Last Comment Bug 700116 - ABORT: should not get marked modified during parsing: '!data->mSheet->IsModified()'
: ABORT: should not get marked modified during parsing: '!data->mSheet->IsModif...
Status: RESOLVED FIXED
: assertion
Product: Core
Classification: Components
Component: CSS Parsing and Computation (show other bugs)
: Trunk
: x86 All
: P2 critical (vote)
: mozilla11
Assigned To: Boris Zbarsky [:bz] (still a bit busy)
:
: Jet Villegas (:jet)
Mentors:
http://www.t-i-forum.co.jp/function/map/
Depends on:
Blocks: 532972
  Show dependency treegraph
 
Reported: 2011-11-06 04:50 PST by Bob Clary [:bc:]
Modified: 2012-02-01 13:56 PST (History)
1 user (show)
bzbarsky: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
affected
affected
affected


Attachments
Minimal testcase (214 bytes, text/html)
2011-11-07 10:57 PST, Boris Zbarsky [:bz] (still a bit busy)
no flags Details
Fix the ordering if IsAlternate calls and sheet state determination so tht the hashtable munging IsAlternate can do doesn't mess up our sheet states. (10.51 KB, patch)
2011-11-07 11:22 PST, Boris Zbarsky [:bz] (still a bit busy)
jonas: review+
Details | Diff | Splinter Review

Description Bob Clary [:bc:] 2011-11-06 04:50:24 PST
1. http://www.t-i-forum.co.jp/function/map/
2. ABORT: should not get marked modified during parsing: '!data->mSheet->IsModified()', file /work/mozilla/builds/nightly/mozilla/layout/style/Loader.cpp, line 1754

0  0x00043ef4 in TouchBadMemory () at /work/mozilla/builds/nightly/mozilla/memory/mozalloc/mozalloc_abort.cpp:66
#1  0x00043f4f in mozalloc_abort (msg=0xbfffc750 "###!!! ABORT: should not get marked modified during parsing: '!data->mSheet->IsModified()', file /work/mozilla/builds/nightly/mozilla/layout/style/Loader.cpp, line 1754") at /work/mozilla/builds/nightly/mozilla/memory/mozalloc/mozalloc_abort.cpp:87
#2  0x06b351dd in Abort (aMsg=Could not find the frame base for "Abort(char const*)".
) at /work/mozilla/builds/nightly/mozilla/xpcom/base/nsDebugImpl.cpp:388
#3  0x06b35786 in NS_DebugBreak_P (aSeverity=3, aStr=0x73d1d7c "should not get marked modified during parsing", aExpr=0x73d1d60 "!data->mSheet->IsModified()", aFile=0x73d1050 "/work/mozilla/builds/nightly/mozilla/layout/style/Loader.cpp", aLine=1754) at /work/mozilla/builds/nightly/mozilla/xpcom/base/nsDebugImpl.cpp:345
#4  0x057839f5 in mozilla::css::Loader::DoSheetComplete (this=0x23a8eae0, aLoadData=0x25c60710, aStatus=0, aDatasToNotify=@0xbfffcc58) at /work/mozilla/builds/nightly/mozilla/layout/style/Loader.cpp:1753
#5  0x05783d49 in mozilla::css::Loader::SheetComplete (this=0x23a8eae0, aLoadData=0x25c60710, aStatus=0) at /work/mozilla/builds/nightly/mozilla/layout/style/Loader.cpp:1683
#6  0x05784610 in mozilla::css::Loader::ParseSheet (this=0x23a8eae0, aInput=@0x25ca4334, aLoadData=0x25c60710, aCompleted=@0xbfffce2b) at /work/mozilla/builds/nightly/mozilla/layout/style/Loader.cpp:1658
#7  0x05786502 in mozilla::css::SheetLoadData::OnStreamComplete (this=0x25c60710, aLoader=0x25ca4300, aContext=0x0, aStatus=0, aBuffer=@0x25ca4334) at /work/mozilla/builds/nightly/mozilla/layout/style/Loader.cpp:991
#8 

Nightly, Aurora, Beta - Linux, Mac, Windows
Comment 1 Boris Zbarsky [:bz] (still a bit busy) 2011-11-07 10:32:29 PST
The real issue is an assertion much earlier:

###!!! ASSERTION: CreateSheet lied about the state: 'existingData', file ../../../mozilla/layout/style/Loader.cpp, line 1486

The rest follows.
Comment 2 Boris Zbarsky [:bz] (still a bit busy) 2011-11-07 10:57:48 PST
Created attachment 572535 [details]
Minimal testcase

At least for the asserts.  The problem is that IsAlternate() on the second title="x" stylesheet makes that title non-alternate, thus kicking off the load of the first title="x" stylesheet.
Comment 3 Boris Zbarsky [:bz] (still a bit busy) 2011-11-07 11:00:00 PST
And in particular, IsAlternate calls SetHeaderData on the document which calls SetPreferredSheet on the loader, which messes with the mPendingDatas hashtable.

We need to either make some part of that async or deal with the table mutation.
Comment 4 Boris Zbarsky [:bz] (still a bit busy) 2011-11-07 11:22:31 PST
Created attachment 572547 [details] [diff] [review]
Fix the ordering if IsAlternate calls and sheet state determination so tht the hashtable munging IsAlternate can do doesn't mess up our sheet states.
Comment 5 Boris Zbarsky [:bz] (still a bit busy) 2011-11-07 20:42:55 PST
http://hg.mozilla.org/integration/mozilla-inbound/rev/27b8e5fb9699
Comment 6 Ed Morley [:emorley] 2011-11-07 23:41:09 PST
Backed out for retest failures on Windows:
https://tbpl.mozilla.org/?tree=Mozilla-Inbound&rev=5c0861ec147f
https://tbpl.mozilla.org/php/getParsedLog.php?id=7274624&tree=Mozilla-Inbound
{
REFTEST TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/content/test/reftest/xml-stylesheet/css_relative_href_also_external.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/content/test/reftest/xml-stylesheet/css_relative_href_also_external_override.xml | assertion count 1 is more than expected 0 assertions 
}

https://hg.mozilla.org/integration/mozilla-inbound/rev/095a745d1e72
Comment 7 Boris Zbarsky [:bz] (still a bit busy) 2011-11-08 09:07:02 PST
Ah, bah.  I failed to set *aIsAlternate on the various CSS loader methods.  Fixing that.
Comment 8 Boris Zbarsky [:bz] (still a bit busy) 2011-11-08 09:11:18 PST
http://hg.mozilla.org/integration/mozilla-inbound/rev/f5a4970361c8 with that fixed
Comment 9 Marco Bonardo [::mak] 2011-11-09 05:24:42 PST
https://hg.mozilla.org/mozilla-central/rev/f5a4970361c8

Note You need to log in before you can comment on or make changes to this bug.