Testcase found while fuzzing mozilla-central rev 946b9c995ec3. thread 'StyleThread#2' panicked at 'assertion failed: `(left == right)` (left: `0`, right: `1`)', /builds/worker/workspace/build/src/servo/components/style/traversal.rs:668 stack backtrace: thread 'StyleThread#1' panicked at 'assertion failed: `(left == right)` (left: `0`, right: `1`)', /builds/worker/workspace/build/src/servo/components/style/traversal.rs:668 0: 0x7fdada3f0493 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::hcab99e0793da62c7 1: 0x7fdada3eb7b6 - std::sys_common::backtrace::_print::hbfe5b0c7e79c0711 2: 0x7fdada3fdb2a - std::panicking::default_hook::{{closure}}::h9ba2c6973907a2be 3: 0x7fdada3fd72b - std::panicking::default_hook::he4d55e2dd21c3cca 4: 0x7fdada3fdf7a - std::panicking::rust_panic_with_hook::ha138c05cd33ad44d 5: 0x7fdada3fde14 - std::panicking::begin_panic::hcdbfa35c94142fa2 6: 0x7fdada3fdd49 - std::panicking::begin_panic_fmt::hc09fe500d9b7be81 7: 0x7fdada4c1590 - style::traversal::compute_style::he9440e02ab5b4568 8: 0x7fdada5dc4fd - style::traversal::recalc_style_at::hb7b907d23224e88a 9: 0x7fdada5b5c9a - <style::gecko::traversal::RecalcStyleOnly<'recalc> as style::traversal::DomTraversal<style::gecko::wrapper::GeckoElement<'le>>>::process_preorder::h64c5cec2c7de7224 10: 0x7fdada5dad41 - style::parallel::traverse_nodes::{{closure}}::h7089d5281be6469a 11: 0x7fdada5a9359 - rayon_core::scope::Scope::execute_job_closure::{{closure}}::h041192ab93362884 12: 0x7fdada5fbacd - <std::panic::AssertUnwindSafe<F> as core::ops::FnOnce<()>>::call_once::hd6cb4163f56c867b 13: 0x7fdada5b920d - std::panicking::try::do_call::hd4197f2a970ab863 14: 0x7fdada40281b - <unknown> Redirecting call to abort() to mozalloc_abort Hit MOZ_CRASH() at /builds/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33 stack backtrace: 0: 0x7fdada3f0493 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::hcab99e0793da62c7 1: 0x7fdada3eb7b6 - std::sys_common::backtrace::_print::hbfe5b0c7e79c0711 2: 0x7fdada3fdb2a - std::panicking::default_hook::{{closure}}::h9ba2c6973907a2be 3: 0x7fdada3fd72b - std::panicking::default_hook::he4d55e2dd21c3cca 4: 0x7fdada3fdf7a - std::panicking::rust_panic_with_hook::ha138c05cd33ad44d 5: 0x7fdada3fde14 - std::panicking::begin_panic::hcdbfa35c94142fa2 6: 0x7fdada3fdd49 - std::panicking::begin_panic_fmt::hc09fe500d9b7be81 7: 0x7fdada4c1590 - style::traversal::compute_style::he9440e02ab5b4568 8: 0x7fdada5dc4fd - style::traversal::recalc_style_at::hb7b907d23224e88a 9: 0x7fdada5b5c9a - <style::gecko::traversal::RecalcStyleOnly<'recalc> as style::traversal::DomTraversal<style::gecko::wrapper::GeckoElement<'le>>>::process_preorder::h64c5cec2c7de7224 10: 0x7fdada5dad41 - style::parallel::traverse_nodes::{{closure}}::h7089d5281be6469a 11: 0x7fdada5a9359 - rayon_core::scope::Scope::execute_job_closure::{{closure}}::h041192ab93362884 12: 0x7fdada5fbacd - <std::panic::AssertUnwindSafe<F> as core::ops::FnOnce<()>>::call_once::hd6cb4163f56c867b 13: 0x7fdada5b920d - std::panicking::try::do_call::hd4197f2a970ab863 14: 0x7fdada40281b - <unknown> Redirecting call to abort() to mozalloc_abort Hit MOZ_CRASH() at /builds/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33

