Closed Bug 1998438 Opened 21 days ago Closed 15 days ago

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Attempt to insert a frame twice was made), at /layout/base/PresShell.cpp:11586

Categories

(Core :: Layout: Positioned, defect)

Product:
Core
Component:
Layout: Positioned
Platform:
x86_64
Linux
Type:
defect
Points:
1

Tracking

()

Status:
VERIFIED FIXED
Milestone:
147 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox-esr140 --- unaffected
firefox144 --- disabled
firefox145 --- disabled
firefox146 --- wontfix
firefox147 --- verified

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: pernosco, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [anchorpositioning:m2], [wptsync upstream])

Attachments

(2 files)

Testcase
255 bytes, text/html
Details
Bug 1998438 - Don't call InitPrimaryFrame() twice for subdocuments. r=#layout
48 bytes, text/x-phabricator-request
Details | Review

Testcase found while fuzzing mozilla-central rev 57ecaf4b76dc (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build 57ecaf4b76dc --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Attempt to insert a frame twice was made), at /layout/base/PresShell.cpp:11586

    ==42641==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x776c87c14fab bp 0x7ffc7568fdb0 sp 0x7ffc7568fd40 T42641)
    ==42641==The signal is caused by a WRITE memory access.
    ==42641==Hint: address points to the zero page.
        #0 0x776c87c14fab in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x776c87c14fab in void mozilla::PresShell::AddAnchorPosAnchorImpl<true>(nsAtom const*, nsIFrame*) /layout/base/PresShell.cpp:11586:7
        #2 0x776c87c14d1a in mozilla::PresShell::MergeAnchorPosAnchorChanges() /layout/base/PresShell.cpp:11649:5
        #3 0x776c87b4b402 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /layout/style/RestyleManager.cpp:3342:31
        #4 0x776c87b4c761 in mozilla::RestyleManager::ProcessPendingRestyles() /layout/style/RestyleManager.cpp:3390:3
        #5 0x776c87bf50ae in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4466:37
        #6 0x776c83be5144 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1508:5
        #7 0x776c83be5144 in mozilla::dom::Document::DetermineProximityToViewportAndNotifyResizeObservers() /dom/base/Document.cpp:18631:11
        #8 0x776c87bbb624 in operator() /layout/base/nsRefreshDriver.cpp:2510:14
        #9 0x776c87bbb624 in operator() /layout/base/nsRefreshDriver.cpp:1314:7
        #10 0x776c87bbb624 in RunRenderingPhaseLegacy<(lambda at /layout/base/nsRefreshDriver.cpp:1293:35)> /layout/base/nsRefreshDriver.cpp:1286:3
        #11 0x776c87bbb624 in void nsRefreshDriver::RunRenderingPhase<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_10>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_10&&, bool (*)(mozilla::dom::Document const&)) /layout/base/nsRefreshDriver.cpp:1293:3
        #12 0x776c87bb760a in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2506:3
        #13 0x776c87bc0f51 in TickDriver /layout/base/nsRefreshDriver.cpp:368:13
        #14 0x776c87bc0f51 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /layout/base/nsRefreshDriver.cpp:346:7
        #15 0x776c87bc0e50 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:362:5
        #16 0x776c87bc0cfd in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:952:5
        #17 0x776c87bc029a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:862:5
        #18 0x776c87bbf796 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /layout/base/nsRefreshDriver.cpp:593:14
        #19 0x776c86f852db in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncMainChild.cpp:66:15
        #20 0x776c87204959 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:229:78
        #21 0x776c8291d102 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:5097:32
        #22 0x776c828be07e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1794:25
        #23 0x776c828bb600 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1720:9
        #24 0x776c828bc007 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1509:3
        #25 0x776c828bcfe9 in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1611:14
        #26 0x776c81cb69f7 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:705:16
        #27 0x776c81cb1347 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1325:20
        #28 0x776c81caffe7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1148:15
        #29 0x776c81cb0465 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:641:36
        #30 0x776c81cbd8e6 in operator() /xpcom/threads/TaskController.cpp:333:37
        #31 0x776c81cbd8e6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:549:5
        #32 0x776c81ccf913 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1166:16
        #33 0x776c81cd61df in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #34 0x776c828c3907 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #35 0x776c8281e7a1 in RunHandler /ipc/chromium/src/base/message_loop.cc:361:3
        #36 0x776c8281e7a1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:343:3
        #37 0x776c877bcc48 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:152:27
        #38 0x776c8788bc74 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:470:33
        #39 0x776c888c0fdb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:656:20
        #40 0x776c828c47b4 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #41 0x776c8281e7a1 in RunHandler /ipc/chromium/src/base/message_loop.cc:361:3
        #42 0x776c8281e7a1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:343:3
        #43 0x776c888c0731 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:594:34
        #44 0x5b2391129aac in main /browser/app/nsBrowserApp.cpp:465:22
        #45 0x776c92d3a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #46 0x776c92d3a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #47 0x5b23910fd2e8 in _start ??:0:0
    
