Closed Bug 1856755 Opened 9 months ago Closed 9 months ago

Assertion failure: cachedStyles[i]->EqualForCachedAnonymousContentStyle(*cs) (cached anonymous content styles should be identical to those we would compute normally), at /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4111

Categories

(Core :: CSS Parsing and Computation, defect, P2)

Product:
Core
Component:
CSS Parsing and Computation
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
120 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox118 --- unaffected
firefox119 --- unaffected
firefox120 --- verified

People

(Reporter: tsmith, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [fuzzblocker][bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(3 files)

testcase.html
80 bytes, text/html
Details
Bug 1856755 - Add faster multiplication and division for fixed-point values. r=jfkthame,jwatt,#layout
48 bytes, text/x-phabricator-request
Details | Review
Bug 1856755 - Implement an internal zoom: document value that forces effective zoom to 1. r=jfkthame
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Found while fuzzing m-c 20231002-24f12f75ef9b (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: cachedStyles[i]->EqualForCachedAnonymousContentStyle(*cs) (cached anonymous content styles should be identical to those we would compute normally), at /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4111

#0 0x7f2334099a10 in nsCSSFrameConstructor::GetAnonymousContent(nsIContent*, nsIFrame*, nsTArray<nsIAnonymousContentCreator::ContentInfo>&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4108:9
#1 0x7f233409881f in nsCSSFrameConstructor::BeginBuildingScrollFrame(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, mozilla::PseudoStyleType, bool, nsContainerFrame*&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4243:7
#2 0x7f233409c77e in nsCSSFrameConstructor::ConstructScrollableBlock(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4542:48
#3 0x7f233409d949 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:3759:16
#4 0x7f23340a24c5 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:5547:3
#5 0x7f2334092819 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:9491:5
#6 0x7f23340a6410 in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7162:3
#7 0x7f2334064390 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1660:25
#8 0x7f233406b434 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3241:9
#9 0x7f233403eb85 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3326:3
#10 0x7f233403dd1e in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4346:39
#11 0x7f2330365f52 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1472:5
#12 0x7f2330365f52 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:10921:16
#13 0x7f2331f43d10 in InitBasic /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:348:16
#14 0x7f2331f43d10 in mozilla::ContentEventHandler::InitCommon(mozilla::EventMessage, mozilla::SelectionType, bool) /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:421:17
#15 0x7f2331f443a9 in mozilla::ContentEventHandler::Init(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:493:17
#16 0x7f2331f480ab in mozilla::ContentEventHandler::OnQueryTextContent(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:1591:17
#17 0x7f2331f47741 in mozilla::ContentEventHandler::HandleQueryContentEvent(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/ContentEventHandler.cpp:1425:12
#18 0x7f2331fa06db in mozilla::IMEContentObserver::HandleQueryContentEvent(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:657:25
#19 0x7f2331f202a1 in mozilla::EventStateManager::HandleQueryContentEvent(mozilla::WidgetQueryContentEvent*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:1204:22
#20 0x7f2331f1f4ce in mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/dom/events/EventStateManager.cpp:699:5
#21 0x7f233405542d in mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager*, mozilla::WidgetEvent*, bool, nsEventStatus*, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8284:39
#22 0x7f233404efc6 in mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:8253:17
#23 0x7f233404f79a in mozilla::PresShell::EventHandler::HandleEventAtFocusedContent(mozilla::WidgetGUIEvent*, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:7999:7
#24 0x7f233404d14c in mozilla::PresShell::EventHandler::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6995:12
#25 0x7f233404c6eb in mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6913:23
#26 0x7f2333bdfe0e in nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:653:18
#27 0x7f2333bdfb69 in nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) /builds/worker/checkouts/gecko/view/nsView.cpp:1149:9
#28 0x7f2333c1a803 in mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) /builds/worker/checkouts/gecko/widget/PuppetWidget.cpp:348:37
#29 0x7f2333bfdbbd in mozilla::ContentCacheInChild::CacheText(nsIWidget*, mozilla::widget::IMENotification const*) /builds/worker/checkouts/gecko/widget/ContentCache.cpp:330:12
#30 0x7f2333bfd9fd in mozilla::ContentCacheInChild::CacheAll(nsIWidget*, mozilla::widget::IMENotification const*) /builds/worker/checkouts/gecko/widget/ContentCache.cpp:184:27
#31 0x7f2333c1c8bc in mozilla::widget::PuppetWidget::NotifyIMEOfFocusChange(mozilla::widget::IMENotification const&) /builds/worker/checkouts/gecko/widget/PuppetWidget.cpp:753:9
#32 0x7f2333c2ccaf in mozilla::widget::TextEventDispatcher::NotifyIME(mozilla::widget::IMENotification const&) /builds/worker/checkouts/gecko/widget/TextEventDispatcher.cpp:487:40
#33 0x7f2333bf2f2a in nsBaseWidget::NotifyIME(mozilla::widget::IMENotification const&) /builds/worker/checkouts/gecko/widget/nsBaseWidget.cpp:1897:43
#34 0x7f2331f9f424 in mozilla::IMEStateManager::NotifyIME(mozilla::widget::IMENotification const&, nsIWidget*, mozilla::dom::BrowserParent*) /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp
#35 0x7f2331fa673d in mozilla::IMEContentObserver::IMENotificationSender::SendFocusSet() /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:1846:3
#36 0x7f2331fa5f35 in mozilla::IMEContentObserver::IMENotificationSender::Run() /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:1716:5
#37 0x7f2331fa58af in mozilla::IMEContentObserver::TryToFlushPendingNotifications(bool) /builds/worker/checkouts/gecko/dom/events/IMEContentObserver.cpp:1542:17
