Jason Kratzer [:jkratzer] Reporter
	Description • 7 years ago

Testcase found while fuzzing mozilla-central rev 20170915-893fe1549e1e.

thread '<unnamed>' panicked at 'assertion failed: self.font_size.map_or(true, |f| f == font_size)', /builds/worker/workspace/build/src/servo/components/style/rule_cache.rs:28
stack backtrace:
   0:     0x7f43152f5c53 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::hcab99e0793da62c7
   1:     0x7f43152f0f76 - std::sys_common::backtrace::_print::hbfe5b0c7e79c0711
   2:     0x7f43153032ea - std::panicking::default_hook::{{closure}}::h9ba2c6973907a2be
   3:     0x7f4315302eeb - std::panicking::default_hook::he4d55e2dd21c3cca
   4:     0x7f431530373a - std::panicking::rust_panic_with_hook::ha138c05cd33ad44d
   5:     0x7f431516c16a - std::panicking::begin_panic::ha0986727c75c6797
   6:     0x7f43150e9608 - style::rule_cache::RuleCacheConditions::set_font_size_dependency::h875b81c098794675
   7:     0x7f4314eda458 - style::values::specified::length::FontRelativeLength::reference_font_size_and_length::h95952d6dc29f13b6
   8:     0x7f4314eda39c - style::values::specified::length::FontRelativeLength::to_computed_value::h645bd6461026a644
   9:     0x7f4314ebdcca - style::values::computed::length::<impl style::values::computed::ToComputedValue for style::values::specified::length::NoCalcLength>::to_computed_value::hfb920e6c96561df9
  10:     0x7f4314ebe584 - style::values::computed::length::<impl style::values::computed::ToComputedValue for style::values::specified::length::LengthOrPercentage>::to_computed_value::hb019c9eeed9e5c9b
  11:     0x7f4314ee9894 - <style::values::generics::NonNegative<T> as style::values::computed::ToComputedValue>::to_computed_value::h48cb14cdc53e4c58
  12:     0x7f4314efbbd3 - style::properties::longhands::padding_right::cascade_property::h789c0cab8c9d7028
  13:     0x7f4314f28a0d - style::properties::apply_declarations::h0857c0cc69469517
  14:     0x7f4314f27b12 - style::properties::cascade::h53c5a34c546c1eb4
  15:     0x7f4315442ab5 - <style::style_resolver::StyleResolverForElement<'a, 'ctx, 'le, E>>::cascade_style::h725f59f8d23a15d4
  16:     0x7f43154435ff - <style::style_resolver::StyleResolverForElement<'a, 'ctx, 'le, E>>::cascade_style_and_visited::hbc7dfd7fa804b7f4
  17:     0x7f43154433d9 - <style::style_resolver::StyleResolverForElement<'a, 'ctx, 'le, E>>::resolve_primary_style::hb0de9e5cbc6d6e77
  18:     0x7f43154430e1 - <style::style_resolver::StyleResolverForElement<'a, 'ctx, 'le, E>>::resolve_style::h6e7bf301a84da49b
  19:     0x7f4315504f03 - style::traversal::resolve_style::h4b75789eaa2585f0
  20:     0x7f4314b9a9ab - Servo_ResolveStyleLazily
  21:     0x7f4313165bbc - _ZN7mozilla13ServoStyleSet26ResolveStyleLazilyInternalEPNS_3dom7ElementENS_20CSSPseudoElementTypeEP7nsIAtomPKNS_17ServoStyleContextENS_18StyleRuleInclusionEb
  22:     0x7f4313165cef - _ZN7mozilla13ServoStyleSet15ResolveStyleForEPNS_3dom7ElementEPNS_17ServoStyleContextENS_19LazyComputeBehaviorE
  23:     0x7f43129f4780 - _ZN7mozilla14StyleSetHandle3Ptr15ResolveStyleForEPNS_3dom7ElementEP14nsStyleContextNS_19LazyComputeBehaviorE
  24:     0x7f43132a591e - _ZL39GetPropagatedScrollbarStylesForViewportP13nsPresContextPN7mozilla15ScrollbarStylesE
  25:     0x7f43132a5bae - _ZN13nsPresContext37UpdateViewportScrollbarStylesOverrideEv
  26:     0x7f4313290b5f - _ZN21nsCSSFrameConstructor24ConstructDocElementFrameEPN7mozilla3dom7ElementEP21nsILayoutHistoryState
  27:     0x7f4313291eba - _ZN21nsCSSFrameConstructor20ContentRangeInsertedEP10nsIContentS1_S1_P21nsILayoutHistoryStateNS_13InsertionKindEP16TreeMatchContext
  28:     0x7f4313292d34 - _ZN21nsCSSFrameConstructor15ContentInsertedEP10nsIContentS1_P21nsILayoutHistoryStateNS_13InsertionKindE
  29:     0x7f431324057f - _ZN7mozilla9PresShell10InitializeEii
  30:     0x7f431210de7f - _ZN13nsContentSink11StartLayoutEb
  31:     0x7f4311d1d519 - _ZN21nsHtml5TreeOpExecutor11StartLayoutEPb
  32:     0x7f4311d2f619 - _ZN20nsHtml5TreeOperation7PerformEP21nsHtml5TreeOpExecutorPP10nsIContentPb
  33:     0x7f4311d2fa25 - _ZN21nsHtml5TreeOpExecutor12RunFlushLoopEv
  34:     0x7f4311d2fbc2 - _ZN22nsHtml5ExecutorFlusher3RunEv
  35:     0x7f4311504c63 - _ZN8nsThread16ProcessNextEventEbPb.part.255
  36:     0x7f43115009ca - _Z19NS_ProcessNextEventP9nsIThreadb
  37:     0x7f43118b2476 - _ZN7mozilla3ipc11MessagePump3RunEPN4base11MessagePump8DelegateE
  38:     0x7f4311887db8 - _ZN11MessageLoop11RunInternalEv
  39:     0x7f4311887de4 - _ZN11MessageLoop3RunEv
  40:     0x7f43130127bc - _ZN14nsBaseAppShell3RunEv
  41:     0x7f4313f3bee6 - _ZN12nsAppStartup3RunEv
  42:     0x7f4313fbd8fe - _ZN7XREMain11XRE_mainRunEv
  43:     0x7f4313fbe116 - _ZN7XREMain8XRE_mainEiPPcRKN7mozilla15BootstrapConfigE
  44:     0x7f4313fbe3fb - _Z8XRE_mainiPPcRKN7mozilla15BootstrapConfigE
  45:           0x40723e - _ZL7do_mainiPPcS0_
  46:           0x406a02 - main
  47:     0x7f4322cfe82f - __libc_start_main
  48:           0x406c64 - <unknown>

	Manish Goregaokar [:manishearth]
	Comment 1 • 7 years ago

looks like a rule node cache issue

	Cameron McCormack (:heycam)
	Comment 2 • 7 years ago

Jason, can you attach the test that triggered the assertion?

	Bob Clary [:bc] (inactive)
	Comment 3 • 7 years ago

Bughunter has seen this on two urls so far:

http://www.meteofrance.com/previsions-meteo-france/la-chaussee-saint-victor/41260
http://vms10let.ru/

	Jason Kratzer [:jkratzer] Reporter
	Comment 4 • 7 years ago

Attached testcase.

	Aria Beingessner [:Gankra]
	Comment 5 • 7 years ago

Seeing it in local builds when I visit https://color.typekit.com/

	Emilio Cobos Álvarez (:emilio) Assignee
	Comment 6 • 7 years ago

I got a patch. The bug that regresses the test-case is bug 1380980, but it's not that bug's fault per se.

	Emilio Cobos Álvarez (:emilio) Assignee
	Comment 8 • 7 years ago

Landed:
   https://hg.mozilla.org/integration/autoland/rev/0ee945271889

Also pushed the crashtest:
   https://hg.mozilla.org/integration/autoland/rev/64b53d09febf538db91d4791a549680f43a2b57c

	Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)
	Comment 9 • 7 years ago
bugherder

https://hg.mozilla.org/mozilla-central/rev/64b53d09febf