    ==42641==Register values:
    rax = 0x0000000000000000  rbx = 0x00005b2398476b90  rcx = 0x0000000000002d42  rdx = 0x0000776c92f14563
    rdi = 0x0000776c92f15700  rsi = 0x0000000000000000  rbp = 0x00007ffc7568fdb0  rsp = 0x00007ffc7568fd40
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000000  r11 = 0x0000000000000293
    r12 = 0x0000000000000002  r13 = 0x0000000000000020  r14 = 0x00005b2398479e98  r15 = 0x00007ffc7568fd70
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/jkratzer/builds/m-c-20251105082217-fuzzing-debug/libxul.so+0xa2e0fab) (BuildId: 41f083ee2c3314c6d134ba61049dfd438b3faed3)
    ==42641==ABORTING
Attached file Testcase —
Attachment #9524740 - Attachment filename: testcase.html.undefined → testcase.html
Attachment #9524740 - Attachment mime type: text/plain → text/html

Looks like we're tripping a MOZ_ASSERT_UNREACHABLE inside of PresShell::AddAnchorPosAnchorImpl -- jwatt/dshin, mind taking a look & triaging as part of anchor work?

Flags: needinfo?(mozmail)
Component: Layout → Layout: Positioned

Verified bug as reproducible on mozilla-central 20251105102839-9a81a01d61b6.
The bug appears to have been introduced in the following build range:

Start: 992c0c5e28b78c00a3dfda07220f9d060e5dde77 (20250811090842)
End: bba8b54545d17d0a940a38bc4bb8877c4b04e7bb (20250811212651)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=992c0c5e28b78c00a3dfda07220f9d060e5dde77&tochange=bba8b54545d17d0a940a38bc4bb8877c4b04e7bb

Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

comment 3's pushlog is empty - probably it should have been constructed using autoland rather than mozilla-central.

Swapping to autoland yields this nonempty regression range:
https://hg-edge.mozilla.org/integration/autoland/pushloghtml?fromchange=992c0c5e28b78c00a3dfda07220f9d060e5dde77&tochange=bba8b54545d17d0a940a38bc4bb8877c4b04e7bb

That includes several anchor-related commits from Jari -- the most relevant seems to be
"Bug 1974382: Avoid mixing anchors in different child lists."

--> Tentatively flagging as regression from that

Regressed by: 1974382

Set release status flags based on info from the regressing bug 1974382

status-firefox144: --- → affected
status-firefox145: --- → affected
status-firefox146: --- → affected
status-firefox-esr140: --- → unaffected

(flagging as 'disabled' for 144 and 145, since layout.css.anchor-positioning.enabled is still Nightly-only for now.)

status-firefox144: wontfix → disabled
status-firefox145: wontfix → disabled

First time around:

#0  mozilla::PresShell::AddAnchorPosAnchorImpl<false> (this=0x77adfc8e6000, aName=0x77adfdb32e80, aFrame=0x77adfc87ebb0) at /home/dshin/firefox-2/layout/base/PresShell.cpp:11557
#1  0x000077ae1cde2da5 in mozilla::PresShell::AddAnchorPosAnchor (this=0x77adfc8e6000, aName=0x77adfdb32e80, aFrame=0x77adfc87ebb0) at /home/dshin/firefox-2/layout/base/PresShell.cpp:11611
#2  0x000077ae1d02de56 in nsIFrame::HandlePrimaryFrameStyleChange (this=0x77adfc87ebb0, aOldStyle=0x0) at /home/dshin/firefox-2/layout/generic/nsIFrame.cpp:817
#3  0x000077ae1d02d9f7 in nsIFrame::InitPrimaryFrame (this=0x77adfc87ebb0) at /home/dshin/firefox-2/layout/generic/nsIFrame.cpp:774
#4  0x000077ae1ce86a9b in nsIFrame::SetIsPrimaryFrame (this=0x77adfc87ebb0, aIsPrimary=true) at /home/dshin/firefox-2/layout/generic/nsIFrame.h:2584
#5  0x000077ae1ce78a42 in nsIContent::SetPrimaryFrame (this=0x77adfbe04120, aFrame=0x77adfc87ebb0) at /home/dshin/firefox-2/dom/base/nsIContentInlines.h:39
#6  0x000077ae1d103f85 in nsSubDocumentFrame::Init (this=0x77adfc87ebb0, aContent=0x77adfbe04120, aParent=0x77adfc87e9c0, aPrevInFlow=0x0) at /home/dshin/firefox-2/layout/generic/nsSubDocumentFrame.cpp:133
#7  0x000077ae1ce39855 in nsCSSFrameConstructor::InitAndRestoreFrame (this=0x77adfc85f1e0, aState=..., aContent=0x77adfbe04120, aParentFrame=0x77adfc87e9c0, aNewFrame=0x77adfc87ebb0, aAllowCounters=true)
    at /home/dshin/firefox-2/layout/base/nsCSSFrameConstructor.cpp:4459
#8  0x000077ae1ce42d1e in nsCSSFrameConstructor::ConstructFrameFromItemInternal (this=0x77adfc85f1e0, aItem=..., aState=..., aParentFrame=0x77adfc87e9c0, aFrameList=...) at /home/dshin/firefox-2/layout/base/nsCSSFrameConstructor.cpp:3799
#9  0x000077ae1ce47ce2 in nsCSSFrameConstructor::ConstructFramesFromItem (this=0x77adfc85f1e0, aState=..., aIter=..., aParentFrame=0x77adfc87e9c0, aFrameList=...) at /home/dshin/firefox-2/layout/base/nsCSSFrameConstructor.cpp:5405
#10 0x000077ae1ce77cd7 in nsCSSFrameConstructor::ConstructFramesFromItemList (this=0x77adfc85f1e0, aState=..., aItems=..., aParentFrame=0x77adfc87e9c0, aParentIsWrapperAnonBox=false, aFrameList=...)
    at /home/dshin/firefox-2/layout/base/nsCSSFrameConstructor.cpp:9466
#11 0x000077ae1ce4d692 in nsCSSFrameConstructor::ContentAppended (this=0x77adfc85f1e0, aFirstNewContent=0x77adfbe04120, aInsertionKind=nsCSSFrameConstructor::InsertionKind::Sync) at /home/dshin/firefox-2/layout/base/nsCSSFrameConstructor.cpp:6554
#12 0x000077ae1ccae8b3 in mozilla::RestyleManager::ProcessRestyledFrames (this=0x77adfc8f8710, aChangeList=...) at /home/dshin/firefox-2/layout/style/RestyleManager.cpp:1633
#13 0x000077ae1ccb53cc in mozilla::RestyleManager::DoProcessPendingRestyles (this=0x77adfc8f8710, aFlags=mozilla::ServoTraversalFlags::Empty) at /home/dshin/firefox-2/layout/style/RestyleManager.cpp:3300
#14 0x000077ae1ccb605e in mozilla::RestyleManager::ProcessPendingRestyles (this=0x77adfc8f8710) at /home/dshin/firefox-2/layout/style/RestyleManager.cpp:3390
#15 0x000077ae1cdc7ae3 in mozilla::PresShell::DoFlushPendingNotifications (this=0x77adfc8e6000, aFlush=...) at /home/dshin/firefox-2/layout/base/PresShell.cpp:4466
#16 0x000077ae16559ea2 in mozilla::PresShell::FlushPendingNotifications (this=0x77adfc8e6000, aType=...) at /home/dshin/firefox-2/obj-ff-dbg/dist/include/mozilla/PresShell.h:1508
#17 0x000077ae1cdc7126 in mozilla::PresShell::DoFlushPendingNotifications (this=0x77adfc8e6000, aType=mozilla::FlushType::InterruptibleLayout) at /home/dshin/firefox-2/layout/base/PresShell.cpp:4300
#18 0x000077ae16677cd6 in mozilla::PresShell::FlushPendingNotifications (this=0x77adfc8e6000, aType=mozilla::FlushType::InterruptibleLayout) at /home/dshin/firefox-2/obj-ff-dbg/dist/include/mozilla/PresShell.h:1499
#19 0x000077ae18d27d87 in mozilla::EventStateManager::FlushLayout (this=0x77adfdac0ee0, aPresContext=0x77adfc8d0800) at /home/dshin/firefox-2/dom/events/EventStateManager.cpp:6930

