1883796 - Hit MOZ_CRASH(assertion `left == right` failed: Linkness mismatch left: false right: true) at /builds/worker/checkouts/gecko/servo/components/style/sharing/mod.rs:911

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240113-23a77d3c25d7 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(assertion left == right failed: Linkness mismatch left: false right: true) at /builds/worker/checkouts/gecko/servo/components/style/sharing/mod.rs:911

#0 0x7fd86c9e8b55 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:301:3
#1 0x7fd86c9e8b55 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7fd86c9e844b in mozglue_static::panic_hook::h08f0b8cf893a7d1b /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:96:9
#3 0x7fd86c9e844b in core::ops::function::Fn::call::h470351fe87853971 /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/core/src/ops/function.rs:79:5
#4 0x7fd86da606d5 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::hbc5ccf4eb663e1e5 /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/alloc/src/boxed.rs:2029:9
#5 0x7fd86da606d5 in std::panicking::rust_panic_with_hook::h095fccf1dc9379ee /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/std/src/panicking.rs:783:13
#6 0x7fd86da60421 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h032ba12139b353db /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/std/src/panicking.rs:657:13
#7 0x7fd86da5d915 in std::sys_common::backtrace::__rust_end_short_backtrace::h9259bc2ff8fd0f76 /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/std/src/sys_common/backtrace.rs:171:18
#8 0x7fd86da6017f in rust_begin_unwind /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/std/src/panicking.rs:645:5
#9 0x7fd86daac174 in core::panicking::panic_fmt::h784f20a50eaab275 /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/core/src/panicking.rs:72:14
#10 0x7fd86daac7ee in core::panicking::assert_failed_inner::hbf94b40c37b92af0 /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/core/src/panicking.rs:337:23
#11 0x7fd86d242227 in core::panicking::assert_failed::hbe0e339af7c6170a /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/core/src/panicking.rs:297:5
#12 0x7fd86d28b93f in style::sharing::StyleSharingCache$LT$E$GT$::lookup_by_rules::_$u7b$$u7b$closure$u7d$$u7d$::h4ba1cef89e920144 /builds/worker/checkouts/gecko/servo/components/style/sharing/mod.rs:911:13
#13 0x7fd86d28b93f in uluru::LRUCache$LT$T$C$_$GT$::lookup::h2a4afa8834a7f1f9 /builds/worker/checkouts/gecko/third_party/rust/uluru/src/lib.rs:142:30
#14 0x7fd86d28b93f in style::sharing::StyleSharingCache$LT$E$GT$::lookup_by_rules::h09a64f229e81dafc /builds/worker/checkouts/gecko/servo/components/style/sharing/mod.rs:873:9
#15 0x7fd86d28b93f in style::style_resolver::StyleResolverForElement$LT$E$GT$::cascade_primary_style::hf68b04ababa1ac37 /builds/worker/checkouts/gecko/servo/components/style/style_resolver.rs:232:26
#16 0x7fd86d289498 in style::style_resolver::StyleResolverForElement$LT$E$GT$::cascade_styles_with_default_parents::_$u7b$$u7b$closure$u7d$$u7d$::h9f2308c1c83a0b79 /builds/worker/checkouts/gecko/servo/components/style/style_resolver.rs:381:17
#17 0x7fd86d289498 in style::style_resolver::with_default_parent_styles::haf079315924a4abc /builds/worker/checkouts/gecko/servo/components/style/style_resolver.rs:118:5
#18 0x7fd86d2baa93 in style::style_resolver::StyleResolverForElement$LT$E$GT$::cascade_styles_with_default_parents::hd7ca15db11477d9b /builds/worker/checkouts/gecko/servo/components/style/style_resolver.rs:379:9
#19 0x7fd86d2baa93 in style::traversal::compute_style::h8a5851a7dcef8609 /builds/worker/checkouts/gecko/servo/components/style/traversal.rs:656:26
#20 0x7fd86d2b8b31 in style::traversal::recalc_style_at::hd519f2df504707be /builds/worker/checkouts/gecko/servo/components/style/traversal.rs:428:13
#21 0x7fd86d2b8b31 in _$LT$style..gecko..traversal..RecalcStyleOnly$u20$as$u20$style..traversal..DomTraversal$LT$style..gecko..wrapper..GeckoElement$GT$$GT$::process_preorder::h2623a96c05925a03 /builds/worker/checkouts/gecko/servo/components/style/gecko/traversal.rs:37:13
#22 0x7fd86d2b8b31 in style::parallel::style_trees::h055219bed5b3269f /builds/worker/checkouts/gecko/servo/components/style/parallel.rs:158:9
#23 0x7fd86d296301 in style::driver::traverse_dom::_$u7b$$u7b$closure$u7d$$u7d$::haf9c599fcac32d92 /builds/worker/checkouts/gecko/servo/components/style/driver.rs:126:9
#24 0x7fd86d295938 in style::driver::with_pool_in_place_scope::_$u7b$$u7b$closure$u7d$$u7d$::hb16eeee5321a4807 /builds/worker/checkouts/gecko/servo/components/style/driver.rs:58:42
#25 0x7fd86d295938 in rayon_core::scope::do_in_place_scope_fifo::_$u7b$$u7b$closure$u7d$$u7d$::hbcdb8658f4559a30 /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/scope/mod.rs:457:36
#26 0x7fd86d295938 in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hfe1802860a66470c /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/core/src/panic/unwind_safe.rs:272:9
#27 0x7fd86d295938 in std::panicking::try::do_call::habfd349fa7c8ec0e /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/std/src/panicking.rs:552:40
#28 0x7fd86d295938 in std::panicking::try::h403f1c51caa596b9 /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/std/src/panicking.rs:516:19
#29 0x7fd86d295938 in std::panic::catch_unwind::h168eb30c9bacda27 /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/std/src/panic.rs:142:14
#30 0x7fd86d295938 in rayon_core::unwind::halt_unwinding::h716897675095d479 /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/unwind.rs:17:5
#31 0x7fd86d295938 in rayon_core::scope::ScopeBase::execute_job_closure::h588014be5e3b899d /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/scope/mod.rs:689:28
