Closed
Bug 1640040
Opened 4 years ago
Closed 4 years ago
Assertion failure: !mInStyleRefresh, at src/layout/base/RestyleManager.cpp:3141
Categories
(Core :: Layout, defect)
Core
Layout
Tracking
()
RESOLVED
FIXED
81 Branch
People
(Reporter: tsmith, Assigned: emilio)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase, Whiteboard: [bugmon:confirmed])
Attachments
(3 files)
Reduced with m-c 20200520-855249e545c3
Assertion failure: !mInStyleRefresh, at /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3141
0|0|libxul.so|mozilla::RestyleManager::ContentStateChanged(nsIContent*, mozilla::EventStates)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|3141|0x29
0|1|libxul.so|mozilla::PresShell::ContentStateChanged(mozilla::dom::Document*, nsIContent*, mozilla::EventStates)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4282|0x25
0|2|libxul.so|mozilla::dom::Document::ContentStateChanged(nsIContent*, mozilla::EventStates)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|7380|0xcd
0|3|libxul.so|mozilla::dom::Element::UpdateState(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|291|0xe
0|4|libxul.so|mozilla::TextControlState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2674|0xd
0|5|libxul.so|mozilla::TextControlState::UnbindFromFrame(nsTextControlFrame*)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2465|0xf
0|6|libxul.so|nsTextControlFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&)|hg:hg.mozilla.org/mozilla-central:layout/forms/nsTextControlFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|143|0x14
0|7|libxul.so|nsBlockFrame::DoRemoveFrameInternal(nsIFrame*, unsigned int, mozilla::layout::PostFrameDestroyData&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|6250|0x13
0|8|libxul.so|nsBlockFrame::DoRemoveFrame(nsIFrame*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.h:855249e545c361516a65bcba8f5bc6b423e2d131|528|0x11
0|9|libxul.so|nsBlockFrame::RemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|5566|0x10
0|10|libxul.so|nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|7560|0x12
0|11|libxul.so|nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|8559|0x10
0|12|libxul.so|mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1482|0xa
0|13|libxul.so|mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/RestyleManager.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|3034|0xb
0|14|libxul.so|mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|4161|0x1c
0|15|libxul.so|mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|10004|0x23
0|16|libxul.so|mozilla::AccessibleCaretManager::FlushLayout()|hg:hg.mozilla.org/mozilla-central:layout/base/AccessibleCaretManager.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1025|0xa
0|17|libxul.so|mozilla::AccessibleCaretManager::DispatchCaretStateChangedEvent(mozilla::dom::CaretChangedReason)|hg:hg.mozilla.org/mozilla-central:layout/base/AccessibleCaretManager.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1398|0x5
0|18|libxul.so|mozilla::AccessibleCaretManager::OnSelectionChanged(mozilla::dom::Document*, mozilla::dom::Selection*, short)|hg:hg.mozilla.org/mozilla-central:layout/base/AccessibleCaretManager.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|0|0x21
0|19|libxul.so|mozilla::dom::Selection::NotifySelectionListeners()|hg:hg.mozilla.org/mozilla-central:dom/base/Selection.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|3149|0x1d
0|20|libxul.so|nsFrameSelection::NotifySelectionListeners(mozilla::SelectionType)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrameSelection.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2150|0x10
0|21|libxul.so|mozilla::dom::Selection::EndBatchChanges(short)|hg:hg.mozilla.org/mozilla-central:dom/base/Selection.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|3178|0x13
0|22|libxul.so|mozilla::dom::SelectionBatcher::~SelectionBatcher()|hg:hg.mozilla.org/mozilla-central:dom/base/Selection.h:855249e545c361516a65bcba8f5bc6b423e2d131|917|0xf
0|23|libxul.so|mozilla::TextControlState::SetValueWithTextEditor(mozilla::AutoTextControlHandlingState&)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2841|0x5
0|24|libxul.so|mozilla::TextControlState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2658|0x8
0|25|libxul.so|mozilla::dom::HTMLInputElement::SetValueInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLInputElement.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2656|0x19
0|26|libxul.so|mozilla::TextControlState::SetRangeText(nsTSubstring<char16_t> const&, unsigned int, unsigned int, mozilla::dom::SelectionMode, mozilla::ErrorResult&, mozilla::Maybe<unsigned int> const&, mozilla::Maybe<unsigned int> const&)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2292|0x10
0|27|libxul.so|mozilla::TextControlState::SetRangeText(nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2246|0x17
0|28|libxul.so|mozilla::dom::HTMLInputElement_Binding::setRangeText(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:d0594af1af02f110c6e2c2113c6bc01b2844cc970af7d98c7f90b0047a98e56eda646e43b713a4dcc1720da6498d496924bcdfcb577c058cb404f6e83fea9e03/dom/bindings/HTMLInputElementBinding.cpp:|4004|0xb
0|29|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|3203|0x21
0|30|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|493|0x12
0|31|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|585|0x12
0|32|libxul.so|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|652|0x7
0|33|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|465|0xb
0|34|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|620|0xd
0|35|libxul.so|<name omitted>|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|665|0xb
0|36|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2840|0x23
0|37|libxul.so|mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:a39a0c7064327d8bf5f33af316b4cc9c9d3236184b2183673b9f8103182682809cdd62ab814947d309a2f0405582be39e80ec6d762aad6de8c66e51e15d2f95d/dom/bindings/EventHandlerBinding.cpp:|276|0xb
0|38|libxul.so|void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:5abc72777d30ad0ea7b8b3e1392cd7961bd73b8cd08e5ab209f3b42251def563ee9c9a7cea98a24d0fa9d867edfc0c0297c165b0d167458ac5a2af4b7a0caebe/dist/include/mozilla/dom/EventHandlerBinding.h:|367|0x28
0|39|libxul.so|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|hg:hg.mozilla.org/mozilla-central:dom/events/JSEventHandler.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|201|0x18
0|40|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1088|0xc
0|41|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1280|0x15
0|42|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|356|0xb
0|43|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|558|0x19
0|44|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1055|0x5
0|45|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1146|0x1c
0|46|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|5817|0x18
0|47|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|5569|0xe
0|48|libxul.so|non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|0|0x10
0|49|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1345|0x3
0|50|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|905|0x28
0|51|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|725|0xe
0|52|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|613|0xb
0|53|libxul.so|non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|0|0xd
0|54|libxul.so|mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|611|0x14
0|55|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|518|0xe
0|56|libxul.so|mozilla::dom::Document::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|10698|0x1c
0|57|libxul.so|mozilla::dom::Document::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|10630|0x8
0|58|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|7277|0xd
0|59|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:855249e545c361516a65bcba8f5bc6b423e2d131|1237|0x17
0|60|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|146|0x11
0|61|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|1211|0x11
0|62|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|501|0xc
0|63|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|87|0x7
0|64|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:855249e545c361516a65bcba8f5bc6b423e2d131|315|0x17
0|65|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:855249e545c361516a65bcba8f5bc6b423e2d131|290|0x8
0|66|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|137|0xd
0|67|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|909|0xe
0|68|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|237|0x5
0|69|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:855249e545c361516a65bcba8f5bc6b423e2d131|315|0x17
0|70|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:855249e545c361516a65bcba8f5bc6b423e2d131|290|0x8
0|71|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|740|0x5
0|72|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|56|0x11
0|73|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|303|0x20
Flags: in-testsuite?
|
||
Comment 1•4 years ago
|
||
Is this a recent regression?
|
Assignee | |
Comment 2•4 years ago
|
||
Seems like AccessibleCaret flushing at a bad time, again :(
This probably needs prefs doesn't it? It doesn't seem to crash here.
Flags: needinfo?(twsmith)
|
Reporter | |
Comment 3•4 years ago
|
||
Flags: needinfo?(twsmith)
|
|
Reporter | |
Comment 4•4 years ago
|
||
A Pernosco session is available here: https://pernos.co/debug/vvHKqkbMdGFdEHE1-JiLtQ/index.html
|
||
Comment 5•4 years ago
|
||
It sure seems like this bit of the stack (frame 6 leading to frame 2) shouldn't be able to happen:
0|2|libxul.so|mozilla::dom::Document::ContentStateChanged(nsIContent*, mozilla::EventStates)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|7380|0xcd
0|3|libxul.so|mozilla::dom::Element::UpdateState(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|291|0xe
0|4|libxul.so|mozilla::TextControlState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2674|0xd
0|5|libxul.so|mozilla::TextControlState::UnbindFromFrame(nsTextControlFrame*)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|2465|0xf
0|6|libxul.so|nsTextControlFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&)|hg:hg.mozilla.org/mozilla-central:layout/forms/nsTextControlFrame.cpp:855249e545c361516a65bcba8f5bc6b423e2d131|143|0x14
|
|
Assignee | |
Comment 6•4 years ago
|
||
Yes, that bit has always been a bit problematic. That SetValue() call should always be idempotent with regards to element state... except this time it is called from TextControlState::SetValue in the middle of actually changing the state.
|
||
Updated•4 years ago
|
Severity: -- → S3
|
||
Comment 7•4 years ago
|
||
Bugmon Analysis:
Unable to reproduce bug using the following builds:
> mozilla-central 20200526023857-da2c7b0ac9a4
> mozilla-central 20200521023441-3d91ba9e1d25
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.|
|
Assignee | |
Comment 8•4 years ago
|
||
Does this need any pref to repro or something? It doesn't seem to repro and I tried on 68 and it doesn't either.
Flags: needinfo?(twsmith)
|
|
Reporter | |
Comment 9•4 years ago
|
||
I was able to reproduce it with the attached test case and prefs file. I'm not sure which specific pref (or prefs) is required.
Here is a new Pernosco session with an up-to-date build: https://pernos.co/debug/CQYicbSbod1D7m_gsG29tg/index.html
Flags: needinfo?(twsmith)
|
|
Assignee | |
Comment 11•4 years ago
|
||
The problematic call stack is this:
#0 0x00007f89cb4854af in mozilla::TextControlState::UnbindFromFrame (this=0x60b0000e33c0, aFrame=0x625000380488) at /home/twsmith/code/mozilla-central/dom/html/TextControlState.cpp:2452
#1 0x00007f89cb2c7550 in mozilla::dom::HTMLInputElement::UnbindFromFrame (this=0x6150001d2480, aFrame=0x625000380488) at /home/twsmith/code/mozilla-central/dom/html/HTMLInputElement.cpp:2297
#2 0x00007f89cf725961 in nsTextControlFrame::DestroyFrom (this=0x625000380488, aDestructRoot=0x625000380488, aPostDestroyData=...) at /home/twsmith/code/mozilla-central/layout/forms/nsTextControlFrame.cpp:144
#3 0x00007f89cf1b8f73 in nsBlockFrame::DoRemoveFrameInternal (this=0x62500037ff98, aDeletedFrame=0x625000380488, aFlags=2, aPostDestroyData=...) at /home/twsmith/code/mozilla-central/layout/generic/nsBlockFrame.cpp:6223
#4 0x00007f89cf259deb in nsBlockFrame::DoRemoveFrame (this=0x62500037ff98, aDeletedFrame=0x625000380488, aFlags=2) at /home/twsmith/code/mozilla-central/layout/generic/nsBlockFrame.h:532
#5 0x00007f89cf1b3232 in nsBlockFrame::RemoveFrame (this=0x62500037ff98, aListID=mozilla::layout::kPrincipalList, aOldFrame=0x625000380488) at /home/twsmith/code/mozilla-central/layout/generic/nsBlockFrame.cpp:5538
#6 0x00007f89ceefff4f in nsFrameManager::RemoveFrame (this=0x6110001c2680, aListID=mozilla::layout::kPrincipalList, aOldFrame=0x625000380488) at /home/twsmith/code/mozilla-central/layout/base/nsFrameManager.cpp:116
#7 0x00007f89ceefdff0 in nsCSSFrameConstructor::ContentRemoved (this=0x6110001c2680, aChild=0x6150001d2480, aOldNextSibling=0x60c000252880, aFlags=nsCSSFrameConstructor::REMOVE_FOR_RECONSTRUCTION) at /home/twsmith/code/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:7553
#8 0x00007f89ceef156e in nsCSSFrameConstructor::RecreateFramesForContent (this=0x6110001c2680, aContent=0x6150001d2480, aInsertionKind=nsCSSFrameConstructor::InsertionKind::Sync) at /home/twsmith/code/mozilla-central/layout/base/nsCSSFrameConstructor.cpp:8535
#9 0x00007f89cee30876 in mozilla::RestyleManager::ProcessRestyledFrames (this=0x60c00024f640, aChangeList=...) at /home/twsmith/code/mozilla-central/layout/base/RestyleManager.cpp:1484
#10 0x00007f89cee3d466 in mozilla::RestyleManager::DoProcessPendingRestyles (this=0x60c00024f640, aFlags=mozilla::ServoTraversalFlags::Empty) at /home/twsmith/code/mozilla-central/layout/base/RestyleManager.cpp:3037
#11 0x00007f89cededc27 in mozilla::RestyleManager::ProcessPendingRestyles (this=0x60c00024f640) at /home/twsmith/code/mozilla-central/layout/base/RestyleManager.cpp:3116
#12 0x00007f89cedecf0c in mozilla::PresShell::DoFlushPendingNotifications (this=0x622000042100, aFlush=...) at /home/twsmith/code/mozilla-central/layout/base/PresShell.cpp:4190
#13 0x00007f89c671f406 in mozilla::PresShell::FlushPendingNotifications (this=0x622000042100, aType=...) at /home/twsmith/code/mozilla-central/objdir-ff-ubsan/dist/include/mozilla/PresShell.h:1421
#14 0x00007f89c6ac438d in mozilla::dom::Document::FlushPendingNotifications (this=0x61e00003b480, aFlush=...) at /home/twsmith/code/mozilla-central/dom/base/Document.cpp:10091
#15 0x00007f89c6a8d5a9 in mozilla::dom::Document::FlushPendingNotifications (this=0x61e00003b480, aType=mozilla::FlushType::Layout) at /home/twsmith/code/mozilla-central/dom/base/Document.cpp:10012
#16 0x00007f89ced8f9ac in mozilla::AccessibleCaretManager::FlushLayout (this=0x606000247b20) at /home/twsmith/code/mozilla-central/layout/base/AccessibleCaretManager.cpp:1023
#17 0x00007f89ced9d282 in mozilla::AccessibleCaretManager::DispatchCaretStateChangedEvent (this=0x606000247b20, aReason=mozilla::dom::CaretChangedReason::Visibilitychange) at /home/twsmith/code/mozilla-central/layout/base/AccessibleCaretManager.cpp:1395
#18 0x00007f89ced8f71c in mozilla::AccessibleCaretManager::HideCarets (this=0x606000247b20) at /home/twsmith/code/mozilla-central/layout/base/AccessibleCaretManager.cpp:175
#19 0x00007f89ced8ee99 in mozilla::AccessibleCaretManager::OnSelectionChanged (this=0x606000247b20, aDoc=0x61e00003b480, aSel=0x61000006e440, aReason=0) at /home/twsmith/code/mozilla-central/layout/base/AccessibleCaretManager.cpp:125
#20 0x00007f89cee7351a in mozilla::AccessibleCaretEventHub::NoActionState::OnSelectionChanged (this=0x7f89df63b140 <mozilla::AccessibleCaretEventHub::NoActionState()::singleton>, aContext=0x6080000f2920, aDoc=0x61e00003b480, aSel=0x61000006e440, aReason=0) at /home/twsmith/code/mozilla-central/layout/base/AccessibleCaretEventHub.cpp:86
#21 0x00007f89ced8d1e0 in mozilla::AccessibleCaretEventHub::OnSelectionChange (this=0x6080000f2920, aDoc=0x61e00003b480, aSel=0x61000006e440, aReason=0) at /home/twsmith/code/mozilla-central/layout/base/AccessibleCaretEventHub.cpp:675
#22 0x00007f89c6d34025 in mozilla::dom::Selection::NotifySelectionListeners (this=0x61000006e440) at /home/twsmith/code/mozilla-central/dom/base/Selection.cpp:3130
#23 0x00007f89cf2d75e0 in nsFrameSelection::NotifySelectionListeners (this=0x6110001d5dc0, aSelectionType=mozilla::SelectionType::eNormal) at /home/twsmith/code/mozilla-central/layout/generic/nsFrameSelection.cpp:2168
#24 0x00007f89cf2dccb0 in nsFrameSelection::EndBatchChanges (this=0x6110001d5dc0, aReasons=0) at /home/twsmith/code/mozilla-central/layout/generic/nsFrameSelection.cpp:2159
#25 0x00007f89c6d3f82c in mozilla::dom::Selection::EndBatchChanges (this=0x61000006e440, aReason=0) at /home/twsmith/code/mozilla-central/dom/base/Selection.cpp:3159
#26 0x00007f89c6d766dc in mozilla::dom::SelectionBatcher::~SelectionBatcher (this=0x7ffcfd9a61c0) at /home/twsmith/code/mozilla-central/objdir-ff-ubsan/dist/include/mozilla/dom/Selection.h:912
#27 0x00007f89cb4be3b6 in mozilla::TextControlState::SetValueWithTextEditor (this=0x60b0000e33c0, aHandlingSetValue=...) at /home/twsmith/code/mozilla-central/dom/html/TextControlState.cpp:2834
#28 0x00007f89cb4bd668 in mozilla::TextControlState::SetValue (this=0x60b0000e33c0, aValue=..., aOldValue=0x0, aFlags=12) at /home/twsmith/code/mozilla-central/dom/html/TextControlState.cpp:2651
#29 0x00007f89cb2d432a in mozilla::dom::HTMLInputElement::SetValueInternal (this=0x6150001d2480, aValue=..., aOldValue=0x0, aFlags=12) at /home/twsmith/code/mozilla-central/dom/html/HTMLInputElement.cpp:2652
#30 0x00007f89cb31d02c in mozilla::dom::HTMLInputElement::SetValueInternal (this=0x6150001d2480, aValue=..., aFlags=12) at /home/twsmith/code/mozilla-central/objdir-ff-ubsan/dist/include/mozilla/dom/HTMLInputElement.h:925
#31 0x00007f89cb2f5572 in mozilla::dom::HTMLInputElement::SetValueFromSetRangeText (this=0x6150001d2480, aValue=...) at /home/twsmith/code/mozilla-central/dom/html/HTMLInputElement.cpp:5417
#32 0x00007f89cb48d2d7 in mozilla::TextControlState::SetRangeText (this=0x60b0000e33c0, aReplacement=..., aStart=0, aEnd=0, aSelectMode=mozilla::dom::SelectionMode::Preserve, aRv=..., aSelectionStart=..., aSelectionEnd=...) at /home/twsmith/code/mozilla-central/dom/html/TextControlState.cpp:2288
#33 0x00007f89cb48c89a in mozilla::TextControlState::SetRangeText (this=0x60b0000e33c0, aReplacement=..., aRv=...) at /home/twsmith/code/mozilla-central/dom/html/TextControlState.cpp:2242
#34 0x00007f89cb2f526a in mozilla::dom::HTMLInputElement::SetRangeText (this=0x6150001d2480, aReplacement=..., aRv=...) at /home/twsmith/code/mozilla-central/dom/html/HTMLInputElement.cpp:5395
#35 0x00007f89c9c0ca60 in mozilla::dom::HTMLInputElement_Binding::setRangeText (cx_=0x61d000019a80, obj=..., void_self=0x6150001d2480, args=...) at HTMLInputElementBinding.cpp:4004
So this is related to the accessible caret pref.
Flags: needinfo?(emilio)
|
|
Assignee | |
Comment 12•4 years ago
|
||
The issue here is that AccessibleCaret flushes layout from the middle of
the SetValue call, because it hides the caret (see the call stack in
comment 11).
That changes the placeholder-shown state because it goes from empty to
non-empty but the SetValue call from UnbindFromFrame is not supposed to
change that state (because we're in the middle of restyling).
Call OnValueChanged later, at the outer caller instead.
|
||
Updated•4 years ago
|
Assignee: nobody → emilio
Status: NEW → ASSIGNED
|
||
Comment 13•4 years ago
|
||
Pushed by ealvarez@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/00b2729bb4b3 Only handle updating the DOM state from TextControlState::SetValue on the outer caller. r=masayuki
|
||
Comment 14•4 years ago
|
||
| bugherder | ||
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox81:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 81 Branch
|
||
Updated•4 years ago
|
status-firefox79:
--- → wontfix
status-firefox80:
--- → wontfix
status-firefox-esr68:
--- → unaffected
status-firefox-esr78:
--- → wontfix
Flags: in-testsuite? → in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•