2044746 - Hit MOZ_CRASH(assertion `left == right` failed left: 8 right: 0) at servo/components/style/sharing/mod.rs:158

Tyson Smith [:tsmith]

Reporter

Description

•

2 months ago

Found with m-c 20260530-da3572890156 (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

Launch browser and visit site

This issue was triggered by visiting http://www.crowntraining.com.br/. A Pernosco session is available here: https://pernos.co/debug/8wDebPTZh2EjS9WRLvB6FA/index.html

Hit MOZ_CRASH(assertion left == right failed left: 8 right: 0) at servo/components/style/sharing/mod.rs:158

0|0|libxul.so|RustMozCrash|git:github.com/mozilla-firefox/firefox:mozglue/static/rust/wrappers.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|17|0x2f
0|1|libxul.so|mozglue_static::panic_hook|git:github.com/mozilla-firefox/firefox:mozglue/static/rust/lib.rs:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|99|0xfe
0|2|libxul.so|core::ops::function::Fn::call|/builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs|79|0xb
0|3|libxul.so|std::panicking::panic_with_hook|git:github.com/rust-lang/rust:library/std/src/panicking.rs:ded5c06cf21d2b93bffd5d884aa6e96934ee4234|842|0xd8
0|4|libxul.so|std::panicking::panic_handler::{{closure}}|git:github.com/rust-lang/rust:library/std/src/panicking.rs:ded5c06cf21d2b93bffd5d884aa6e96934ee4234|707|0x99
0|5|libxul.so|std::sys::backtrace::__rust_end_short_backtrace|git:github.com/rust-lang/rust:library/std/src/sys/backtrace.rs:ded5c06cf21d2b93bffd5d884aa6e96934ee4234|174|0x8
0|6|libxul.so|__rustc::rust_begin_unwind|git:github.com/rust-lang/rust:library/std/src/panicking.rs:ded5c06cf21d2b93bffd5d884aa6e96934ee4234|698|0x1c
0|7|libxul.so|core::panicking::panic_fmt|git:github.com/rust-lang/rust:library/core/src/panicking.rs:ded5c06cf21d2b93bffd5d884aa6e96934ee4234|80|0x1f
0|8|libxul.so|core::panicking::assert_failed_inner|git:github.com/rust-lang/rust:library/core/src/panicking.rs:ded5c06cf21d2b93bffd5d884aa6e96934ee4234|444|0xad
0|9|libxul.so|core::panicking::assert_failed|git:github.com/rust-lang/rust:library/core/src/panicking.rs:ded5c06cf21d2b93bffd5d884aa6e96934ee4234|399|0x2f
0|10|libxul.so|<style::sharing::RevalidationResult as core::cmp::PartialEq>::eq|git:github.com/mozilla-firefox/firefox:servo/components/style/sharing/mod.rs:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|158|0x128
0|11|libxul.so|style::sharing::checks::revalidate|git:github.com/mozilla-firefox/firefox:servo/components/style/sharing/checks.rs:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|141|0xc0
0|12|libxul.so|style::traversal::compute_style|git:github.com/mozilla-firefox/firefox:servo/components/style/traversal.rs:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|549|0x197c
0|13|libxul.so|style::parallel::style_trees|git:github.com/mozilla-firefox/firefox:servo/components/style/parallel.rs:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|171|0x3c1
0|14|libxul.so|style::driver::traverse_dom::{{closure}}|git:github.com/mozilla-firefox/firefox:servo/components/style/driver.rs:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|136|0x1dc
0|15|libxul.so|style::driver::traverse_dom|git:github.com/mozilla-firefox/firefox:servo/components/style/driver.rs:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|125|0x20d
0|16|libxul.so|geckoservo::glue::traverse_subtree|git:github.com/mozilla-firefox/firefox:servo/ports/geckolib/glue.rs:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|308|0x41f
0|17|libxul.so|Servo_TraverseSubtree|git:github.com/mozilla-firefox/firefox:servo/ports/geckolib/glue.rs:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|368|0x477
0|18|libxul.so|mozilla::ServoStyleSet::StyleDocument(mozilla::ServoTraversalFlags)|git:github.com/mozilla-firefox/firefox:layout/style/ServoStyleSet.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|836|0x239
0|19|libxul.so|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|git:github.com/mozilla-firefox/firefox:layout/style/RestyleManager.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|3172|0x1b4
0|20|libxul.so|mozilla::RestyleManager::ProcessPendingRestyles()|git:github.com/mozilla-firefox/firefox:layout/style/RestyleManager.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|3319|0xc1
0|21|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|git:github.com/mozilla-firefox/firefox:layout/base/PresShell.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|4529|0x6f1
0|22|libxul.so|mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush)|git:github.com/mozilla-firefox/firefox:dom/base/Document.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|11644|0x269
0|23|libxul.so|mozilla::dom::BrowsingContext::PreOrderWalkVoid(std::function<void (mozilla::dom::BrowsingContext*)> const&)|git:github.com/mozilla-firefox/firefox:docshell/base/BrowsingContext.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|1446|0x3a
0|24|libxul.so|mozilla::dom::Document::DetermineProximityToViewportAndNotifyResizeObservers()|git:github.com/mozilla-firefox/firefox:dom/base/Document.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|19212|0x346
0|25|libxul.so|nsRefreshDriver::RunRenderingPhase<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_11>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_11&&, bool (*)(mozilla::dom::Document const&))|git:github.com/mozilla-firefox/firefox:layout/base/nsRefreshDriver.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|1288|0x274