#38 0x7f2331fae430 in mozilla::IMEStateManager::OnFocusInEditor(nsPresContext&, mozilla::dom::Element*, mozilla::EditorBase&) /builds/worker/checkouts/gecko/dom/events/IMEStateManager.cpp:974:32
#39 0x7f2333d7be14 in mozilla::EditorBase::OnFocus(nsINode const&) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:5879:3
#40 0x7f2333e059af in mozilla::HTMLEditor::OnFocus(nsINode const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditor.cpp:787:22
#41 0x7f2333d869ed in mozilla::EditorEventListener::Focus(mozilla::InternalFocusEvent const&) /builds/worker/checkouts/gecko/editor/libeditor/EditorEventListener.cpp:1170:47
#42 0x7f2333d859de in mozilla::EditorEventListener::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/editor/libeditor/EditorEventListener.cpp:471:21
#43 0x7f2333e65eca in mozilla::HTMLEditorEventListener::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorEventListener.cpp:102:42
#44 0x7f2331f90575 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1348:22
#45 0x7f2331f91674 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1663:12
#46 0x7f2331f90ee9 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1560:35
#47 0x7f2331f845df in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:465:5
#48 0x7f2331f845df in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:363:17
#49 0x7f2331f83824 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:527:12
#50 0x7f2331f84043 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:695:5
#51 0x7f2331f864af in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1222:11
#52 0x7f233061d4da in FocusBlurEvent::Run() /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:2743:12
#53 0x7f23300f35ec in nsContentUtils::AddScriptRunner(already_AddRefed<nsIRunnable>) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:6065:13
#54 0x7f23300f383a in nsContentUtils::AddScriptRunner(nsIRunnable*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:6071:3
#55 0x7f23305a6404 in nsFocusManager::FireFocusOrBlurEvent(mozilla::EventMessage, mozilla::PresShell*, mozilla::dom::EventTarget*, bool, bool, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:2884:3
#56 0x7f23305a54c9 in nsFocusManager::SendFocusOrBlurEvent(mozilla::EventMessage, mozilla::PresShell*, mozilla::dom::Document*, mozilla::dom::EventTarget*, bool, bool, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:2855:3
#57 0x7f233059c93b in nsFocusManager::Focus(nsPIDOMWindowOuter*, mozilla::dom::Element*, unsigned int, bool, bool, bool, bool, unsigned long, mozilla::Maybe<nsFocusManager::BlurredElementInfo> const&) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:2607:7
#58 0x7f23305a2de8 in nsFocusManager::WindowShown(mozIDOMWindowProxy*, bool) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:1006:7
#59 0x7f233018ebdb in nsGlobalWindowInner::SetReadyForFocus() /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:4468:9
#60 0x7f233403cae2 in mozilla::PresShell::UnsuppressAndInvalidate() /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4010:10
#61 0x7f23340bd615 in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1147:18
#62 0x7f23356c36d2 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6406:20
#63 0x7f23356c2adb in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5800:7
#64 0x7f23356c47a6 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
#65 0x7f232f74c629 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1380:3
#66 0x7f232f74bba2 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:978:14
#67 0x7f232f749d4b in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:795:9
#68 0x7f232f74aff4 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:678:5
#69 0x7f23356fa7df in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:13900:23
#70 0x7f232e97851f in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:631:22
#71 0x7f232e979a60 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:535:10
#72 0x7f233036adfc in mozilla::dom::Document::DoUnblockOnload() /builds/worker/checkouts/gecko/dom/base/Document.cpp:11706:18
#73 0x7f2330350f34 in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:8156:3
#74 0x7f2330400619 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1164:18
#75 0x7f2330400619 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#76 0x7f2330400619 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#77 0x7f2330400619 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#78 0x7f2330400619 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#79 0x7f2330400619 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
#80 0x7f2330400619 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1213:13
#81 0x7f232e73a587 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:559:16
#82 0x7f232e732143 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:886:26
#83 0x7f232e730987 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:709:15
#84 0x7f232e730de5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:495:36
#85 0x7f232e73e296 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
#86 0x7f232e73e296 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#87 0x7f232e754b0a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1198:16
#88 0x7f232e75bb3d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#89 0x7f232f40e3a5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#90 0x7f232f329041 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#91 0x7f232f329041 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#92 0x7f2333c4cd88 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#93 0x7f2335e83aab in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:721:20
#94 0x7f232f40f286 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#95 0x7f232f329041 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#96 0x7f232f329041 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#97 0x7f2335e83312 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:34
#98 0x561e0b010236 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#99 0x561e0b010236 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#100 0x7f2343c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#101 0x7f2343c29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#102 0x561e0afe5f68 in _start (/home/user/workspace/browsers/m-c-20231003213105-fuzzing-debug/firefox-bin+0x58f68) (BuildId: 6b74772e88d340d0726f6cc337da5f075b6ec527)
Flags: in-testsuite?
See Also: → 1856017

