dc3e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1088:22
#25 0x7f469d69e899 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1279:17
#26 0x7f469d694042 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:354:5
#27 0x7f469d694042 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:356:17
#28 0x7f469d6935f3 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:558:16
#29 0x7f469d6960fd in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1058:11
#30 0x7f469eb1b57a in nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1103:7
#31 0x7f469fad0ca0 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:6368:20
#32 0x7f469fad065a in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:5720:7
#33 0x7f469fad157f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
#34 0x7f469b64a0bc in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1348:3
#35 0x7f469b64966a in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:954:14
#36 0x7f469b6479fc in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) src/uriloader/base/nsDocLoader.cpp:757:9
#37 0x7f469b648aad in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:640:5
#38 0x7f469b64928c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp
#39 0x7f469a46c846 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) src/netwerk/base/nsLoadGroup.cpp:615:22
#40 0x7f469a46dd53 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:522:10
#41 0x7f469bff3a51 in mozilla::dom::Document::DoUnblockOnload() src/dom/base/Document.cpp:10830:18
#42 0x7f469bfd2c10 in mozilla::dom::Document::UnblockOnload(bool) src/dom/base/Document.cpp:10760:9
#43 0x7f469bfe32f0 in mozilla::dom::Document::DispatchContentLoadedEvents() src/dom/base/Document.cpp:7341:3
#44 0x7f469c052de6 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1188:12
#45 0x7f469c052de6 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1194:12
#46 0x7f469c052de6 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1240:13
#47 0x7f469a2dadd2 in mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:146:20
#48 0x7f469a3086d3 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:244:16
#49 0x7f469a2e4014 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:514:26
#50 0x7f469a2e30c4 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:373:15
#51 0x7f469a2e3253 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:170:36
#52 0x7f469a30d826 in operator() src/xpcom/threads/TaskController.cpp:84:37
#53 0x7f469a30d826 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
#54 0x7f469a2f7777 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1234:14
#55 0x7f469a2fcf8a in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:513:10
#56 0x7f469abf1f76 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
#57 0x7f469ab64c63 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#58 0x7f469ab64b7d in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
#59 0x7f469ab64b7d in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#60 0x7f469e7ded38 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#61 0x7f469ffc6253 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:913:20
#62 0x7f469abf2d39 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:237:9
#63 0x7f469ab64c63 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#64 0x7f469ab64b7d in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
#65 0x7f469ab64b7d in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#66 0x7f469ffc5e38 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:744:34
#67 0x55f4dc4cf917 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#68 0x55f4dc4cf917 in main src/browser/app/nsBrowserApp.cpp:304:18

Comment 1

[Emilio Cobos Álvarez (:emilio)]

This should be relatively easy to fix, probably the IsScrollingElement logic got out of sync with the overflow propagation code (and it shouldn't). Mats do you have the cycles to look at this? Feel free to ni? me back if not :)

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/OZRWSya_RWTp2v7Fr1JnEQ/index.html

Comment 3

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200917142508-084477976b2d.
The bug appears to have been introduced in the following build range:

Start: 11e97601cbca5bbe37c95f3272a80e30bbf7fc61 (20200731041113)
End: 750bc4c5c4ad53082f99a3afd836ef2a6cfd70ec (20200801094810)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=11e97601cbca5bbe37c95f3272a80e30bbf7fc61&tochange=750bc4c5c4ad53082f99a3afd836ef2a6cfd70ec

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1531609

Comment 5

[Julien Cristau [:jcristau]]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #1)

Mats do you have the cycles to look at this? Feel free to ni? me back if not :)

I'm guessing this means no?

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1665796 - Make sure Document::IsScrollingElement and overflow propagation code agree. r=mats

They got out of sync in bug 1635473. This needs a resolution to the spec
issue linked from the test before landing I suspect.

Comment 7

[Mats Palmgren (inactive)]

Well, it seems to me the real blame is bug 1654099, here's the changes you're correcting with your patch:
https://phabricator.services.mozilla.com/D84280
(which landed after I attached my patch in bug 1635473 so I wasn't really aware of those changes)

Comment 8

[Emilio Cobos Álvarez (:emilio)]

Ah, indeed, you're right.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2e15f7800a8f
Make sure Document::IsScrollingElement and overflow propagation code agree. r=mats

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/26277 for changes under testing/web-platform/tests

Comment 11

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/2e15f7800a8f

Comment 12

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 13

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20201025214116-61c35792ca70.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.