Observed while trying to unlock the lockscreen in B2G, and also during the FTU on a fresh install. This is on a build from inbound-src 118216:632213b8cbc6. logcat snippet (full log attached): I( 580:0x244) [Parent 580] WARNING: throttled animations not up to date: '!CommonAnimationManager::ThrottlingEnabled() || mPresContext->ThrottledStyleIsUpToDate()', file /home/mikeh/dev/mozilla/m-c/inbound-src/layout/style/nsTransitionManager.cpp, line 509 I( 580:0x244) [Parent 580] WARNING: Unable to test style tree integrity -- no content node: file /home/mikeh/dev/mozilla/m-c/inbound-src/layout/base/nsCSSFrameConstructor.cpp, line 8263 I( 580:0x244) [Parent 580] ###!!! ABORT: unexpected change hint: 'NS_IsHintSubset(styleChange, NS_CombineHint(nsChangeHint_UpdateOpacityLayer, NS_CombineHint(nsChangeHint_UpdateTransformLayer, nsChangeHint_UpdateOverflow)))', file /home/mikeh/dev/mozilla/m-c/inbound-src/layout/style/nsTransitionManager.cpp, line 322 E( 580:0x244) mozalloc_abort: [Parent 580] ###!!! ABORT: unexpected change hint: 'NS_IsHintSubset(styleChange, NS_CombineHint(nsChangeHint_UpdateOpacityLayer, NS_CombineHint(nsChangeHint_UpdateTransformLayer, nsChangeHint_UpdateOverflow)))', file /home/mikeh/dev/mozilla/m-c/inbound-src/layout/style/nsTransitionManager.cpp, line 322 F( 580:0x244) Fatal signal 11 (SIGSEGV) at 0x00000000 (code=1) I( 651:0x28c) [Child 651] WARNING: pipe error (14): Connection reset by peer: file /home/mikeh/dev/mozilla/m-c/inbound-src/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 431 I( 651:0x28b) I( 651:0x28b) ###!!! [Child][SyncChannel] Error: Channel error: cannot send/recv I( 651:0x28b) I( 651:0x28b) [Child 651] WARNING: failed to forward Layers transaction: file /home/mikeh/dev/mozilla/m-c/inbound-src/gfx/layers/basic/BasicLayerManager.cpp, line 1259 I( 651:0x28b) [Child 651] WARNING: shutting down early because of crash!: file /home/mikeh/dev/mozilla/m-c/inbound-src/dom/ipc/ContentChild.cpp, line 816 I( 651:0x28b) [Child 651] WARNING: content process _exit()ing: file /home/mikeh/dev/mozilla/m-c/inbound-src/dom/ipc/ContentChild.cpp, line 865 I( 424:0x1a8) debuggerd committing suicide to free the zombie! I( 670:0x29e) debuggerd: Jan 7 2013 09:39:04

Also observed in gecko-18!

Note that this doesn't show up on non-debug builds because NS_ABORT_IF_FALSE() is #defined to nothing in that case. http://mxr.mozilla.org/mozilla-central/source/xpcom/glue/nsDebug.h#142

dbaron, how bad is this assertion?

(In reply to Doug Turner (:dougt) from comment #3) > dbaron, how bad is this assertion? If #if 0 this assert, nothing seems to break and the crash is gone.

CC-ing Nick because of the CommonAnimationManager in the trace, just in case.

Assertion removed on inbound and in relanding on b2g18, see bug 822721 comment 104 and 105.

In that case, I am just going to dupe this against bug 822721.