1854757 - Hit MOZ_CRASH(Should've handled snapshots here already) at /builds/worker/checkouts/gecko/servo/components/style/traversal.rs:406

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20230922-aee77156969b (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting:

• https://airbnb.com

Hit MOZ_CRASH(Should've handled snapshots here already) at /builds/worker/checkouts/gecko/servo/components/style/traversal.rs:406

#0 0x7f89e48d8835 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:281:3
#1 0x7f89e48d8835 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7f89e48d87ca in mozglue_static::panic_hook::habfbf582d66d5c86 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:96:9
#3 0x7f89e48d81cb in core::ops::function::Fn::call::h081d0c2d4ea076dc /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/core/src/ops/function.rs:79:5
#4 0x7f89e593582d in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::hb3a915ffd78277c6 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/alloc/src/boxed.rs:2007:9
#5 0x7f89e593582d in std::panicking::rust_panic_with_hook::h75cd912a39a34e8a /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/panicking.rs:709:13
#6 0x7f89e505a58b in std::panicking::begin_panic::_$u7b$$u7b$closure$u7d$$u7d$::heb834254fce8a264 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/panicking.rs:626:9
#7 0x7f89e5059998 in std::sys_common::backtrace::__rust_end_short_backtrace::h89c3b6ea0f099f52 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/sys_common/backtrace.rs:151:18
#8 0x7f89e505a55c in std::panicking::begin_panic::hf8788059a53c19a0 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/panicking.rs:625:12
#9 0x7f89e510a1a0 in style::traversal::recalc_style_at::hc46a1a2822917ab5 /builds/worker/checkouts/gecko/servo/components/style/traversal.rs:406:5
#10 0x7f89e510a1a0 in _$LT$style..gecko..traversal..RecalcStyleOnly$u20$as$u20$style..traversal..DomTraversal$LT$style..gecko..wrapper..GeckoElement$GT$$GT$::process_preorder::h56738c826174291d /builds/worker/checkouts/gecko/servo/components/style/gecko/traversal.rs:37:13
#11 0x7f89e510a1a0 in style::parallel::style_trees::hdceefa5a82b6ff15 /builds/worker/checkouts/gecko/servo/components/style/parallel.rs:158:9
#12 0x7f89e50dd993 in style::driver::traverse_dom::_$u7b$$u7b$closure$u7d$$u7d$::he6e5c1e1fa1e4c71 /builds/worker/checkouts/gecko/servo/components/style/driver.rs:123:9
#13 0x7f89e50dd08a in style::driver::with_pool_in_place_scope::_$u7b$$u7b$closure$u7d$$u7d$::h9abe3de80c1c93bb /builds/worker/checkouts/gecko/servo/components/style/driver.rs:58:13
#14 0x7f89e50dd08a in rayon_core::scope::do_in_place_scope_fifo::_$u7b$$u7b$closure$u7d$$u7d$::hb017802fd97e6bd4 /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/scope/mod.rs:477:36
#15 0x7f89e50dd08a in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h99c3ec31ae87ada8 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/core/src/panic/unwind_safe.rs:271:9
#16 0x7f89e50dd08a in std::panicking::try::do_call::h233ec1d556b0c028 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/panicking.rs:500:40
#17 0x7f89e50dd08a in std::panicking::try::h32d1c7abc02835dd /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/panicking.rs:464:19
#18 0x7f89e50dd08a in std::panic::catch_unwind::h1454d2417e864330 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/panic.rs:142:14
#19 0x7f89e50dd08a in rayon_core::unwind::halt_unwinding::heb468a9ee81985de /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/unwind.rs:17:5
#20 0x7f89e50dd08a in rayon_core::scope::ScopeBase::execute_job_closure::h8080f45c4c0aa89c /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/scope/mod.rs:713:15
#21 0x7f89e50dd08a in rayon_core::scope::ScopeBase::complete::h72a9fb62504d74d6 /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/scope/mod.rs:691:31
#22 0x7f89e50dd08a in rayon_core::scope::do_in_place_scope_fifo::h5138d2f54e9b04d7 /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/scope/mod.rs:477:5
#23 0x7f89e50dd08a in rayon_core::thread_pool::ThreadPool::in_place_scope_fifo::hc0db5847580239e3 /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/thread_pool/mod.rs:296:9
#24 0x7f89e50dd08a in style::driver::with_pool_in_place_scope::h4c1dbc65cbc37458 /builds/worker/checkouts/gecko/servo/components/style/driver.rs:57:23
#25 0x7f89e50dd08a in style::driver::traverse_dom::h6d2f9d02611673b3 /builds/worker/checkouts/gecko/servo/components/style/driver.rs:112:5
#26 0x7f89e519c462 in geckoservo::glue::traverse_subtree::h865256b0f386720b /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:292:5
#27 0x7f89e519c957 in Servo_TraverseSubtree /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:352:5
#28 0x7f89dfef7f1d in mozilla::ServoStyleSet::StyleDocument(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/style/ServoStyleSet.cpp:819:9
#29 0x7f89dffb9850 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3188:20
#30 0x7f89dff8d301 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3326:3
#31 0x7f89dff8c4a7 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4345:39
#32 0x7f89dde794fd in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1463:5