#32 0x7fd86d295938 in rayon_core::scope::ScopeBase::complete::h6856a76105c5f568 /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/scope/mod.rs:667:31
#33 0x7fd86d295938 in rayon_core::scope::do_in_place_scope_fifo::h51eb1909248435f9 /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/scope/mod.rs:457:5
#34 0x7fd86d295938 in rayon_core::thread_pool::ThreadPool::in_place_scope_fifo::hb4b60a5fb4785df3 /builds/worker/checkouts/gecko/third_party/rust/rayon-core/src/thread_pool/mod.rs:296:9
#35 0x7fd86d295938 in style::driver::with_pool_in_place_scope::h3f39cb9d9ffa47b4 /builds/worker/checkouts/gecko/servo/components/style/driver.rs:58:14
#36 0x7fd86d295938 in style::driver::traverse_dom::hf2c3846ea704551a /builds/worker/checkouts/gecko/servo/components/style/driver.rs:111:5
#37 0x7fd86d352b9b in geckoservo::glue::traverse_subtree::h53c502fdcc0d72c9 /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:305:5
#38 0x7fd86d3530e1 in Servo_TraverseSubtree /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:355:9
#39 0x7fd8681dfd4b in mozilla::ServoStyleSet::StyleDocument(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/style/ServoStyleSet.cpp:814:9
#40 0x7fd8682a2187 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3215:20
#41 0x7fd868274665 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3350:3
#42 0x7fd8682737a7 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4347:39
#43 0x7fd868237c69 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1474:5
#44 0x7fd868237c69 in nsRefreshDriver::TickObserverArray(unsigned int, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2501:20
#45 0x7fd868234488 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2735:28
#46 0x7fd86823dfd1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:13
#47 0x7fd86823dfd1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:345:7
#48 0x7fd86823ded0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:361:5
#49 0x7fd86823dd6d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:951:5
#50 0x7fd86823d00c in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:861:5
#51 0x7fd86823c279 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:592:14
#52 0x7fd8675556fb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#53 0x7fd86784545d in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:237:78
#54 0x7fd86772d3e0 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8277:32
#55 0x7fd8635f311f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1812:25
#56 0x7fd8635efe72 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1731:9
#57 0x7fd8635f0af2 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1524:3
#58 0x7fd8635f1c3f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1622:14
#59 0x7fd8628f3377 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:578:16
#60 0x7fd8628e8ae6 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:905:26
#61 0x7fd8628e72c7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:728:15
#62 0x7fd8628e7745 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:514:36
#63 0x7fd8628f7316 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:232:37
#64 0x7fd8628f7316 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#65 0x7fd86290c682 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#66 0x7fd8629137cd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#67 0x7fd8635f9065 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#68 0x7fd86350f411 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#69 0x7fd86350f411 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#70 0x7fd867e68158 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#71 0x7fd867f2abb8 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:470:33
#72 0x7fd869d6282b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:712:20
#73 0x7fd8635f9f46 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#74 0x7fd86350f411 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#75 0x7fd86350f411 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#76 0x7fd869d62092 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:647:34
#77 0x55f8f8cce3f6 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#78 0x55f8f8cce3f6 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#79 0x7fd877a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#80 0x7fd877a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#81 0x55f8f8ca4128 in _start (/home/user/workspace/browsers/m-c-20240304165340-fuzzing-debug/firefox-bin+0x59128) (BuildId: 4cd10e79b03551268afff4f2a04b8043968b0ce3)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240306044140-099f52f30c39.
The bug appears to have been introduced in the following build range:

Start: d8c42e0b32b5e3cb0004372220bb614a003ba179 (20230612095516)
End: 14b1a630b5a0d46be7cc823014b5b9fadbb9df76 (20230612133738)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=d8c42e0b32b5e3cb0004372220bb614a003ba179&tochange=14b1a630b5a0d46be7cc823014b5b9fadbb9df76

Comment 2

[BugBot [:suhaib / :marco]]

:emilio, since you are the author of the regressor, bug 1835407, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1883796 - Deal with an assert that doesn't hold always. r=#style

During an animation restyle, two links might share the same rules while
not sharing the same link-ness.

This is a temporary state, but let's deal with it correctly.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3e4982fb319e
Deal with an assert that doesn't hold always. r=dshin

Comment 5

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/44978 for changes under testing/web-platform/tests

Comment 6

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/3e4982fb319e

Comment 7

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20240308044528-ac5529a784bd.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot