Closed
Bug 1409183
Opened 7 years ago
Closed 6 years ago
stylo: Assertion failure: !mInStyleRefresh in [@ mozilla::ServoRestyleManager::ContentStateChanged]
Categories
(Core :: CSS Parsing and Computation, defect, P3)
Tracking
()
RESOLVED
FIXED
mozilla61
People
(Reporter: tsmith, Assigned: emilio)
References
(Blocks 2 open bugs)
Details
(Keywords: assertion, testcase)
Attachments
(2 files)
Assertion failure: !mInStyleRefresh, at /src/layout/base/ServoRestyleManager.cpp:1253 #0 mozilla::ServoRestyleManager::ContentStateChanged(nsIContent*, mozilla::EventStates) /src/layout/base/ServoRestyleManager.cpp:1253:3 #1 mozilla::PresShell::ContentStateChanged(nsIDocument*, nsIContent*, mozilla::EventStates) /src/layout/base/PresShell.cpp:4255:37 #2 nsDocument::ContentStateChanged(nsIContent*, mozilla::EventStates) /src/dom/base/nsDocument.cpp:5708:3 #3 mozilla::dom::Element::UpdateState(bool) /src/dom/base/Element.cpp:273:14 #4 mozilla::dom::HTMLInputElement::SetCheckedInternal(bool, bool) /src/dom/html/HTMLInputElement.cpp:3344:3 #5 mozilla::dom::HTMLInputElement::RadioSetChecked(bool) /src/dom/html/HTMLInputElement.cpp:3234:9 #6 mozilla::dom::HTMLInputElement::AddedToRadioGroup() /src/dom/html/HTMLInputElement.cpp:6749:5 #7 mozilla::dom::HTMLInputElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/html/HTMLInputElement.cpp:4846:5 #8 mozilla::dom::Element::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/base/Element.cpp:1710:17 #9 nsGenericHTMLElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/html/nsGenericHTMLElement.cpp:482:43 #10 mozilla::dom::Element::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/base/Element.cpp:1710:17 #11 nsSVGElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/svg/nsSVGElement.cpp:268:35 #12 mozilla::dom::SVGTitleElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/svg/SVGTitleElement.cpp:82:38 #13 mozilla::dom::Element::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/base/Element.cpp:1710:17 #14 nsSVGElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/svg/nsSVGElement.cpp:268:35 #15 mozilla::dom::SVGSVGElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /src/dom/svg/SVGSVGElement.cpp:515:37 #16 nsCSSFrameConstructor::GetAnonymousContent(nsIContent*, nsIFrame*, nsTArray<nsIAnonymousContentCreator::ContentInfo>&) /src/layout/base/nsCSSFrameConstructor.cpp:4395:19 #17 nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsStyleContext*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*) /src/layout/base/nsCSSFrameConstructor.cpp:11288:3 #18 nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) /src/layout/base/nsCSSFrameConstructor.cpp:4206:9 #19 nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) /src/layout/base/nsCSSFrameConstructor.cpp:6411:3 #20 nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameItems&) /src/layout/base/nsCSSFrameConstructor.cpp:11060:5 #21 nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, nsCSSFrameConstructor::InsertionKind, TreeMatchContext*) /src/layout/base/nsCSSFrameConstructor.cpp:8434:3 #22 nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /src/layout/base/nsCSSFrameConstructor.cpp:10096:9 #23 mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /src/layout/base/RestyleManager.cpp:1513:25 #24 mozilla::ServoRestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /src/layout/base/ServoRestyleManager.cpp:1158:9 #25 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /src/layout/base/PresShell.cpp:4146:41 #26 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:1926:18 #27 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:307:7 #28 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:328:5 #29 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:770:5 #30 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:683:35 #31 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /src/layout/base/nsRefreshDriver.cpp:529:20 #32 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14 #33 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:524:10 #34 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21 #35 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10 #36 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3 #37 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27 #38 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30 #39 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4694:22 #40 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4856:8 #41 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4951:21 #42 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:231:22 #43 main /src/browser/app/nsBrowserApp.cpp:304:16 #44 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 #45 _start (firefox+0x41ebe4)
Flags: in-testsuite?
Comment 1•7 years ago
|
||
Similar to bug 1404180.
Summary: Assertion failure: !mInStyleRefresh in [@ mozilla::ServoRestyleManager::ContentStateChanged] → stylo: Assertion failure: !mInStyleRefresh in [@ mozilla::ServoRestyleManager::ContentStateChanged]
Updated•7 years ago
|
Blocks: stylo-fuzzing
status-firefox56:
--- → unaffected
status-firefox57:
--- → ?
status-firefox-esr52:
--- → unaffected
Priority: -- → P3
Comment 2•7 years ago
|
||
Indeed, is does look similar. This time associating with a radio group across the SVG <use> element shadow boundary.
Updated•7 years ago
|
Assignee: nobody → cam
Comment 3•7 years ago
|
||
INFO: Last good revision: aab0dfdae32f14246e3bed8824a5f7ce309276cd INFO: First bad revision: 3e6477d932037d6026ac13bd8c988dc0a51935d4 INFO: Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=aab0dfdae32f14246e3bed8824a5f7ce309276cd&tochange=3e6477d932037d6026ac13bd8c988dc0a51935d4
Reporter | ||
Updated•7 years ago
|
status-firefox59:
--- → affected
Reporter | ||
Updated•6 years ago
|
status-firefox60:
--- → affected
status-firefox61:
--- → affected
Comment 4•6 years ago
|
||
Assignee | ||
Updated•6 years ago
|
Assignee: cam → emilio
Assignee | ||
Updated•6 years ago
|
Attachment #8959649 -
Flags: review?(bugs)
Assignee | ||
Comment 5•6 years ago
|
||
Probably we should switch <svg:use> to Shadow DOM...
Comment 6•6 years ago
|
||
Comment on attachment 8959649 [details] Bug 1409183: Don't consider anonymous checkboxes as part of the document radio group. r=smaug Olli Pettay [:smaug] has approved the revision. https://phabricator.services.mozilla.com/D741
Attachment #8959649 -
Flags: review+
Updated•6 years ago
|
Attachment #8959649 -
Flags: review?(bugs)
Pushed by ecoal95@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/f930f3eafde5 Don't consider anonymous checkboxes as part of the document radio group. r=smaug
Comment 8•6 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/f930f3eafde5
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Comment 9•6 years ago
|
||
Emilio, should we uplift this fix to Beta 60? Or is this a fuzzing corner case that is unlikely to affect web content?
Flags: needinfo?(emilio)
Assignee | ||
Comment 10•6 years ago
|
||
I think it's very hard to hit this, you need a checkbox in an <svg:use> subtree... It can be a footgun though, so given I don't think it's very risky, and there's still time, I think we can try to uplift it, your call. We've shipped this since forever btw, the bug blocked only added the assertion.
Flags: needinfo?(emilio)
Comment 11•6 years ago
|
||
(In reply to Emilio Cobos Álvarez [:emilio] from comment #10) > We've shipped this since forever btw, the bug blocked only added the > assertion. Sounds like there's no need to rush this then. firefox60=wontfix
You need to log in
before you can comment on or make changes to this bug.
Description
•