0|26|libxul.so|nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)|git:github.com/mozilla-firefox/firefox:layout/base/nsRefreshDriver.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|2536|0x87c
0|27|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|git:github.com/mozilla-firefox/firefox:layout/base/nsRefreshDriver.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|343|0x91
0|28|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|git:github.com/mozilla-firefox/firefox:layout/base/nsRefreshDriver.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|359|0x60
0|29|libxul.so|mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|git:github.com/mozilla-firefox/firefox:layout/base/nsRefreshDriver.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|946|0xd
0|30|libxul.so|mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|git:github.com/mozilla-firefox/firefox:layout/base/nsRefreshDriver.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|856|0x12a
0|31|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread()|git:github.com/mozilla-firefox/firefox:layout/base/nsRefreshDriver.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|587|0xb6
0|32|libxul.so|mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&)|git:github.com/mozilla-firefox/firefox:dom/ipc/VsyncMainChild.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|64|0xe3
0|33|libxul.so|mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:26570708c09faa7b69b20f119869067838778d64d6e14be50f192e144dbd8cdec4de8abdba3905df3fc0b36dffd1f3e6b98529399e7a70978887eee678f69a44/ipc/ipdl/PVsyncChild.cpp:|241|0x3a5
0|34|libxul.so|mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:b879d03645bc99f26f7b090f24901d1be8eae987323c7cbfb7695619efbc9f77d70f81ecf63052d484add9c778c32da0a9c31af55e72e9ae03b029a8adec4fe3/ipc/ipdl/PBackgroundChild.cpp:|4955|0x195
0|35|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessageChannel.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|1797|0x128
0|36|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message> >)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessageChannel.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|1723|0x254
0|37|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessageChannel.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|1512|0x178
0|38|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|git:github.com/mozilla-firefox/firefox:ipc/glue/MessageChannel.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|1614|0xcd
0|39|libxul.so|mozilla::RunnableTask::Run()|git:github.com/mozilla-firefox/firefox:xpcom/threads/TaskController.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|719|0x17
0|40|libxul.so|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|git:github.com/mozilla-firefox/firefox:xpcom/threads/TaskController.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|1358|0x5b4
0|41|libxul.so|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|git:github.com/mozilla-firefox/firefox:xpcom/threads/TaskController.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|1181|0x57
0|42|libxul.so|mozilla::TaskController::ProcessPendingMTTask(bool)|git:github.com/mozilla-firefox/firefox:xpcom/threads/TaskController.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|655|0x65
0|43|libxul.so|mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run()|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThreadUtils.h:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|536|0x19
0|44|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThread.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|1179|0x5ca
0|45|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThreadUtils.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|472|0x4f
0|46|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|105|0x125
0|47|libxul.so|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|346|0x61
0|48|libxul.so|nsBaseAppShell::Run()|git:github.com/mozilla-firefox/firefox:widget/nsBaseAppShell.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|151|0x28
0|49|libxul.so|nsAppShell::Run()|git:github.com/mozilla-firefox/firefox:widget/gtk/nsAppShell.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|575|0x114
0|50|libxul.so|XRE_RunAppShell()|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsEmbedFunctions.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|652|0x6b
0|51|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|233|0x3c
0|52|libxul.so|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|346|0x61
0|53|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsEmbedFunctions.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|590|0x944
0|54|firefox-bin|main|git:github.com/mozilla-firefox/firefox:browser/app/nsBrowserApp.cpp:a5789d9e5a28642fca6c7a464bd8f6216fe876e7|466|0x21c

Emilio Cobos Álvarez [:emilio]

Assignee

Updated

•

2 months ago

Flags: needinfo?(emilio)

Emilio Cobos Álvarez [:emilio]

Assignee

Comment 1

•

2 months ago

Attached file Bug 2044746 - Don't bother revalidating between shadow / non-shadow contents. r=#style — Details

In the crashtest, what's going on is that we try to share between two
cousins that happen to be in the same tree position, one on a shadow
tree and one outside.