This is frequently hit by fuzzers, marking as fuzzblocker.

Whiteboard: [fuzzblocker]
Flags: needinfo?(emilio)

Verified bug as reproducible on mozilla-central 20231004035337-01abf9300140.
The bug appears to have been introduced in the following build range:

Start: 5ed78c90a6d60161e4d3428fa5eacf8b47241f9b (20230928102441)
End: a5fd40a8bf47afafdda240c7b8f1b1b911d2d937 (20230928114443)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5ed78c90a6d60161e4d3428fa5eacf8b47241f9b&tochange=a5fd40a8bf47afafdda240c7b8f1b1b911d2d937

Keywords: regression
Whiteboard: [fuzzblocker] → [fuzzblocker][bugmon:bisected,confirmed]
Blocks: csszoom
Flags: needinfo?(emilio)
Regressed by: 1854441

Even though I ended up not using the division code, it seems useful.

Assignee: nobody → emilio
Status: NEW → ASSIGNED

The name matches the value that webkit (but not blink) exposes to the
web. We don't expose it.

Filed https://github.com/w3c/csswg-drafts/issues/9435 for this.

Depends on D190024

Severity: -- → S3
Priority: -- → P2

Set release status flags based on info from the regressing bug 1854441

status-firefox118: --- → unaffected
status-firefox119: --- → unaffected
status-firefox-esr115: --- → unaffected
Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d39de6196338
Add faster multiplication and division for fixed-point values. r=jfkthame,layout-reviewers
https://hg.mozilla.org/integration/autoland/rev/15478746a3b5
Implement an internal zoom: document value that forces effective zoom to 1. r=jfkthame
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/42396 for changes under testing/web-platform/tests
Whiteboard: [fuzzblocker][bugmon:bisected,confirmed] → [fuzzblocker][bugmon:bisected,confirmed], [wptsync upstream]
Upstream PR was closed without merging
Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b7c0f05cc3d9
Add faster multiplication and division for fixed-point values. r=jfkthame,layout-reviewers
Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/3203468939ab
Implement an internal zoom: document value that forces effective zoom to 1. r=jfkthame
Flags: needinfo?(emilio)
Pushed by emilio@crisal.io:
https://hg.mozilla.org/integration/autoland/rev/311a5e3ecc9f
Fix browser_parsable_css.js to account for the previous patch.

https://hg.mozilla.org/mozilla-central/rev/b7c0f05cc3d9
https://hg.mozilla.org/mozilla-central/rev/3203468939ab
https://hg.mozilla.org/mozilla-central/rev/311a5e3ecc9f

Status: ASSIGNED → RESOLVED
Closed: 9 months ago
status-firefox120: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 120 Branch
Upstream PR merged by moz-wptsync-bot
Regressions: 1857901

Verified bug as fixed on rev mozilla-central 20231009093538-d5fd5e481ff2.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox120: fixed → verified
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: