Jason Kratzer [:jkratzer] Reporter
	Description • 7 years ago

Attached testcase causes an assertion in m-c rev 36ad88e6b7b2 with stylo enabled by pref.

Assertion failure: !(isInitial || forReconstruct) || !postTraversalRequired, at /home/worker/workspace/build/src/layout/style/ServoStyleSet.cpp:294

#01: mozilla::ServoStyleSet::StyleDocument at layout/style/ServoStyleSet.cpp:790
#02: nsCSSFrameConstructor::ConstructDocElementFrame at layout/style/StyleSetHandle.h:199
#03: nsCSSFrameConstructor::ContentRangeInserted at layout/base/nsCSSFrameConstructor.cpp:8057
#04: nsCSSFrameConstructor::ContentInserted at layout/base/nsCSSFrameConstructor.h:277
#05: mozilla::PresShell::ContentInserted at dom/base/nsINode.h:580
#06: nsNodeUtils::ContentInserted at dom/base/nsNodeUtils.cpp:201
#07: nsINode::doInsertChildAt at dom/base/nsINode.cpp:1640
#08: nsINode::ReplaceOrInsertBefore at dom/bindings/ErrorResult.h:376
#09: mozilla::dom::NodeBinding::replaceChild at obj-firefox/dom/bindings/NodeBinding.cpp:946
#10: mozilla::dom::GenericBindingMethod at dom/bindings/BindingUtils.cpp:3055

	Bobby Holley (:bholley) Assignee
	Comment 1 • 7 years ago

This fixes the testcase in the bug, which removes and reinserts
some elements. Our invariants require us not to set the dirty
descendants bits on unstyled elements.

MozReview-Commit-ID: 1eESZjNSURG

	Bobby Holley (:bholley) Assignee
	Comment 2 • 7 years ago

MozReview-Commit-ID: 59I61PQIWHi

	Pulsebot
	Comment 3 • 7 years ago

Pushed by bholley@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/fa3284a6b8f0
Clear the servo bits when dropping servo data. r=emilio
https://hg.mozilla.org/integration/autoland/rev/0787a4518e77
Crashtest. r=me

	Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)
	Comment 4 • 7 years ago
bugherder

https://hg.mozilla.org/mozilla-central/rev/fa3284a6b8f0
https://hg.mozilla.org/mozilla-central/rev/0787a4518e77

	Ryan VanderMeulen [:RyanVM]
	Comment 5 • 7 years ago

Bobby, do we want this on Beta in support of the Stylo experiment or can it ride the 57 train?

	Bobby Holley (:bholley) Assignee
	Comment 6 • 7 years ago

(In reply to Ryan VanderMeulen [:RyanVM] from comment #5)
> Bobby, do we want this on Beta in support of the Stylo experiment or can it
> ride the 57 train?

I guess it couldn't hurt. Extremely low risk.

	Bobby Holley (:bholley) Assignee
	Comment 7 • 7 years ago

Comment on attachment 8895216 [details] [diff] [review]
Clear the servo bits when dropping servo data. v1

Approval Request Comment
[Feature/Bug causing the regression]: N/A
[User impact if declined]: Small chance of stability/correctness issues with the stylo experiment we're running on 56 beta.
[Is this code covered by automated tests?]: Yes
[Has the fix been verified in Nightly?]: (via tests)
[Needs manual test from QE? If yes, steps to reproduce]: No 
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: No.
[Why is the change risky/not risky?]:  Only affects stylo, and very low risk for stylo.
[String changes made/needed]: None

	Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)
	Comment 8 • 7 years ago

Comment on attachment 8895216 [details] [diff] [review]
Clear the servo bits when dropping servo data. v1

Fix should only affect stylo for beta 56 experiement. Please uplift for beta 3.

	Ryan VanderMeulen [:RyanVM]
	Comment 9 • 7 years ago
bugherder uplift

https://hg.mozilla.org/releases/mozilla-beta/rev/570ac5d020c8
https://hg.mozilla.org/releases/mozilla-beta/rev/4d85f7b5e426