2020755 - Assertion failure: !mInStyleRefresh, at /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:3556

Status: RESOLVED DUPLICATE of bug 2020190

(Core :: Layout, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260301-d196b0e15fb4 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !mInStyleRefresh, at /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:3556

#0 0x7b50922fa9d3 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
#1 0x7b50922fa9d3 in mozilla::RestyleManager::TakeSnapshotForAttributeChange(mozilla::dom::Element&, int, nsAtom*) /builds/worker/checkouts/gecko/layout/style/RestyleManager.cpp:3556:3
#2 0x7b509247fbba in mozilla::PresShell::AttributeWillChange(mozilla::dom::Element*, int, nsAtom*, AttrModType) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4599:37
#3 0x7b508afe20b0 in operator() /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:137:10
#4 0x7b508afe20b0 in Notify<(NotifyPresShell)2, (lambda at /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:137:10)> /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:99:7
#5 0x7b508afe20b0 in mozilla::dom::MutationObservers::NotifyAttributeWillChange(mozilla::dom::Element*, int, nsAtom*, AttrModType) /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:136:3
#6 0x7b508aecda86 in SetAttrInternal<(lambda at /builds/worker/checkouts/gecko/dom/base/Element.cpp:3513:26)> /builds/worker/checkouts/gecko/dom/base/Element.cpp:3595:5
#7 0x7b508aecda86 in mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool) /builds/worker/checkouts/gecko/dom/base/Element.cpp:3511:10
#8 0x7b508aecf468 in SetAttr /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:1023:12
#9 0x7b508aecf468 in mozilla::dom::Element::SetAttribute(nsTSubstring<char16_t> const&, mozilla::dom::TrustedHTMLOrTrustedScriptOrTrustedScriptURLOrString const&, nsIPrincipal*, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Element.cpp:1856:14
#10 0x7b508cb17423 in mozilla::dom::Element_Binding::setAttribute(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./ElementBinding.cpp:2519:24
#11 0x7b508cdc360d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3304:13
#12 0x7b5095a0137d in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:490:13
#13 0x7b5095a0137d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:586:12
#14 0x7b5094c456c0 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1698:10

Comment 1

[Tyson Smith [:tsmith]]

Marking as s-s for now because another assert was triggered during reduction: Assertion failure: !mForbiddenToFlush (This is bad!), at /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4360

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260303095635-887fb4b92f0c.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 35157773ff814b8c3e96826a4db20f9ca73fa4b0 (20250305205032)
End: d196b0e15fb423d4e8dea0a6a924664ca6a7248f (20260301091022)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 3

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 4

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 5

[Emilio Cobos Álvarez [:emilio]]

This is bug 2020190. Not sure if duping or dependency is better. Feel free to dupe.

Comment 6

[Emilio Cobos Álvarez [:emilio]]

I guess duping is harmless. Let me know otherwise.

Comment 7

[Bugmon [:jkratzer for issues]]

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.