1959597 - Tab crash in debug mode on page with CSS selector has trailing comma inside :is() when layout.css.details-content.enabled is enabled (Hit MOZ_CRASH(assertion `left == right` failed left: 3 right: 2) at servo/components/style/sharing/mod.rs:159)

Nicolas Chevobbe [:nchevobbe]

Reporter

Description

•

6 months ago

•

Edited

On a debug build
Set layout.css.details-content.enabled to true
Go to data:text/html,<meta charset=utf8><html><head><style>:is([open],) {}</style></head><details open></details>

-> tab crashes

The CSS triggering the crash is :

:is(
  [open],
) {}

the tab doesn't crash if I change it to

:is(
  [open]
) {}

(no more trailing comma after [open]).
The tab doesn't crash if layout.css.details-content.enabled is set to false

stack:

[56063] Hit MOZ_CRASH(assertion `left == right` failed
  left: 3
 right: 2) at servo/components/style/sharing/mod.rs:159
#01: RustMozCrash[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x8f26d4c]
#02: mozglue_static::panic_hook::h636c4efc17617823[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x8f26a70]
#03: core::ops::function::FnMut::call_mut::hadf32486f316eecb[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x8f266f8]
#04: std::panicking::rust_panic_with_hook::ha68643d4311595e9[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x9ae8e00]
#05: std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h0edcf2e5c8ce9186[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x9ae894c]
#06: std::sys::backtrace::output_filename::h61925b78c82092af[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x9ae7a8c]
#07: _$LT$std..panicking..begin_panic_handler..FormatStringPayload$u20$as$u20$core..panic..PanicPayload$GT$::take_box::hcd45028128d34b7e[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x9ae8604]
#08: core::panicking::panic_nounwind_fmt::h930012317ee5fbe3[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x9b04e34]
#09: core::result::unwrap_failed::h49b97238f5f454fc[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x9b051c0]
#10: core::panicking::assert_failed_inner::ha8dbaead67d51a76[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x9b050b8]
#11: _$LT$style..sharing..RevalidationResult$u20$as$u20$core..cmp..PartialEq$GT$::eq::h8bb9d290c4165a13[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x985e054]
#12: style::sharing::checks::revalidate::h2c761720413df649[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x96c513c]
#13: style::traversal::compute_style::hec0bc1a0c2fe057d[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x96d1bd4]
#14: style::parallel::style_trees::h5d1be912ee524cc1[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x96cfbcc]
#15: style::driver::traverse_dom::_$u7b$$u7b$closure$u7d$$u7d$::hea018225aa8217ce[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x96b7584]
#16: style::driver::traverse_dom::hb6add9773583fed5[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x96b6d2c]
#17: geckoservo::glue::traverse_subtree::hfabc541f054daf03[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x9725fe0]
#18: Servo_TraverseSubtree[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x9726294]
#19: mozilla::ServoStyleSet::StyleDocument(mozilla::ServoTraversalFlags)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5de5110]
#20: mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5eaf314]
#21: mozilla::RestyleManager::ProcessPendingRestyles()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5e842e8]
#22: mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5e836a8]
#23: nsRefreshDriver::FlushLayoutOnPendingDocsAndFixUpFocus()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5e44adc]
#24: nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5e43cd4]
#25: mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5e4d7ac]
#26: mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5e4d698]
#27: mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5e4d510]
#28: mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5e4c608]
#29: mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5e4b778]
#30: mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x520169c]
#31: mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x53f453c]
#32: mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x10c27e0]
#33: mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x1072e50]
#34: mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x1070c0c]
#35: mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x1071518]
#36: mozilla::ipc::MessageChannel::MessageTask::Run()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x1072118]
#37: mozilla::RunnableTask::Run()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x594128]
#38: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x58d250]
#39: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x58ab94]
#40: mozilla::TaskController::ProcessPendingMTTask(bool)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x58b020]
#41: mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x59ce90]
#42: nsThread::ProcessNextEvent(bool, bool*)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5b2130]
#43: NS_ProcessNextEvent(nsIThread*, bool)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5b901c]
#44: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x1077bd0]
#45: MessageLoop::RunInternal()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0xfe615c]
#46: MessageLoop::Run()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0xfe6054]
#47: nsBaseAppShell::Run()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5a6bf3c]
#48: nsAppShell::Run()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x5aff04c]
#49: XRE_RunAppShell()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x6b11704]
#50: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x1078604]
#51: MessageLoop::RunInternal()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0xfe615c]
#52: MessageLoop::Run()[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0xfe6054]
#53: XRE_InitChildProcess(int, char**, XREChildData const*)[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/XUL +0x6b1072c]
#54: main[/Users/nchevobbe/Projects/mozilla-central/objdir-frontend/dist/Firefox NightlyDebug.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container +0x720]

Nicolas Chevobbe [:nchevobbe]

Reporter

Updated

•

6 months ago

No longer depends on: 1901037

Keywords: regression

Regressed by: 1901037

BugBot [:suhaib / :marco/ :calixte]

Comment 1

•

6 months ago

:lwarlow, since you are the author of the regressor, bug 1901037, could you take a look?

For more information, please visit BugBot documentation.

Flags: needinfo?(lwarlow)

Emilio Cobos Álvarez [:emilio]

Comment 2

•

6 months ago

Haven't dug into it (and in particular I'm curious about why we're considering the outer selector for revalidation), but at a glance I suspect the issue is that we're trying to share styles between the ::details-content slot and the other unnamed slot.

If so, the right fix would be to add a check in this function, something like if target.implemented_pseudo_element() != candidate.implemented_pseudo_element() { return ... }

Emilio Cobos Álvarez [:emilio]

Updated

•

6 months ago

Blocks: interop-2025-details

Luke Warlow

Assignee

Updated

•

6 months ago

Assignee: nobody → lwarlow

Status: NEW → ASSIGNED

Flags: needinfo?(lwarlow)

BugBot [:suhaib / :marco/ :calixte]

Comment 3

•

5 months ago

The severity field is not set for this bug.
:hsivonen, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(hsivonen)

Henri Sivonen (:hsivonen)

Updated

•

5 months ago

Component: DOM: Core & HTML → CSS Parsing and Computation

Flags: needinfo?(hsivonen)

Daniel Holbert [:dholbert]

Updated

•

5 months ago

Severity: -- → S3

Daniel Holbert [:dholbert]

Updated

•

5 months ago

Blocks: 1941406

Luke Warlow

Assignee

Comment 4

•

4 months ago

Attached file Bug 1959597 - Fix tab crash with details-content enabled; r=emilio — Details

This patch ensures that we don't try to share styles when there's a mismatch between the backing pseudo elements.

This fixes a debug assert that's hit by the details element when ::details-content is enabled.

Pulsebot

Comment 5

•

4 months ago

Pushed by mozilla@keithcirkel.co.uk: https://github.com/mozilla-firefox/firefox/commit/108f33584d73 https://hg.mozilla.org/integration/autoland/rev/876e9a090e13 Fix tab crash with details-content enabled; r=emilio

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Comment 6

•

4 months ago

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/53255 for changes under testing/web-platform/tests

Cristian Tuns

Comment 7

•

4 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/876e9a090e13

Status: ASSIGNED → RESOLVED

Closed: 4 months ago

status-firefox141: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 141 Branch

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Comment 8

•

4 months ago

Upstream PR merged by moz-wptsync-bot

Camelia Badau [:cbadau], Desktop Test Engineering

Updated

•

3 months ago

QA Whiteboard: [qa-triage-done-c142/b141]

Ryan VanderMeulen [:RyanVM]

Updated

•

3 months ago

status-firefox140: --- → disabled

status-firefox-esr115: --- → unaffected

status-firefox-esr128: --- → unaffected

status-firefox-esr140: --- → disabled

Flags: in-testsuite+

Bugzilla

Tab crash in debug mode on page with CSS selector has trailing comma inside :is() when layout.css.details-content.enabled is enabled (Hit MOZ_CRASH(assertion `left == right` failed left: 3 right: 2) at servo/components/style/sharing/mod.rs:159)

Categories

(Core :: CSS Parsing and Computation, defect)

Tracking

()

People

(Reporter: nchevobbe, Assigned: lwarlow)

References

(Regression)

Details

(Keywords: regression)

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Updated

Comment 1

Comment 2

Updated

Updated

Comment 3

Updated

Updated

Updated

Comment 4

Comment 5

Comment 6

Comment 7

Comment 8

Updated

Updated

Attachment

General

Description

File Name

Content Type