This is the bloom filter depth assertion [1]. Somehow the insert_parents_recovering call above isn't ending us up with the right depth. [1] http://searchfox.org/mozilla-central/rev/20e41d4a61a8f5e34c9cf357304b78b3e9bced8a/servo/components/style/traversal.rs#668

So, this is flattened tree coherency problem, where the parent (the root) thinks it has a child, but the child thinks it has no parent (because it thinks it's document-level NAC). This is because the root element is content-editable, and so the editor machinery creates manual NAC beneath it. But the document-level NAC detection code in GetFlattenedTreeParentForStyle predates our handling of manual NAC, and thus makes faulty assumptions about it. Fix should be straightforward, I'll write it up.

MozReview-Commit-ID: 74UMBeZBZcw

Comment on attachment 8913888 [details] [diff] [review] Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. v1 Whoops, out of date patch.

MozReview-Commit-ID: 74UMBeZBZcw

(In reply to Bobby Holley (:bholley) (busy with Stylo) from comment #7) > https://treeherder.mozilla.org/#/ > jobs?repo=try&revision=1920b65df4b8f8b85d6de38d771f9c32ed56b44e This is green.

Comment on attachment 8913889 [details] [diff] [review] Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. v1 Review of attachment 8913889 [details] [diff] [review]: ----------------------------------------------------------------- r=me ::: dom/base/FragmentOrElement.cpp @@ +185,5 @@ > + nsContentUtils::AppendNativeAnonymousChildren( > + parent, rootElementNAC, nsIContent::eSkipDocumentLevelNativeAnonymousContent); > + bool isDocLevelNAC = !rootElementNAC.Contains(this); > + > +#ifdef DEBUG nit: I'd maybe introduce a block here, to avoid accidentally using variables defined only in debug mode if someone is touching this code, but not a big deal either way.

Pushed by bholley@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/e939fa11b68c Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. r=emilio https://hg.mozilla.org/integration/autoland/rev/555a9dafe460 Crashtest. r=me

Backed out in https://hg.mozilla.org/integration/autoland/rev/f90790f7a346 for debug build bustage, https://treeherder.mozilla.org/logviewer.html#?job_id=134237211&repo=autoland

Whoops, forgot to commit the changes in my tree before cherry-picking them to autoland.

Pushed by bholley@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/e6663f10c42b Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. r=emilio https://hg.mozilla.org/integration/autoland/rev/325ab1b04aba Crashtest. r=me