Second:

#0  mozilla::PresShell::AddAnchorPosAnchorImpl<false> (this=0x7a7be155a000, aName=0x7a7be3cae6a0, aFrame=0x7a7be152fbb0) at /home/dshin/firefox-2/layout/base/PresShell.cpp:11557
#1  0x00007a7c025e2da5 in mozilla::PresShell::AddAnchorPosAnchor (this=0x7a7be155a000, aName=0x7a7be3cae6a0, aFrame=0x7a7be152fbb0) at /home/dshin/firefox-2/layout/base/PresShell.cpp:11611
#2  0x00007a7c0282de56 in nsIFrame::HandlePrimaryFrameStyleChange (this=0x7a7be152fbb0, aOldStyle=0x0) at /home/dshin/firefox-2/layout/generic/nsIFrame.cpp:817
#3  0x00007a7c0282d9f7 in nsIFrame::InitPrimaryFrame (this=0x7a7be152fbb0) at /home/dshin/firefox-2/layout/generic/nsIFrame.cpp:774
#4  0x00007a7c02686a9b in nsIFrame::SetIsPrimaryFrame (this=0x7a7be152fbb0, aIsPrimary=true) at /home/dshin/firefox-2/layout/generic/nsIFrame.h:2584
#5  0x00007a7c02678a42 in nsIContent::SetPrimaryFrame (this=0x7a7be1404120, aFrame=0x7a7be152fbb0) at /home/dshin/firefox-2/dom/base/nsIContentInlines.h:39
#6  0x00007a7c02643471 in nsCSSFrameConstructor::ConstructFrameFromItemInternal (this=0x7a7be1fdc4a0, aItem=..., aState=..., aParentFrame=0x7a7be152f9c0, aFrameList=...) at /home/dshin/firefox-2/layout/base/nsCSSFrameConstructor.cpp:3928
#7  0x00007a7c02647ce2 in nsCSSFrameConstructor::ConstructFramesFromItem (this=0x7a7be1fdc4a0, aState=..., aIter=..., aParentFrame=0x7a7be152f9c0, aFrameList=...) at /home/dshin/firefox-2/layout/base/nsCSSFrameConstructor.cpp:5405
#8  0x00007a7c02677cd7 in nsCSSFrameConstructor::ConstructFramesFromItemList (this=0x7a7be1fdc4a0, aState=..., aItems=..., aParentFrame=0x7a7be152f9c0, aParentIsWrapperAnonBox=false, aFrameList=...)
    at /home/dshin/firefox-2/layout/base/nsCSSFrameConstructor.cpp:9466
#9  0x00007a7c0264d692 in nsCSSFrameConstructor::ContentAppended (this=0x7a7be1fdc4a0, aFirstNewContent=0x7a7be1404120, aInsertionKind=nsCSSFrameConstructor::InsertionKind::Sync) at /home/dshin/firefox-2/layout/base/nsCSSFrameConstructor.cpp:6554
#10 0x00007a7c024ae8b3 in mozilla::RestyleManager::ProcessRestyledFrames (this=0x7a7be1f7a050, aChangeList=...) at /home/dshin/firefox-2/layout/style/RestyleManager.cpp:1633
#11 0x00007a7c024b53cc in mozilla::RestyleManager::DoProcessPendingRestyles (this=0x7a7be1f7a050, aFlags=mozilla::ServoTraversalFlags::Empty) at /home/dshin/firefox-2/layout/style/RestyleManager.cpp:3300
#12 0x00007a7c024b605e in mozilla::RestyleManager::ProcessPendingRestyles (this=0x7a7be1f7a050) at /home/dshin/firefox-2/layout/style/RestyleManager.cpp:3390
#13 0x00007a7c025c7ae3 in mozilla::PresShell::DoFlushPendingNotifications (this=0x7a7be155a000, aFlush=...) at /home/dshin/firefox-2/layout/base/PresShell.cpp:4466
#14 0x00007a7bfbd59ea2 in mozilla::PresShell::FlushPendingNotifications (this=0x7a7be155a000, aType=...) at /home/dshin/firefox-2/obj-ff-dbg/dist/include/mozilla/PresShell.h:1508
#15 0x00007a7bfbcef37a in mozilla::dom::Document::DetermineProximityToViewportAndNotifyResizeObservers (this=0x7a7be8407500) at /home/dshin/firefox-2/dom/base/Document.cpp:18631

