Closed Bug 1719483 Opened 4 years ago Closed 3 years ago

Assertion failure: !mForbiddenToFlush (This is bad!), at /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4051

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
92 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- wontfix
firefox-esr91 --- wontfix
firefox90 --- wontfix
firefox91 --- wontfix
firefox92 --- verified

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Crash Data

Attachments

(2 files)

testcase.html
787 bytes, text/html
Details
Bug 1719483 - SVG observers shouldn't observe changes to anonymous content like scrollbars. r=dholbert
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Testcase found while fuzzing mozilla-central rev 152fdda295bb (built with --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 152fdda295bb --debug --fuzzing -n mc-debug
$ python -m grizzly.replay ./mc-debug/firefox ./testcase.html

Assertion failure: !mForbiddenToFlush (This is bad!), at /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4051

    #0 0x7fd63a4d73d6 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4051:3
    #1 0x7fd638bc1a88 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1402:5
    #2 0x7fd638bc1a88 in mozilla::dom::CanvasRenderingContext2D::UpdateFilter() /builds/worker/checkouts/gecko/dom/canvas/CanvasRenderingContext2D.cpp:2469:16
    #3 0x7fd63a7d89b1 in mozilla::SVGFilterObserverListForCanvasContext::OnRenderingChange() /builds/worker/checkouts/gecko/layout/svg/SVGObserverUtils.cpp:868:20
    #4 0x7fd63a7d79af in mozilla::SVGFilterObserver::OnRenderingChange() /builds/worker/checkouts/gecko/layout/svg/SVGObserverUtils.cpp:742:26
    #5 0x7fd63780c81b in operator() /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:148:3
    #6 0x7fd63780c81b in ForEachAncestorObserver<(lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:148:3)> /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:65:9
    #7 0x7fd63780c81b in Notify<IsRemoval::No, ShouldAssert::Yes, (lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:148:3), (lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:148:3)> /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:95:19
    #8 0x7fd63780c81b in mozilla::dom::MutationObservers::NotifyAttributeChanged(mozilla::dom::Element*, int, nsAtom*, int, nsAttrValue const*) /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:150:3
    #9 0x7fd6377acd5c in mozilla::dom::Element::SetAttrAndNotify(int, nsAtom*, nsAtom*, nsAttrValue const*, nsAttrValue&, nsIPrincipal*, unsigned char, bool, bool, bool, mozilla::dom::Document*, mozAutoDocUpdate const&) /builds/worker/checkouts/gecko/dom/base/Element.cpp:2518:5
    #10 0x7fd6377a8dec in mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool) /builds/worker/checkouts/gecko/dom/base/Element.cpp:2358:10
    #11 0x7fd63a64e8f3 in SetAttr /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:938:12
    #12 0x7fd63a64e8f3 in SetAttr /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:934:12
    #13 0x7fd63a64e8f3 in mozilla::ScrollFrameHelper::SetCoordAttribute(mozilla::dom::Element*, nsAtom*, int) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:6981:13
    #14 0x7fd63a644a74 in mozilla::ScrollFrameHelper::UpdateScrollbarPosition() /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:5620:5
    #15 0x7fd63a6416d0 in mozilla::ScrollFrameHelper::ScrollToImpl(nsPoint, nsRect const&, mozilla::ScrollOrigin) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:3173:5
    #16 0x7fd63a641bc4 in mozilla::ScrollFrameHelper::CompleteAsyncScroll(nsRect const&, mozilla::ScrollOrigin) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:2343:3
    #17 0x7fd63a642398 in mozilla::ScrollFrameHelper::ScrollToWithOrigin(nsPoint, mozilla::ScrollMode, mozilla::ScrollOrigin, nsRect const*, nsIScrollbarMediator::ScrollSnapMode) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:2455:5
    #18 0x7fd63a4d4fc0 in ScrollToShowRect /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:3472:23
    #19 0x7fd63a4d4fc0 in mozilla::PresShell::ScrollFrameRectIntoView(nsIFrame*, nsRect const&, nsMargin const&, mozilla::ScrollAxis, mozilla::ScrollAxis, mozilla::ScrollFlags) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:3645:9
    #20 0x7fd63a754096 in nsListControlFrame::ScrollToFrame(mozilla::dom::HTMLOptionElement&) /builds/worker/checkouts/gecko/layout/forms/nsListControlFrame.cpp:1805:16
    #21 0x7fd63a75171b in nsListControlFrame::ScrollToIndex(int) /builds/worker/checkouts/gecko/layout/forms/nsListControlFrame.cpp:1796:7
    #22 0x7fd63a7524e8 in nsListControlFrame::ResetList(bool) /builds/worker/checkouts/gecko/layout/forms/nsListControlFrame.cpp:978:7
    #23 0x7fd63a752d2f in nsListControlFrame::DidReflow(nsPresContext*, mozilla::ReflowInput const*) /builds/worker/checkouts/gecko/layout/forms/nsListControlFrame.cpp:1400:5
    #24 0x7fd63a5ec203 in nsContainerFrame::FinishReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput const&, mozilla::ReflowInput const*, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1149:14
    #25 0x7fd63a73c49a in nsComboboxControlFrame::ReflowDropdown(nsPresContext*, mozilla::ReflowInput const&) /builds/worker/checkouts/gecko/layout/forms/nsComboboxControlFrame.cpp:460:3
    #26 0x7fd63a73d77f in nsComboboxControlFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/forms/nsComboboxControlFrame.cpp:844:3
    #27 0x7fd63a6e54fc in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:875:13
    #28 0x7fd63a5dfa5f in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4548:15
    #29 0x7fd63a5defa6 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4350:5
    #30 0x7fd63a5db030 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4235:9
    #31 0x7fd63a5d7750 in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3215:5
    #32 0x7fd63a5d210b in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2749:7
    #33 0x7fd63a5cdc5b in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1380:3
    #34 0x7fd63a5f1370 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1000:14
    #35 0x7fd63a74d40c in nsHTMLButtonControlFrame::ReflowButtonContents(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsIFrame*) /builds/worker/checkouts/gecko/layout/forms/nsHTMLButtonControlFrame.cpp:228:3
    #36 0x7fd63a74cca6 in nsHTMLButtonControlFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/forms/nsHTMLButtonControlFrame.cpp:173:3
    #37 0x7fd63a6e54fc in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:875:13
    #38 0x7fd63a5dfa5f in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4548:15
    #39 0x7fd63a5defa6 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowInput&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4350:5
    #40 0x7fd63a5db030 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4235:9
    #41 0x7fd63a5d7750 in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3215:5
    #42 0x7fd63a5d210b in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:2749:7
    #43 0x7fd63a5cdc5b in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1380:3
    #44 0x7fd63a5f1370 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1000:14
    #45 0x7fd63a5f077a in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:819:7
    #46 0x7fd63a5f1370 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1000:14
    #47 0x7fd63a6359b9 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:758:3
    #48 0x7fd63a636339 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:881:3
    #49 0x7fd63a63a7d9 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:1300:3
    #50 0x7fd63a5c2c68 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1040:14
    #51 0x7fd63a5c250c in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:374:7
    #52 0x7fd63a4cdd6c in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9570:11
    #53 0x7fd63a4d7bee in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9741:24
    #54 0x7fd63a4d70eb in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4229:11
    #55 0x7fd63a49f6cf in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1411:5
    #56 0x7fd63a49f6cf in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2328:20
    #57 0x7fd63a4a783a in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:348:13
    #58 0x7fd63a4a783a in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:326:7
    #59 0x7fd63a4a7753 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:342:5
    #60 0x7fd63a4a7620 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:775:5
    #61 0x7fd63a4a6c88 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:704:16
    #62 0x7fd63a4a6570 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:617:7
    #63 0x7fd63a4a5fe9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:538:9
    #64 0x7fd639cc65a6 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncChild.cpp:68:15
    #65 0x7fd6369c9334 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
    #66 0x7fd6367907dc in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6091:32
    #67 0x7fd636402f11 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2085:25
    #68 0x7fd6363ff811 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2012:9
    #69 0x7fd636400d4d in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1860:3
    #70 0x7fd636401acb in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1891:13
    #71 0x7fd635afc99e in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:502:16
    #72 0x7fd635ada6b9 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:805:26
    #73 0x7fd635ad9528 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:641:15
    #74 0x7fd635ad97a3 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:425:36
    #75 0x7fd635b00196 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:135:37
    #76 0x7fd635b00196 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
    #77 0x7fd635aec10f in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1152:16
    #78 0x7fd635af2d4a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #79 0x7fd6364090b6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #80 0x7fd636362fb7 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #81 0x7fd636362ed2 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #82 0x7fd636362ed2 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #83 0x7fd63a1d4cc8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #84 0x7fd63bb84dd3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:910:20
    #85 0x7fd636409faa in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
    #86 0x7fd636362fb7 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #87 0x7fd636362ed2 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #88 0x7fd636362ed2 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #89 0x7fd63bb849ee in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:742:34
    #90 0x55bde3554c56 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #91 0x55bde3554c56 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:327:18
    #92 0x7fd64ac4c0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
Flags: in-testsuite?
Crash Signature: [@ mozilla::PresShell::DoFlushPendingNotifications]
Keywords: crash
See Also: → 1714290

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210708154614-ab46ef66acce.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 37e052bd233427ba430c094622cd7cb44377752c (20200709040358)
End: a2e6beb5031bdc394cce20c5a755cd34db3d6168 (20210707095209)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
See Also: → 1719744

This is a regression, it just goes further back than bugmon happened to explore.

I ran the following to get a nightly regression range (for opt builds, so not necessarily the same issue as the assertion-failure but likely related). My command:

mozregression --good 2019-01-01 --pref "security.sandbox.content.level:0" -a https://bugzilla.mozilla.org/attachment.cgi?id=9230093

...and got:
INFO: Last good revision: 1d189ae70326e415f8590e3aeee24885fb8418bc (2019-09-26)
INFO: First bad revision: d23a0a0ffa93fe273c571592bdbff6aa68f6ca2b (2019-09-27)
INFO: Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1d189ae70326e415f8590e3aeee24885fb8418bc&tochange=d23a0a0ffa93fe273c571592bdbff6aa68f6ca2b

In that pushlog... Given the mention of scrolling in the crash backtrace (comment 0, levels 13-21) and the reentrancy (levels 1 and 55), my first guess is that this might be related to "Bug 1578933 - Run scroll anchoring adjustments when blocking script. r=dholbert"

emilio, this feels like it's in your wheelhouse perhaps?

Flags: needinfo?(emilio)
Severity: -- → S3
Flags: needinfo?(emilio)

Scrollbar attribute changes run at uncommon times, and SVG shouldn't
really need to care about them (reflowing the relevant nodes should
trigger an observer invalidation).

Assignee: nobody → emilio
Status: NEW → ASSIGNED
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/29899 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]
Pushed by nbeleuzu@mozilla.com: https://hg.mozilla.org/mozilla-central/rev/25ea95b0efd9 SVG observers shouldn't observe changes to anonymous content like scrollbars. r=dholbert

https://hg.mozilla.org/mozilla-central/rev/25ea95b0efd9

Status: ASSIGNED → RESOLVED
Closed: 3 years ago
status-firefox92: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 92 Branch
Upstream PR merged by moz-wptsync-bot
Has Regression Range: --- → yes

Bugmon Analysis
Bug appears to be fixed on mozilla-central 20210804214554-a72c2fe44761 but BugMon was unable to reproduce using None.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

status-firefox92: fixed → verified
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: