Closed Bug 1914449 Opened 5 months ago Closed 5 months ago

Assertion failure: mParentSheet->ChildSheets().Contains(this)

Tracking

(firefox-esr115 unaffected, firefox-esr128 unaffected, firefox129 unaffected, firefox130 unaffected, firefox131 fixed)

Status:

RESOLVED FIXED

Milestone:

131 Branch

Tracking Flags:

Tracking

Status

firefox-esr115

---

unaffected

firefox-esr128

---

unaffected

firefox129

---

unaffected

firefox130

---

unaffected

firefox131

---

fixed

People

(Reporter: zrhoffman, Assigned: emilio)

References

(Regression)

Details

(Keywords: regression)

Attachments

(2 files)

testcase.html 5 months ago Zach Hoffman [:zrhoffman] 115 bytes, text/html		Details
Bug 1914449 - Fix stylesheet cloning in presence of both @layer and @import. r=zrhoffman,#style 5 months ago Emilio Cobos Álvarez (:emilio) 48 bytes, text/x-phabricator-request		Details \| Review

Zach Hoffman [:zrhoffman]

Reporter

Description

•

5 months ago

Steps to reproduce:

Open the testcase or data URI data:text/html,<!doctype html><link rel="stylesheet" href="data:text/css,@layer content; @import url('nonexistent.css');">
Open the DevTools Inspector
Close the DevTools Inspector

Expected result: No assertion failure

Actual result:

console.warn: "Error while destroying front:" "accessibility" (new Error("Connection closed, pending request to server0.conn0.process8//accessibilityActor12, type getSimulator failed\n\nRequest stack:\nrequest@resource://devtools/shared/protocol/Front.js:299:14\ngenerateRequestMethods/</frontProto[name]@resource://devtools/shared/protocol/Front/FrontClassWithSpec.js:47:19\ninitialize@resource://devtools/client/fronts/accessibility.js:520:39\n", "resource://devtools/shared/protocol/Front.js", 105))
console.error: "Exception when calling onAvailable handler" "Connection closed, pending request to server0.conn0.process8//accessibilityActor12, type getSimulator failed\n\nRequest stack:\nrequest@resource://devtools/shared/protocol/Front.js:299:14\ngenerateRequestMethods/</frontProto[name]@resource://devtools/shared/protocol/Front/FrontClassWithSpec.js:47:19\ninitialize@resource://devtools/client/fronts/accessibility.js:520:39\n" (new Error("Connection closed, pending request to server0.conn0.process8//accessibilityActor12, type getSimulator failed\n\nRequest stack:\nrequest@resource://devtools/shared/protocol/Front.js:299:14\ngenerateRequestMethods/</frontProto[name]@resource://devtools/shared/protocol/Front/FrontClassWithSpec.js:47:19\ninitialize@resource://devtools/client/fronts/accessibility.js:520:39\n", "resource://devtools/shared/protocol/Front.js", 105))
console.error: (new TypeError("can't access property \"watchResources\", this.toolbox.resourceCommand is null", "resource://devtools/client/inspector/inspector.js", 233))
JavaScript error: , line 0: NotFoundError: No such JSProcessActor 'DevToolsProcess'
JavaScript error: , line 0: NotFoundError: No such JSProcessActor 'DevToolsProcess'
JavaScript error: , line 0: NotFoundError: No such JSProcessActor 'DevToolsProcess'
[2364175] Assertion failure: mParentSheet->ChildSheets().Contains(this), at /home/user/hg.mozilla.org/gecko-dev/layout/style/StyleSheet.cpp:913

Top 10 frames:

#0  0x00007c645ccbb733 in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7ffe1f8ddda0, rem=rem@entry=0x7ffe1f8ddda0) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:48
#1  0x00007c645ccc7827 in __GI___nanosleep (req=req@entry=0x7ffe1f8ddda0, rem=rem@entry=0x7ffe1f8ddda0) at ../sysdeps/unix/sysv/linux/nanosleep.c:25
#2  0x00007c645ccd9f41 in __sleep (seconds=0) at ../sysdeps/posix/sleep.c:55
#3  0x00007c644dc3ed30 in common_crap_handler (signum=11, aFirstFramePC=0x7c644f840b63 <WasmTrapHandler(int, siginfo_t*, void*)+675>) at /home/user/hg.mozilla.org/gecko-dev/toolkit/xre/nsSigHandlers.cpp:100
#4  0x00007c644dc3eeb7 in child_ah_crap_handler (signum=11) at /home/user/hg.mozilla.org/gecko-dev/toolkit/xre/nsSigHandlers.cpp:114
#5  0x00007c644f840b63 in WasmTrapHandler (signum=11, info=0x7ffe1f8ddfb0, context=0x7ffe1f8dde80) at /home/user/hg.mozilla.org/gecko-dev/js/src/wasm/WasmSignalHandlers.cpp:794
#6  0x00007c645cc171d0 in <signal handler called> () at /usr/lib/libc.so.6
#7  0x00007c644c85723e in mozilla::StyleSheet::RemoveFromParent (this=0x7c642db262f0) at /home/user/hg.mozilla.org/gecko-dev/layout/style/StyleSheet.cpp:913
#8  0x00007c644c78cc4f in mozilla::dom::CSSImportRule::DropSheetReference (this=0x7c643912d7c0) at /home/user/hg.mozilla.org/gecko-dev/layout/style/CSSImportRule.cpp:115
#9  0x00007c644c83f8dd in mozilla::ServoCSSRuleList::DropSheetReference()::$_0::operator()(mozilla::css::Rule*, unsigned int) const (this=0x7ffe1f8dec57, rule=0x7c643912d7c0) at /home/user/hg.mozilla.org/gecko-dev/layout/style/ServoCSSRuleList.cpp:180

Zach Hoffman [:zrhoffman]

Reporter

Comment 1

•

5 months ago

Attached file testcase.html — Details

Testcase

BugBot [:suhaib / :marco/ :calixte]

Comment 2

•

5 months ago

Set release status flags based on info from the regressing bug 1912996

:emilio, since you are the author of the regressor, bug 1912996, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

status-firefox129: --- → unaffected

status-firefox130: --- → unaffected

status-firefox131: --- → affected

status-firefox-esr115: --- → unaffected

status-firefox-esr128: --- → unaffected

Flags: needinfo?(emilio)

Emilio Cobos Álvarez (:emilio)

Assignee

Updated

•

5 months ago

Flags: needinfo?(emilio)

Emilio Cobos Álvarez (:emilio)

Assignee

Comment 3

•

5 months ago

Attached file Bug 1914449 - Fix stylesheet cloning in presence of both @layer and @import. r=zrhoffman,#style — Details

Hopefully the test for bug 1912996 would catch this.

Phabricator Automation

Updated

•

5 months ago

Assignee: nobody → emilio

Status: NEW → ASSIGNED

Nicolas Chevobbe [:nchevobbe]

Comment 4

•

5 months ago

(In reply to Emilio Cobos Álvarez (:emilio) from comment #3)

Created attachment 9420707 [details]
Bug 1914449 - Fix stylesheet cloning in presence of both @layer and @import. r=zrhoffman,#style

Hopefully the test for bug 1912996 would catch this.

I wrote a test for the original issue that was failing without your initial patch: https://phabricator.services.mozilla.com/D220096
But it doesn't seem to trigger the assertion

Zach Hoffman [:zrhoffman]

Reporter

Comment 5

•

5 months ago

•

Edited

(In reply to Nicolas Chevobbe [:nchevobbe] from comment #4)

It does trigger the assertion failure for me:

 1:16.92 mozcrash INFO Copy/paste: /home/zrhoffman/.mozbuild/minidump-stackwalk/minidump-stackwalk --cyborg=/tmp/tmpmerpnul5/246809b6-754d-cf9d-afe9-c610c5d35805.trace --brief /tmp/tmp5aykpk5r.mozrunner/minidumps/246809b6-754d-cf9d-afe9-c610c5d35805.dmp /home/zrhoffman/hg.mozilla.org/gecko-dev/obj-x86_64-pc-linux-gnu/dist/crashreporter-symbols
 1:16.98 CRASH: pid:433400. Process type: content. Test:devtools/client/inspector/rules/test/browser_part2.toml. Minidump analysed:False. Signature:[@ libxul.so + 0x00000000136205ce]
Mozilla crash reason: MOZ_ASSERT(mParentSheet->ChildSheets().Contains(this))
Crash dump filename: /tmp/tmp5aykpk5r.mozrunner/minidumps/246809b6-754d-cf9d-afe9-c610c5d35805.dmp

although, yeah, the test does not fail as a result.

Nicolas Chevobbe [:nchevobbe]

Comment 6

•

5 months ago

(In reply to Zach Hoffman [:zrhoffman] from comment #5)

(In reply to Nicolas Chevobbe [:nchevobbe] from comment #4)

It does trigger the assertion failure for me:

 1:16.92 mozcrash INFO Copy/paste: /home/zrhoffman/.mozbuild/minidump-stackwalk/minidump-stackwalk --cyborg=/tmp/tmpmerpnul5/246809b6-754d-cf9d-afe9-c610c5d35805.trace --brief /tmp/tmp5aykpk5r.mozrunner/minidumps/246809b6-754d-cf9d-afe9-c610c5d35805.dmp /home/zrhoffman/hg.mozilla.org/gecko-dev/obj-x86_64-pc-linux-gnu/dist/crashreporter-symbols
 1:16.98 CRASH: pid:433400. Process type: content. Test:devtools/client/inspector/rules/test/browser_part2.toml. Minidump analysed:False. Signature:[@ libxul.so + 0x00000000136205ce]
Mozilla crash reason: MOZ_ASSERT(mParentSheet->ChildSheets().Contains(this))
Crash dump filename: /tmp/tmp5aykpk5r.mozrunner/minidumps/246809b6-754d-cf9d-afe9-c610c5d35805.dmp

although, yeah, the test does not fail as a result.

oh nice, I assumed that because the test wasn't failing we weren't hitting it

Nicolas Chevobbe [:nchevobbe]

Comment 7

•

5 months ago

And Bug 1914850 was backed out because we do get crashes because of the assertion :) So it will cover it nicely. I'll make my patch depend on the one for this bug

Nicolas Chevobbe [:nchevobbe]

Updated

•

5 months ago

Blocks: 1914850

Pulsebot

Comment 8

•

5 months ago

Pushed by ealvarez@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/eb06c74249f3 Fix stylesheet cloning in presence of both @layer and @import. r=zrhoffman,firefox-style-system-reviewers

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 9

•

5 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/eb06c74249f3

Status: ASSIGNED → RESOLVED

Closed: 5 months ago

status-firefox131: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → 131 Branch

Alexandru Trif, Desktop Test Engineering [:atrif]

Updated

•

5 months ago

QA Whiteboard: [qa-131b-p2]

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Assertion failure: mParentSheet->ChildSheets().Contains(this)

Categories

(DevTools :: Inspector, defect)

Tracking

(firefox-esr115 unaffected, firefox-esr128 unaffected, firefox129 unaffected, firefox130 unaffected, firefox131 fixed)

People

(Reporter: zrhoffman, Assigned: emilio)

References

(Regression)

Details

(Keywords: regression)

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Comment 2

Updated

Comment 3

Updated

Comment 4

Comment 5

Comment 6

Comment 7

Updated

Comment 8

Comment 9

Updated

Attachment

General

Description

File Name

Content Type