Backed out for crashing in devtools/server/tests/browser/browser_canvasframe_helper_04.js on Windows 7 debug with non-e10s builds: https://hg.mozilla.org/integration/autoland/rev/1340a2e8b79fd360552a7c24ba8061e9ecfb18d3 https://hg.mozilla.org/integration/autoland/rev/3a0ac72b90db6776118409bb7fd5e0a5cfc97aea Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=325ab1b04abac56d4126bd73ec20c9827ba6f5f6&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-resultStatus=usercancel&filter-resultStatus=runnable&filter-searchStr=f539b5f127e6d7fcaed24809429b5803247288bb Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=134250910&repo=autoland 08:04:21 INFO - 644 INFO TEST-START | devtools/server/tests/browser/browser_canvasframe_helper_04.js 08:04:21 INFO - GECKO(2112) | ++DOCSHELL 167AFC00 == 32 [pid = 2112] [id = {ded01f6e-d11b-461a-a63c-4839dc35c55f}] 08:04:21 INFO - GECKO(2112) | ++DOMWINDOW == 94 (167B0000) [pid = 2112] [serial = 155] [outer = 00000000] 08:04:21 INFO - GECKO(2112) | ++DOMWINDOW == 95 (1EF83C00) [pid = 2112] [serial = 156] [outer = 167B0000] 08:04:21 INFO - GECKO(2112) | ++DOMWINDOW == 96 (1278E800) [pid = 2112] [serial = 157] [outer = 167B0000] 08:04:21 INFO - GECKO(2112) | [2112, Main Thread] WARNING: stylo: Web Components not supported yet: file z:/build/build/src/dom/base/nsDocument.cpp, line 6419 08:04:21 INFO - GECKO(2112) | [2112, Main Thread] WARNING: stylo: Web Components not supported yet: file z:/build/build/src/dom/base/nsDocument.cpp, line 6419 08:04:21 INFO - GECKO(2112) | ++DOMWINDOW == 97 (14091400) [pid = 2112] [serial = 158] [outer = 167B0000] 08:04:21 INFO - GECKO(2112) | [2112, Main Thread] WARNING: stylo: Web Components not supported yet: file z:/build/build/src/dom/base/nsDocument.cpp, line 6419 08:04:21 INFO - GECKO(2112) | [2112, Main Thread] WARNING: stylo: Web Components not supported yet: file z:/build/build/src/dom/base/nsDocument.cpp, line 6419 08:04:21 INFO - TEST-INFO | Main app process: exit 1 08:04:21 ERROR - 645 ERROR TEST-UNEXPECTED-FAIL | ShutdownLeaks | process() called before end of test suite 08:04:21 INFO - Buffered messages logged at 08:04:21 08:04:21 INFO - 646 INFO Entering test bound 08:04:21 INFO - 647 INFO Adding a new tab with URL: data:text/html;charset=utf-8,CanvasFrameAnonymousContentHelper test 1 08:04:21 INFO - 648 INFO Tab added and URL data:text/html;charset=utf-8,CanvasFrameAnonymousContentHelper test 1 loaded 08:04:21 INFO - 649 INFO Building the helper 08:04:21 INFO - 650 INFO Get an element from the helper 08:04:21 INFO - 651 INFO Try to access the element 08:04:21 INFO - 652 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The attribute is correct before navigation - 08:04:21 INFO - 653 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The text content is correct before navigation - 08:04:21 INFO - 654 INFO Add an event listener on the element 08:04:21 INFO - 655 INFO Synthesizing an event on the element 08:04:21 INFO - 656 INFO Waiting for event: 'mousedown' on [object HTMLDocument]. 08:04:21 INFO - 657 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The mousedown event was triggered on the element - 08:04:21 INFO - 658 INFO Got event: 'mousedown' on [object HTMLDocument]. 08:04:21 INFO - 659 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The mousedown event was handled once before navigation - 08:04:21 INFO - 660 INFO Navigating to a new page 08:04:21 INFO - 661 INFO Try to access the element again 08:04:21 INFO - 662 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The attribute is correct after navigation - 08:04:21 INFO - 663 INFO TEST-PASS | devtools/server/tests/browser/browser_canvasframe_helper_04.js | The text content is correct after navigation - 08:04:21 INFO - 664 INFO Synthesizing an event on the element again 08:04:21 INFO - 665 INFO Waiting for event: 'mousedown' on [object HTMLDocument]. 08:04:21 INFO - 666 INFO Got event: 'mousedown' on [object HTMLDocument]. 08:04:21 INFO - Buffered messages finished 08:04:21 ERROR - 667 ERROR TEST-UNEXPECTED-FAIL | devtools/server/tests/browser/browser_canvasframe_helper_04.js | application terminated with exit code 1 08:04:21 INFO - runtests.py | Application ran for: 0:01:00.951000 08:04:21 INFO - zombiecheck | Reading PID log: c:\users\genericworker\appdata\local\temp\tmp17gbrjpidlog 08:04:21 INFO - mozcrash Copy/paste: Z:\task_1506843424\build\win32-minidump_stackwalk.exe c:\users\genericworker\appdata\local\temp\tmpbwfi4a.mozrunner\minidumps\997990f4-44ba-48b5-91e2-2f8fce58e708.dmp Z:\task_1506843424\build\symbols 08:04:39 INFO - mozcrash Saved minidump as Z:\task_1506843424\build\blobber_upload_dir\997990f4-44ba-48b5-91e2-2f8fce58e708.dmp 08:04:39 INFO - mozcrash Saved app info as Z:\task_1506843424\build\blobber_upload_dir\997990f4-44ba-48b5-91e2-2f8fce58e708.extra 08:04:40 WARNING - PROCESS-CRASH | devtools/server/tests/browser/browser_canvasframe_helper_04.js | application crashed [@ nsIPresShell::GetRootScrollFrame()] 08:04:40 INFO - Crash dump filename: c:\users\genericworker\appdata\local\temp\tmpbwfi4a.mozrunner\minidumps\997990f4-44ba-48b5-91e2-2f8fce58e708.dmp 08:04:40 INFO - Operating system: Windows NT 08:04:40 INFO - 6.1.7601 Service Pack 1 08:04:40 INFO - CPU: x86 08:04:40 INFO - GenuineIntel family 6 model 63 stepping 2 08:04:40 INFO - 8 CPUs 08:04:40 INFO - GPU: UNKNOWN 08:04:40 INFO - Crash reason: EXCEPTION_ACCESS_VIOLATION_READ 08:04:40 INFO - Crash address: 0x10 08:04:40 INFO - Process uptime: 61 seconds 08:04:40 INFO - Thread 0 (crashed) 08:04:40 INFO - 0 xul.dll!nsIPresShell::GetRootScrollFrame() [PresShell.cpp:325ab1b04aba : 2434 + 0x0] 08:04:40 INFO - eip = 0x5cb5bd8d esp = 0x0015b748 ebp = 0x0015b7b8 ebx = 0x1ee3b8f0 08:04:40 INFO - esi = 0x0f412760 edi = 0x1ee3b8e0 eax = 0x1ee3b880 ecx = 0x00000000 08:04:40 INFO - edx = 0x0015b75c efl = 0x00010246 08:04:40 INFO - Found by: given as instruction pointer in context 08:04:40 INFO - 1 xul.dll!nsIContent::GetFlattenedTreeParentNodeInternal(nsIContent::FlattenedParentType) [FragmentOrElement.cpp:325ab1b04aba : 197 + 0x22] 08:04:40 INFO - eip = 0x5ba3a023 esp = 0x0015b74c ebp = 0x0015b7b8 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 2 xul.dll!GetFlattenedTreeParentNode<1> [nsIContentInlines.h:325ab1b04aba : 99 + 0x10] 08:04:40 INFO - eip = 0x5b9b49b5 esp = 0x0015b7c0 ebp = 0x0015b7cc 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 3 xul.dll!nsINode::GetFlattenedTreeParentElementForStyle() [ElementInlines.h:325ab1b04aba : 49 + 0x6] 08:04:40 INFO - eip = 0x5b9bf381 esp = 0x0015b7d4 ebp = 0x0015b7e0 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 4 xul.dll!AssertNoBitsPropagatedFrom [Element.cpp:325ab1b04aba : 4354 + 0x7] 08:04:40 INFO - eip = 0x5ba3280c esp = 0x0015b7dc ebp = 0x0015b7e0 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 5 xul.dll!NoteDirtyElement [Element.cpp:325ab1b04aba : 4457 + 0x6] 08:04:40 INFO - eip = 0x5ba3e540 esp = 0x0015b7e8 ebp = 0x0015b804 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 6 xul.dll!mozilla::dom::Element::NoteDirtyForServo() [Element.cpp:325ab1b04aba : 4538 + 0xb] 08:04:40 INFO - eip = 0x5ba3e6eb esp = 0x0015b80c ebp = 0x0015b820 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 7 xul.dll!mozilla::ServoRestyleManager::SnapshotFor(mozilla::dom::Element *) [ServoRestyleManager.cpp:325ab1b04aba : 1055 + 0x7] 08:04:40 INFO - eip = 0x5cb718c3 esp = 0x0015b818 ebp = 0x0015b820 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 8 xul.dll!mozilla::ServoRestyleManager::ContentStateChanged(nsIContent *,mozilla::EventStates) [ServoRestyleManager.cpp:325ab1b04aba : 1251 + 0x8] 08:04:40 INFO - eip = 0x5cb51db7 esp = 0x0015b828 ebp = 0x0015b840 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 9 xul.dll!mozilla::RestyleManager::ContentStateChanged(nsIContent *,mozilla::EventStates) [RestyleManagerInlines.h:325ab1b04aba : 51 + 0x1b] 08:04:40 INFO - eip = 0x5cb51d2d esp = 0x0015b848 ebp = 0x0015b854 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 10 xul.dll!mozilla::PresShell::ContentStateChanged(nsIDocument *,nsIContent *,mozilla::EventStates) [PresShell.cpp:325ab1b04aba : 4254 + 0x1c] 08:04:40 INFO - eip = 0x5cb51cda esp = 0x0015b85c ebp = 0x0015b870 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 11 xul.dll!nsDocument::ContentStateChanged(nsIContent *,mozilla::EventStates) [nsDocument.cpp:325ab1b04aba : 5668 + 0x2f] 08:04:40 INFO - eip = 0x5baa94d7 esp = 0x0015b878 ebp = 0x0015b89c 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 12 xul.dll!mozilla::dom::Element::NotifyStateChange(mozilla::EventStates) [Element.cpp:325ab1b04aba : 247 + 0x11] 08:04:40 INFO - eip = 0x5ba3e835 esp = 0x0015b8a4 ebp = 0x0015b8c0 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 13 xul.dll!mozilla::dom::Element::RemoveStates(mozilla::EventStates) [Element.h:325ab1b04aba : 644 + 0x7] 08:04:40 INFO - eip = 0x5bafc48a esp = 0x0015b8c8 ebp = 0x0015b8dc 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 14 xul.dll!mozilla::EventStateManager::DoStateChange(mozilla::dom::Element *,mozilla::EventStates,bool) [EventStateManager.cpp:325ab1b04aba : 4875 + 0x6] 08:04:40 INFO - eip = 0x5c29946c esp = 0x0015b8e4 ebp = 0x0015b8ec 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 15 xul.dll!mozilla::EventStateManager::UpdateAncestorState(nsIContent *,nsIContent *,mozilla::EventStates,bool) [EventStateManager.cpp:325ab1b04aba : 4905 + 0x11] 08:04:40 INFO - eip = 0x5c29f8b9 esp = 0x0015b8f4 ebp = 0x0015b914 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 16 xul.dll!mozilla::EventStateManager::SetContentState(nsIContent *,mozilla::EventStates) [EventStateManager.cpp:325ab1b04aba : 5055 + 0x14] 08:04:40 INFO - eip = 0x5c29f214 esp = 0x0015b91c ebp = 0x0015b950 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 17 xul.dll!mozilla::EventStateManager::SetActiveManager(mozilla::EventStateManager *,nsIContent *) [EventStateManager.cpp:325ab1b04aba : 5414 + 0xb] 08:04:40 INFO - eip = 0x5c29ecb3 esp = 0x0015b958 ebp = 0x0015b968 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 18 xul.dll!mozilla::EventStateManager::PostHandleEvent(nsPresContext *,mozilla::WidgetEvent *,nsIFrame *,nsEventStatus *) [EventStateManager.cpp:325ab1b04aba : 3202 + 0xb] 08:04:40 INFO - eip = 0x5c29d1b7 esp = 0x0015b970 ebp = 0x0015b9ac 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 19 xul.dll!mozilla::PresShell::HandleEventInternal(mozilla::WidgetEvent *,nsEventStatus *,bool) [PresShell.cpp:325ab1b04aba : 7766 + 0x1f] 08:04:40 INFO - eip = 0x5cb5eb2c esp = 0x0015b9b4 ebp = 0x0015ba2c 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 20 xul.dll!mozilla::PresShell::HandlePositionedEvent(nsIFrame *,mozilla::WidgetGUIEvent *,nsEventStatus *) [PresShell.cpp:325ab1b04aba : 7510 + 0xf] 08:04:40 INFO - eip = 0x5cb5f4a2 esp = 0x0015ba34 ebp = 0x0015ba4c 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 21 xul.dll!mozilla::PresShell::HandleEvent(nsIFrame *,mozilla::WidgetGUIEvent *,bool,nsEventStatus *,nsIContent * *) [PresShell.cpp:325ab1b04aba : 7307 + 0x7] 08:04:40 INFO - eip = 0x5cb5e0ee esp = 0x0015ba54 ebp = 0x0015bb18 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 22 xul.dll!nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent *,nsView *,nsEventStatus *) [nsViewManager.cpp:325ab1b04aba : 812 + 0x1b] 08:04:40 INFO - eip = 0x5c931d64 esp = 0x0015bb20 ebp = 0x0015bb50 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 23 xul.dll!nsView::HandleEvent(mozilla::WidgetGUIEvent *,bool) [nsView.cpp:325ab1b04aba : 1140 + 0x15] 08:04:40 INFO - eip = 0x5c9328f6 esp = 0x0015bb58 ebp = 0x0015bb70 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 24 xul.dll!nsWindow::DispatchEvent(mozilla::WidgetGUIEvent *,nsEventStatus &) [nsWindow.cpp:325ab1b04aba : 4169 + 0x10] 08:04:40 INFO - eip = 0x5c9b3d15 esp = 0x0015bb78 ebp = 0x0015bb88 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 25 xul.dll!nsContentUtils::SendMouseEvent(nsCOMPtr<nsIPresShell> const &,nsTSubstring<char16_t> const &,float,float,int,int,int,int,bool,float,unsigned short,unsigned int,bool,bool *,bool,bool) [nsContentUtils.cpp:325ab1b04aba : 8805 + 0x1a] 08:04:40 INFO - eip = 0x5b9c9f80 esp = 0x0015bb90 ebp = 0x0015bc7c 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 26 xul.dll!nsDOMWindowUtils::SendMouseEventCommon(nsTSubstring<char16_t> const &,float,float,int,int,int,bool,float,unsigned short,unsigned int,bool,bool *,bool,bool,int) [nsDOMWindowUtils.cpp:325ab1b04aba : 756 + 0x4f] 08:04:40 INFO - eip = 0x5b9d7199 esp = 0x0015bc84 ebp = 0x0015bcc8 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 27 xul.dll!nsDOMWindowUtils::SendMouseEvent(nsTSubstring<char16_t> const &,float,float,int,int,int,bool,float,unsigned short,bool,bool,int,unsigned int,unsigned char,bool *) [nsDOMWindowUtils.cpp:325ab1b04aba : 692 + 0x7a] 08:04:40 INFO - eip = 0x5b9d7131 esp = 0x0015bcd0 ebp = 0x0015bd10 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 28 xul.dll!NS_InvokeByIndex + 0x27 08:04:40 INFO - eip = 0x5addd527 esp = 0x0015bd18 ebp = 0x0015bd94 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 29 xul.dll!CallMethodHelper::Invoke() [XPCWrappedNative.cpp:325ab1b04aba : 1996 + 0xf] 08:04:40 INFO - eip = 0x5b5449b3 esp = 0x0015bd9c ebp = 0x0015bdc8 08:04:40 INFO - Found by: previous frame's frame pointer 08:04:40 INFO - 30 xul.dll!CallMethodHelper::Call() [XPCWrappedNative.cpp:325ab1b04aba : 1315 + 0x7] 08:04:40 INFO - eip = 0x5b538a6d esp = 0x0015bdb0 ebp = 0x0015bdc8 08:04:40 INFO - Found by: call frame info with scanning 08:04:40 INFO - 31 xul.dll!XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) [XPCWrappedNative.cpp:325ab1b04aba : 1282 + 0x12] 08:04:40 INFO - eip = 0x5b538b02 esp = 0x0015bdd0 ebp = 0x0015bdc8 08:04:40 INFO - Found by: stack scanning 08:04:40 INFO - 32 xul.dll!XPCWrappedNative::CallMethod(XPCCallContext &,XPCWrappedNative::CallMode) [XPCWrappedNative.cpp:325ab1b04aba : 1282 + 0x12] 08:04:40 INFO - eip = 0x5b538b02 esp = 0x0015bdd8 ebp = 0x0015bea8 08:04:40 INFO - Found by: stack scanning 08:04:40 INFO - 33 xul.dll!js::HeapSlot::assertPreconditionForWriteBarrierPost(js::NativeObject *,js::HeapSlot::Kind,unsigned int,JS::Value const &) [Barrier.cpp:325ab1b04aba : 64 + 0x7] 08:04:40 INFO - eip = 0x5dc6f7fa esp = 0x0015be14 ebp = 0x0015bea8 08:04:40 INFO - Found by: stack scanning 08:04:40 INFO - 34 xul.dll!XPC_WN_CallMethod(JSContext *,unsigned int,JS::Value *) [XPCWrappedNativeJSOps.cpp:325ab1b04aba : 929 + 0xd] 08:04:40 INFO - eip = 0x5b54bc00 esp = 0x0015beb0 ebp = 0x0015bf5c 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 35 xul.dll!js::frontend::BytecodeEmitter::locationOfNameBoundInFunctionScope(JSAtom *,js::frontend::BytecodeEmitter::EmitterScope *) [BytecodeEmitter.cpp:325ab1b04aba : 2276 + 0x5] 08:04:40 INFO - eip = 0x5e0d6b01 esp = 0x0015becc ebp = 0x0015bf5c 08:04:40 INFO - Found by: stack scanning 08:04:40 INFO - 36 xul.dll!js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [jscntxtinlines.h:325ab1b04aba : 293 + 0xd] 08:04:40 INFO - eip = 0x5e1a5d34 esp = 0x0015bf64 ebp = 0x00000000 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 37 xul.dll!JS::Rooted<JSFunction *>::Rooted<JSFunction *><JSContext *,JSFunction *>(JSContext * const &,JSFunction * &&) [RootingAPI.h:325ab1b04aba : 831 + 0xc] 08:04:40 INFO - eip = 0x5b4c4fb6 esp = 0x0015bf80 ebp = 0x0015c250 08:04:40 INFO - Found by: stack scanning 08:04:40 INFO - 38 xul.dll!js::CheckZoneGroup<3>::check() [ProtectedData.cpp:325ab1b04aba : 77 + 0x5] 08:04:40 INFO - eip = 0x5dd8a7f8 esp = 0x0015bfac ebp = 0x0015c010 08:04:40 INFO - Found by: call frame info with scanning 08:04:40 INFO - 39 xul.dll!js::gc::IsCellPointerValid(void const *) [HeapAPI.h:325ab1b04aba : 414 + 0x6] 08:04:40 INFO - eip = 0x5ad5c187 esp = 0x0015bfc4 ebp = 0x0015c010 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 40 xul.dll!js::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,js::AnyInvokeArgs const &,JS::MutableHandle<JS::Value>) [Interpreter.cpp:325ab1b04aba : 559 + 0x5] 08:04:40 INFO - eip = 0x5e1a5b44 esp = 0x0015c018 ebp = 0x0015c2e4 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 41 xul.dll!js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [jscntxtinlines.h:325ab1b04aba : 293 + 0xd] 08:04:40 INFO - eip = 0x5e1a5d34 esp = 0x0015c2ec ebp = 0x0015c250 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 42 xul.dll!js::gc::IsCellPointerValid(void const *) [HeapAPI.h:325ab1b04aba : 414 + 0x6] 08:04:40 INFO - eip = 0x5ad5c187 esp = 0x0015c340 ebp = 0x0015c398 08:04:40 INFO - Found by: call frame info with scanning 08:04:40 INFO - 43 xul.dll!Interpret [Interpreter.cpp:325ab1b04aba : 3084 + 0x10] 08:04:40 INFO - eip = 0x5e1af2a6 esp = 0x0015c3a0 ebp = 0x0015c9c8 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 44 xul.dll!js::SetNewObjectMetadata<js::NativeObject> [jsobjinlines.h:325ab1b04aba : 373 + 0x11] 08:04:40 INFO - eip = 0x5ddd4cac esp = 0x0015c438 ebp = 0x0015c9c8 08:04:40 INFO - Found by: stack scanning 08:04:40 INFO - 45 xul.dll!js::RunScript(JSContext *,js::RunState &) [Interpreter.cpp:325ab1b04aba : 435 + 0xd] 08:04:40 INFO - eip = 0x5e1b6b5c esp = 0x0015c9d0 ebp = 0x0015c468 08:04:40 INFO - Found by: call frame info 08:04:40 INFO - 46 xul.dll!mozilla::CycleCollectedJSContext::InitializeNonPrimary(mozilla::CycleCollectedJSContext *) [CycleCollectedJSContext.cpp:325ab1b04aba : 166 + 0x5] 08:04:40 INFO - eip = 0x5ad5c100 esp = 0x0015cac4 ebp = 0x0015ca88 08:04:40 INFO - Found by: call frame info with scanning

Need a null check in the assertion: https://treeherder.mozilla.org/#/jobs?repo=try&revision=a458bf175926212971506d93d492ac9be5760af1

Pushed by bholley@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/a7053520bcdc Use the nsContentUtils machinery for identifying document-level NAC in GetFlattenedTreeParentNodeInternal. r=emilio https://hg.mozilla.org/integration/autoland/rev/369b409b1129 Crashtest. r=me

https://hg.mozilla.org/mozilla-central/rev/a7053520bcdc https://hg.mozilla.org/mozilla-central/rev/369b409b1129

Approval Request Comment [Feature/Bug causing the regression]: Stylo [User impact if declined]: Potential crashes or rendering issues [Is this code covered by automated tests?]: yes [Has the fix been verified in Nightly?]: No [Needs manual test from QE? If yes, steps to reproduce]: No [List of other uplifts needed for the feature/fix]: None [Is the change risky?]: Pretty low risk. [Why is the change risky/not risky?]: At the time this code was written, we didn't have a general utility method for finding all the NAC, and so we hand-rolled it. Later, we added more sources of NAC, and implemented the utility method for finding it all. But we forgot to update this code, and so there's a mismatch between what this code considers to be NAC and what the rest of the code considers to be NAC, which can lead to inconsistencies. This patch basically just removes a lot of code, and most of the added code is debug-only checking which gives us extra confidence we're getting it right. [String changes made/needed]: None

Comment on attachment 8914417 [details] revisions for uplift (same as comment 18) Stylo related, has automated tests, Beta57+

https://hg.mozilla.org/releases/mozilla-beta/rev/999ba109c2fb https://hg.mozilla.org/releases/mozilla-beta/rev/5eccbe7a7bf8

(In reply to Bobby Holley (:bholley) (busy with Stylo) from comment #19) > [Is this code covered by automated tests?]: yes > [Has the fix been verified in Nightly?]: No > [Needs manual test from QE? If yes, steps to reproduce]: No Setting qe-verify- based on Bobby's assessment on manual testing needs and the fact that this fix has automated coverage.