#33 0x7f89dde794fd in mozilla::EventStateManager::FlushLayout(nsPresContext*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:6032:16
#34 0x7f89dde75a2f in mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:849:7
#35 0x7f89dffa3b5d in mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager*, mozilla::WidgetEvent*, bool, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8254:39
#36 0x7f89dff9d6cf in mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8223:17
#37 0x7f89dff9ced2 in mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7171:30
#38 0x7f89dff9b8c8 in mozilla::PresShell::EventHandler::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6969:12
#39 0x7f89dff9ae7b in mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6912:23
#40 0x7f89dfb2f33e in nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:653:18
#41 0x7f89dfb2f099 in nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) /builds/worker/checkouts/gecko/view/nsView.cpp:1149:9
#42 0x7f89dfb69ea3 in mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) /builds/worker/checkouts/gecko/widget/PuppetWidget.cpp:348:37
#43 0x7f89db931d0b in mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&) /builds/worker/checkouts/gecko/gfx/layers/apz/util/APZCCallbackHelper.cpp:506:21
#44 0x7f89df2b4017 in DispatchWidgetEventViaAPZ /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1694:10
#45 0x7f89df2b4017 in mozilla::dom::BrowserChild::HandleRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1657:3
#46 0x7f89df2b576b in mozilla::dom::BrowserChild::RecvRealMouseButtonEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1624:3
#47 0x7f89df2b58d8 in mozilla::dom::BrowserChild::RecvSynthMouseMoveEvent(mozilla::WidgetMouseEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:1589:8
#48 0x7f89df3eb2ac in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBrowserChild.cpp:5455:80
#49 0x7f89df4783f0 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8655:32
#50 0x7f89db1a1b4f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#51 0x7f89db19e8a2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#52 0x7f89db19f522 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#53 0x7f89db1a066f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#54 0x7f89da4d79c7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:559:16
#55 0x7f89da4cf543 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:886:26
#56 0x7f89da4cdd97 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:709:15
#57 0x7f89da4ce1f5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:495:36
#58 0x7f89da4db6e6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
#59 0x7f89da4db6e6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#60 0x7f89da4f1f0a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#61 0x7f89da4f8dfd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#62 0x7f89db1a7ab5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#63 0x7f89db0c2571 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#64 0x7f89db0c2571 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#65 0x7f89dfb9c348 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#66 0x7f89e1dbc66b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:721:20
#67 0x7f89db1a8996 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#68 0x7f89db0c2571 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#69 0x7f89db0c2571 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#70 0x7f89e1dbbe8e in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:34
#71 0x56044765b926 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#72 0x56044765b926 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#73 0x7f89ee9ead8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#74 0x7f89ee9eae3f in __libc_start_main csu/../csu/libc-start.c:392:3
#75 0x560447632bc8 in _start (/home/worker/build/firefox-bin+0x58bc8) (BuildId: 242d1494e8d28b9ab504b9ae1ffc88df0f7435fd)

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/Ua1JZ4La-xauxq1-woBGgg/index.html

Comment 2

[Emilio Cobos Álvarez (:emilio)]

This is a regression from :has(). In bug 1792501 we started taking snapshots of some nodes with no style data for :has() purposes. Since there is no style data, we don't process the regular invalidations and this assert fails. I think it's harmless tho, since we're styling the element for the first time. So I think we should just relax the assertion a little bit.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1854757 - Relax assert to account for snapshots that we take for relative selector invalidation. r=dshin,#style,#layout

Not sure how easy would it be to construct a test-case for this...

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Tyson, have fuzzers seen this? If not, are fuzzers testing :has()? If not, we should add this.

Comment 5

[Tyson Smith [:tsmith]]

Good question.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/df16a50988c7
Relax assert to account for snapshots that we take for relative selector invalidation. r=dshin

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/df16a50988c7

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1792501