So it's genuinely trying to add the anchor twice.

Not completely sure why the frame is being reconstructed, though.

(Replacing the universal * selector with iframe still reproduces)

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Keywords: pernosco-wanted → pernosco

A pernosco session for this bug can be found here.

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [anchorpositioning:triage]
Flags: needinfo?(emilio)
Severity: -- → S3

nsSubDocumentFrame::Init calls SetPrimaryFrame relatively early, and
we're calling InitPrimaryFrame() twice because of that.

Assignee: nobody → emilio
Status: NEW → ASSIGNED
Flags: needinfo?(mozmail)
Flags: needinfo?(emilio)
Pushed by ealvarez@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/e1a20b25e5e4 https://hg.mozilla.org/integration/autoland/rev/f2f6b11c5e5e Don't call InitPrimaryFrame() twice for subdocuments. r=layout-reviewers,dholbert
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/55968 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed], [anchorpositioning:triage] → [bugmon:bisected,confirmed], [anchorpositioning:triage], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/f2f6b11c5e5e

Status: ASSIGNED → RESOLVED
Closed: 15 days ago
status-firefox147: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 147 Branch
Upstream PR merged by moz-wptsync-bot
Points: --- → 1
Whiteboard: [bugmon:bisected,confirmed], [anchorpositioning:triage], [wptsync upstream] → [bugmon:bisected,confirmed], [anchorpositioning:m2], [wptsync upstream]

Verified bug as fixed on rev mozilla-central 20251111094532-8b434e72bd1e.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox147: fixed → verified
Keywords: bugmon

The patch landed in nightly and beta is affected.
:emilio, is this bug important enough to require an uplift?

For more information, please visit BugBot documentation.

Flags: needinfo?(emilio)
status-firefox146: affected → wontfix
Flags: needinfo?(emilio)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: