Closed Bug 1694459 Opened 3 years ago Closed 3 years ago

use-after-poison in [@ nsCSSFrameConstructor::ContentRemoved]

Categories

(Core :: Layout, defect, P3)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
88 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- unaffected
firefox86 --- unaffected
firefox87 --- wontfix
firefox88 --- fixed

People

(Reporter: tsmith, Assigned: MatsPalmgren_bugz)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords)

Crash Data

Attachments

(3 files)

testcase.html
263 bytes, text/html
Details
Testcase #2
356 bytes, text/html
Details
Bug 1694459 - Deal with 'display:contents' style changes on <fieldset> descendants better where it affects which <legend> is the rendered legend. r=emilio
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html — 
==9914==ERROR: AddressSanitizer: use-after-poison on address 0x62500023d798 at pc 0x7f7bfe288858 bp 0x7fff72d31670 sp 0x7fff72d31668
READ of size 8 at 0x62500023d798 thread T0 (Web Content)
    #0 0x7f7bfe288857 in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /gecko/layout/base/nsCSSFrameConstructor.cpp:7403:33
    #1 0x7f7bfe287ee0 in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /gecko/layout/base/nsCSSFrameConstructor.cpp:7357:31
    #2 0x7f7bfe27d347 in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /gecko/layout/base/nsCSSFrameConstructor.cpp:8476:7
    #3 0x7f7bfe21b0f0 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /gecko/layout/base/RestyleManager.cpp:1489:25
    #4 0x7f7bfe2242e3 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /gecko/layout/base/RestyleManager.cpp:3034:9
    #5 0x7f7bfe1ea9c3 in ProcessPendingRestyles /gecko/layout/base/RestyleManager.cpp:3113:3
    #6 0x7f7bfe1ea9c3 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /gecko/layout/base/PresShell.cpp:4215:39
    #7 0x7f7bf977a434 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1425:5
    #8 0x7f7bf977a434 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /gecko/dom/base/Document.cpp:10331:16
    #9 0x7f7bfe1e4597 in mozilla::PresShell::ScrollContentIntoView(nsIContent*, mozilla::ScrollAxis, mozilla::ScrollAxis, mozilla::ScrollFlags) /gecko/layout/base/PresShell.cpp:3551:16
    #10 0x7f7bf97b9bb2 in mozilla::dom::Element::ScrollIntoView(mozilla::dom::ScrollIntoViewOptions const&) /gecko/dom/base/Element.cpp:739:14
    #11 0x7f7bf97b98a3 in mozilla::dom::Element::ScrollIntoView(mozilla::dom::BooleanOrScrollIntoViewOptions const&) /gecko/dom/base/Element.cpp:667:12
    #12 0x7f7bfaf1945b in mozilla::dom::Element_Binding::scrollIntoView(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/ElementBinding.cpp:3012:24
    #13 0x7f7bfb302cb3 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3235:13
    #14 0x7f7c019d22a6 in CallJSNative /gecko/js/src/vm/Interpreter.cpp:435:13
    #15 0x7f7c019d22a6 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:520:12
    #16 0x7f7c019d403e in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:580:10
    #17 0x7f7c019bd32d in CallFromStack /gecko/js/src/vm/Interpreter.cpp:584:10
    #18 0x7f7c019bd32d in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3243:16
    #19 0x7f7c019a1093 in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:405:13
    #20 0x7f7c019d23d6 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:552:13
    #21 0x7f7c019d403e in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:580:10
    #22 0x7f7c019d42bb in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:597:8
    #23 0x7f7c02253262 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/jsapi.cpp:2863:10
    #24 0x7f7bfab66250 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:871:8
    #25 0x7f7bf965daff in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:783:12
    #26 0x7f7bf97f7982 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:796:12
    #27 0x7f7bf97f7982 in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) /gecko/dom/base/IdleRequest.cpp:61:13
    #28 0x7f7bf9567d97 in nsGlobalWindowInner::RunIdleRequest(mozilla::dom::IdleRequest*, double, bool) /gecko/dom/base/nsGlobalWindowInner.cpp:744:12
    #29 0x7f7bf9566c63 in nsGlobalWindowInner::ExecuteIdleRequest(mozilla::TimeStamp) /gecko/dom/base/nsGlobalWindowInner.cpp:772:3
    #30 0x7f7bf9566a95 in IdleRequestExecutor::Run() /gecko/dom/base/nsGlobalWindowInner.cpp:613:13
    #31 0x7f7bf63185c6 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:472:16
    #32 0x7f7bf6315183 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:760:26
    #33 0x7f7bf63131ed in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:634:15
    #34 0x7f7bf63134ad in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:395:36
    #35 0x7f7bf631fc01 in operator() /gecko/xpcom/threads/TaskController.cpp:133:37
    #36 0x7f7bf631fc01 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /gecko/xpcom/threads/nsThreadUtils.h:534:5
    #37 0x7f7bf633af54 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1158:16
    #38 0x7f7bf6344eac in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #39 0x7f7bf75530ef in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:87:21
    #40 0x7f7bf745d6b1 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #41 0x7f7bf745d6b1 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #42 0x7f7bf745d6b1 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #43 0x7f7bfdcc5a87 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
    #44 0x7f7c0177a2bf in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:902:20
    #45 0x7f7bf745d6b1 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #46 0x7f7bf745d6b1 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #47 0x7f7bf745d6b1 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #48 0x7f7c01779a4f in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:733:34
    #49 0x55a9a8eb533d in content_process_main(mozilla::Bootstrap*, int, char**) /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #50 0x55a9a8eb5761 in main /gecko/browser/app/nsBrowserApp.cpp:306:18
    #51 0x7f7c162ca0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #52 0x55a9a8e08cd9 in _start (/home/worker/builds/m-c-20210223085042-fuzzing-asan-opt/firefox+0x59cd9)