The assert fires because well, shadow data is the same (None) for both,
but one matches light dom rules and another doesn't, so the revalidation
fires and finds the :first-child selector for one and not the other.

This doesn't cause a correctness issue on that crashtest because the
length comparison fails, but it does cause correctness issues that are
not caught by the assert (see the reftest).

Phabricator Automation

Updated

•

2 months ago

Assignee: nobody → emilio

Status: NEW → ASSIGNED

Emilio Cobos Álvarez [:emilio]

Assignee

Updated

•

2 months ago

Flags: needinfo?(emilio)

Pulsebot

Comment 2

•

2 months ago

Pushed by ealvarez@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/140f92d33fe2 https://hg.mozilla.org/integration/autoland/rev/2a3233eabd96 Don't bother revalidating between shadow / non-shadow contents. r=firefox-style-system-reviewers,dshin

Pulsebot

Comment 3

•

2 months ago

Pushed by nfay@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/a9178d81a6a0 https://hg.mozilla.org/integration/autoland/rev/df6fafd76c75 Appease wptlint.

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Comment 4

•

2 months ago

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/60548 for changes under testing/web-platform/tests

Norisz Fay [:noriszfay]

Comment 5

•

2 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/2a3233eabd96
https://hg.mozilla.org/mozilla-central/rev/df6fafd76c75

Status: ASSIGNED → RESOLVED

Closed: 2 months ago

status-firefox153: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → 153 Branch

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Comment 6

•

2 months ago

Upstream PR merged by moz-wptsync-bot

Ryan VanderMeulen [:RyanVM]

Updated

•

2 months ago

status-firefox151: --- → unaffected

status-firefox152: --- → fix-optional

status-firefox-esr115: --- → unaffected

status-firefox-esr140: --- → unaffected

Flags: in-testsuite+

BugBot [:suhaib / :marco]

Comment 7

•

2 months ago

The patch landed in nightly and beta is affected.
:emilio, is this bug important enough to require an uplift?

If yes, please nominate the patch for beta approval.
- See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
If no, please set status-firefox152 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(emilio)

Emilio Cobos Álvarez [:emilio]

Assignee

Comment 8

•

2 months ago

Attached file Bug 2044746 - Don't bother revalidating between shadow / non-shadow contents. — Details

In the crashtest, what's going on is that we try to share between two
cousins that happen to be in the same tree position, one on a shadow
tree and one outside.

The assert fires because well, shadow data is the same (None) for both,
but one matches light dom rules and another doesn't, so the revalidation
fires and finds the :first-child selector for one and not the other.

This doesn't cause a correctness issue on that crashtest because the
length comparison fails, but it does cause correctness issues that are
not caught by the assert (see the reftest).

Original Revision: https://phabricator.services.mozilla.com/D305878

Phabricator Automation

Updated

•

2 months ago

Attachment #9596926 - Flags: approval-mozilla-beta?

Phabricator Automation

Comment 9

•

2 months ago

firefox-beta Uplift Approval Request

User impact if declined/Reason for urgency: Low risk fix.
Code covered by automated testing?: yes
Fix verified in Nightly?: yes
Needs manual QE testing?: no
Steps to reproduce for manual QE testing:
Risk associated with taking this patch: low
Explanation of risk level: Targeted one liner
String changes made/needed?: None
Is Android affected?: yes

Emilio Cobos Álvarez [:emilio]

Assignee

Updated

•

2 months ago

Flags: needinfo?(emilio)

Ryan VanderMeulen [:RyanVM]

Updated

•

2 months ago

Attachment #9596926 - Flags: approval-mozilla-beta? → approval-mozilla-release?

Phabricator Automation

Updated

•

2 months ago

Attachment #9596926 - Flags: approval-mozilla-release? → approval-mozilla-release+

Lando Automation

Updated

•

2 months ago

status-firefox152: fix-optional → fixed

Pulsebot

Comment 10

•

2 months ago

uplift

https://github.com/mozilla-firefox/firefox/commit/695292a0adba https://hg.mozilla.org/releases/mozilla-release/rev/42a4dfab514e

Pulsebot

Comment 11

•

2 months ago

Pushed by rvandermeulen@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/2be5e4edebae https://hg.mozilla.org/releases/mozilla-release/rev/d3f5524a7584 Appease wptlint. DONTBUILD

Bug 2044746 - Don't bother revalidating between shadow / non-shadow contents. r=#style 2 months ago Emilio Cobos Álvarez [:emilio] 48 bytes, text/x-phabricator-request		Details \| Review
Bug 2044746 - Don't bother revalidating between shadow / non-shadow contents. 2 months ago Emilio Cobos Álvarez [:emilio] 48 bytes, text/x-phabricator-request	phab-bot : approval-mozilla-release+	Details \| Review