0x62500023d798 is located 3736 bytes inside of 8192-byte region [0x62500023c900,0x62500023e900)
allocated by thread T0 (Web Content) here:
    #0 0x55a9a8e82b6d in malloc /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x7f7bf62faf30 in mozilla::ArenaAllocator<8192ul, 8ul>::AllocateChunk(unsigned long) /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:170:15
    #2 0x7f7bfe315e7d in InternalAllocate /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:204:25
    #3 0x7f7bfe315e7d in Allocate /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:66:12
    #4 0x7f7bfe315e7d in mozilla::ArenaAllocator<8192ul, 8ul>::Allocate(unsigned long) /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:70:15
    #5 0x7f7bfe391035 in AllocateByObjectID /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:273:32
    #6 0x7f7bfe391035 in AllocateFrame /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:265:12
    #7 0x7f7bfe391035 in operator new /gecko/layout/generic/ViewportFrame.cpp:36:1
    #8 0x7f7bfe391035 in NS_NewViewportFrame(mozilla::PresShell*, mozilla::ComputedStyle*) /gecko/layout/generic/ViewportFrame.cpp:33:10
    #9 0x7f7bfe26e362 in nsCSSFrameConstructor::ConstructRootFrame() /gecko/layout/base/nsCSSFrameConstructor.cpp:2422:7
    #10 0x7f7bfe1d7c2b in mozilla::PresShell::Initialize() /gecko/layout/base/PresShell.cpp:1879:36
    #11 0x7f7bf996a1d7 in nsContentSink::StartLayout(bool) /gecko/dom/base/nsContentSink.cpp:1136:30
    #12 0x7f7bf86a24b9 in nsHtml5TreeOpExecutor::StartLayout(bool*) /gecko/parser/html/nsHtml5TreeOpExecutor.cpp:794:18
==9914==WARNING: Symbolizer buffer too small
    #13 0x7f7bf86ace32  (/home/worker/builds/m-c-20210223085042-fuzzing-asan-opt/libxul.so+0x73c9e32)
==9914==WARNING: Symbolizer buffer too small
    #14 0x7f7bf86a1162  (/home/worker/builds/m-c-20210223085042-fuzzing-asan-opt/libxul.so+0x73be162)
    #15 0x7f7bf86a0402 in umberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:278:14
    #16 0x7f7bf86a0402 in match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:278:14
    #17 0x7f7bf86a0402 in decltype(auto) mozilla::detail::VariantImplementation<unsigned char, 7ul, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu>::match<nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**, bool*, bool*)::TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu>&>(nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**, bool*, bool*)::TreeOperationMatcher&&, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opSetDocumentCharset, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu>&) /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:278:14
    #18 0x7f7bf86a7356 in nsHtml5TreeOpExecutor::RunFlushLoop() /gecko/parser/html/nsHtml5TreeOpExecutor.cpp:613:19
    #19 0x7f7bf630ccac in nsHtml5ExecutorFlusher::Run() /gecko/parser/html/nsHtml5StreamParser.cpp:176:18
    #20 0x7f7bf63185c6 in mozilla::SchedulerGroup::Runnable::Run() /gecko/xpcom/threads/SchedulerGroup.cpp:146:20
    #21 0x7f7bf6315183 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:472:16
    #22 0x7f7bf6313057 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:760:26
    #23 0x7f7bf63134ad in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:611:15
    #24 0x7f7bf631fc01 in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:395:36
    #25 0x7f7bf633af54 in operator() /gecko/xpcom/threads/TaskController.cpp:133:37
    #26 0x7f7bf633af54 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /gecko/xpcom/threads/nsThreadUtils.h:534:5
    #27 0x7f7bf6344eac in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:548:10
Flags: in-testsuite?
Crash Signature: [nsCSSFrameConstructor::ContentRemoved] → [@ nsCSSFrameConstructor::ContentRemoved]
Has Regression Range: --- → yes

In a debug build I get:

Assertion failure: mFrames.IsEmpty() (unexpected second call to SetInitialChildList), at nsContainerFrame.cpp:85

from the call here:
https://searchfox.org/mozilla-central/rev/a6db3bd67367aa9ddd9505690cab09b47e65a762/layout/base/nsCSSFrameConstructor.cpp#9345
because the (outer) fieldset already has a child frame (its anon block)...

So, before the display change we have a frame tree like so:

FieldSet(fieldset) <
  Block(fieldset):-moz-fieldset-content <
    FieldSet(fieldset) <
      Block(legend) <
      >
      Block(fieldset):-moz-fieldset-content <
      >
    >
  >

then we destroy the inner fieldset frame tree, leaving us with just the outer two frames, in which we try to create frames for the inner fieldset with the new display:contents style, which leads to creating a frame for just the legend at the line above...
Hmm, I'll look into how this used to be handled before...

Assignee: nobody → mats
Severity: -- → S3
Flags: needinfo?(mats)
OS: Unspecified → All
Priority: -- → P3
Hardware: Unspecified → All
Attached file Testcase #2 —

Turns out that we failed to handle this case correctly before. This test is the same as the first, but stops after setting the display:contents style. In an old build this makes the legend a regular child frame inside the outer fieldset's anon block, not its rendered legend. However, after toggling display on <body> to recreate the frame tree then it ends up as the rendered legend. Clearly that shouldn't make a difference.

A Pernosco session is available here: https://pernos.co/debug/bLEqBbkAJNsAJgrGhzCUhg/index.html

Sorry for the delay, seems the first submission failed.

So, the root of the problem is this check that existed already before bug 1683748:
https://searchfox.org/mozilla-central/rev/6f8f3d0e9022b6f0405da26ec940a89455416202/layout/base/nsCSSFrameConstructor.cpp#6926
It doesn't catch the <fieldset><x style="display:contents"><legend> case at all, only direct <legend> children.
As demonstrated by Testcase #2 above, we produced the wrong frame tree even before. In bug 1683748 I made the assumption this was already working so now we ended up with this crash instead (the SetInitialChildList overwriting existing child frame(s)).

I've added code in WipeContainingBlock to detect this case. There we're dealing with fctor items, so display:contents intermediaries don't interfere. As noted in the XXX comment, I think it would be somewhat easy to make these checks exclude fieldsets that currently don't have a rendered legend since we now handle that by prepending the legend frame. However, when I tried that I discovered that ContentRangeInserted uses the wrong content insertion frame, probably just because nsFieldSetFrame doesn't implement GetContentInsertionFrame() due to the "multiple insertion points" conundrum. Maybe I'll make an attempt at fixing that in a follow-up bug... (not so much because of the perf improvement for this edge case, but to make nsFieldSetFrame box construction less complicated and special)

Notes on the WPTs: I removed layout/reftests/bugs/403733-1.html and incorporated that case as #test11 in display-contents-dynamic-fieldset-legend-001.html. I moved layout/reftests/css-display/display-contents-fieldset.html into WPT (verbatim with some added <link>s).
Both the WPTs pass in Chrome AFAICT by ocular inspection.

Pushed by mpalmgren@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/867abe6c80a3
Deal with 'display:contents' style changes on <fieldset> descendants better where it affects which <legend> is the rendered legend.  r=emilio
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/27829 for changes under testing/web-platform/tests

https://hg.mozilla.org/mozilla-central/rev/867abe6c80a3

Status: NEW → RESOLVED
Closed: 3 years ago
status-firefox88: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 88 Branch
Upstream PR merged by moz-wptsync-bot

The patch landed in nightly and beta is affected.
:mats, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Flags: needinfo?(mats)
status-firefox86: --- → unaffected
status-firefox87: affected → wontfix
status-firefox-esr78: --- → unaffected
Flags: needinfo?(mats)
Flags: in-testsuite?
Flags: in-testsuite+

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210301093612-867abe6c80a3.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: