Backed out 3 changesets (bug 1310885) for heap write hazard failures
authorPhil Ringnalda <philringnalda@gmail.com>
Thu, 11 May 2017 23:03:31 -0700
changeset 406174 64454880365401de837eb4673e762e2088f37716
parent 406173 96ea13bb00c5a058a8d571e30794e8d0385182ee
child 406175 8cfb113ea73ba7393e6993df1e0644257ebd584c
push id7391
push usermtabara@mozilla.com
push dateMon, 12 Jun 2017 13:08:53 +0000
treeherdermozilla-beta@2191d7f87e2e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1310885
milestone55.0a1
backs out77352010d8e8a269cf33e7891f4c00f2d73b4541
9245a2fbb97450916828f075badf20741dbcd6f0
7c2db290c4b64b0e50b1a44f5d2a42bfe119f196
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out 3 changesets (bug 1310885) for heap write hazard failures Backed out changeset 77352010d8e8 (bug 1310885) Backed out changeset 9245a2fbb974 (bug 1310885) Backed out changeset 7c2db290c4b6 (bug 1310885) MozReview-Commit-ID: 7JWuxt9QDO0
layout/style/ServoBindings.cpp
layout/style/ServoBindings.h
layout/style/nsCSSValue.cpp
layout/style/nsCSSValue.h
layout/style/nsStyleStruct.cpp
layout/style/nsStyleStruct.h
--- a/layout/style/ServoBindings.cpp
+++ b/layout/style/ServoBindings.cpp
@@ -1166,50 +1166,19 @@ CreateStyleImageRequest(nsStyleImageRequ
 
   RefPtr<nsStyleImageRequest> req =
     new nsStyleImageRequest(aModeFlags, url, do_AddRef(aURI.mExtraData));
   return req.forget();
 }
 
 NS_IMPL_THREADSAFE_FFI_REFCOUNTING(mozilla::css::ImageValue, ImageValue);
 
-static already_AddRefed<nsStyleImageRequest>
-CreateStyleImageRequest(nsStyleImageRequest::Mode aModeFlags,
-                        mozilla::css::ImageValue* aImageValue)
-{
-  RefPtr<nsStyleImageRequest> req =
-    new nsStyleImageRequest(aModeFlags, aImageValue);
-  return req.forget();
-}
-
-mozilla::css::ImageValue*
-Gecko_ImageValue_Create(ServoBundledURI aURI)
-{
-  NS_ConvertUTF8toUTF16 url(reinterpret_cast<const char*>(aURI.mURLString),
-                            aURI.mURLStringLength);
-
-  RefPtr<ImageValue> value(new ImageValue(url, do_AddRef(aURI.mExtraData)));
-  return value.forget().take();
-}
-
-void
-Gecko_SetLayerImageImageValue(nsStyleImage* aImage,
-                              mozilla::css::ImageValue* aImageValue)
-{
-  MOZ_ASSERT(aImage && aImageValue);
-
-  RefPtr<nsStyleImageRequest> req =
-    CreateStyleImageRequest(nsStyleImageRequest::Mode::Track, aImageValue);
-  aImage->SetImageRequest(req.forget());
-}
-
 void
 Gecko_SetUrlImageValue(nsStyleImage* aImage, ServoBundledURI aURI)
 {
-  MOZ_ASSERT(aImage);
   RefPtr<nsStyleImageRequest> req =
     CreateStyleImageRequest(nsStyleImageRequest::Mode::Track, aURI);
   aImage->SetImageRequest(req.forget());
 }
 
 void
 Gecko_SetImageElement(nsStyleImage* aImage, nsIAtom* aAtom) {
   MOZ_ASSERT(aImage);
@@ -1235,51 +1204,30 @@ Gecko_InitializeImageCropRect(nsStyleIma
 void
 Gecko_SetCursorArrayLength(nsStyleUserInterface* aStyleUI, size_t aLen)
 {
   aStyleUI->mCursorImages.Clear();
   aStyleUI->mCursorImages.SetLength(aLen);
 }
 
 void
-Gecko_SetCursorImageValue(nsCursorImage* aCursor,
-                          mozilla::css::ImageValue* aImageValue)
-{
-  MOZ_ASSERT(aCursor && aImageValue);
-
-  aCursor->mImage =
-    CreateStyleImageRequest(nsStyleImageRequest::Mode::Discard, aImageValue);
-}
-
-void
 Gecko_SetCursorImage(nsCursorImage* aCursor, ServoBundledURI aURI)
 {
   aCursor->mImage =
     CreateStyleImageRequest(nsStyleImageRequest::Mode::Discard, aURI);
 }
 
 void
 Gecko_CopyCursorArrayFrom(nsStyleUserInterface* aDest,
                           const nsStyleUserInterface* aSrc)
 {
   aDest->mCursorImages = aSrc->mCursorImages;
 }
 
 void
-Gecko_SetContentDataImageValue(nsStyleContentData* aContent,
-                               mozilla::css::ImageValue* aImageValue)
-{
-  MOZ_ASSERT(aContent && aImageValue);
-
-  RefPtr<nsStyleImageRequest> req =
-    CreateStyleImageRequest(nsStyleImageRequest::Mode::Track, aImageValue);
-  aContent->SetImageRequest(req.forget());
-}
-
-void
 Gecko_SetContentDataImage(nsStyleContentData* aContent, ServoBundledURI aURI)
 {
   RefPtr<nsStyleImageRequest> req = CreateStyleImageRequest(nsStyleImageRequest::Mode::Track, aURI);
   aContent->SetImageRequest(req.forget());
 }
 
 void
 Gecko_SetContentDataArray(nsStyleContentData* aContent,
@@ -1323,26 +1271,16 @@ Gecko_CreateGradient(uint8_t aShape,
 
 void
 Gecko_SetListStyleImageNone(nsStyleList* aList)
 {
   aList->mListStyleImage = nullptr;
 }
 
 void
-Gecko_SetListStyleImageImageValue(nsStyleList* aList,
-                             mozilla::css::ImageValue* aImageValue)
-{
-  MOZ_ASSERT(aList && aImageValue);
-
-  aList->mListStyleImage =
-    CreateStyleImageRequest(nsStyleImageRequest::Mode(0), aImageValue);
-}
-
-void
 Gecko_SetListStyleImage(nsStyleList* aList,
                         ServoBundledURI aURI)
 {
   aList->mListStyleImage =
     CreateStyleImageRequest(nsStyleImageRequest::Mode(0), aURI);
 }
 
 void
--- a/layout/style/ServoBindings.h
+++ b/layout/style/ServoBindings.h
@@ -271,55 +271,41 @@ void Gecko_CopyImageOrientationFrom(nsSt
 // Counter style.
 void Gecko_SetListStyleType(nsStyleList* style_struct, uint32_t type);
 void Gecko_CopyListStyleTypeFrom(nsStyleList* dst, const nsStyleList* src);
 
 // background-image style.
 void Gecko_SetNullImageValue(nsStyleImage* image);
 void Gecko_SetGradientImageValue(nsStyleImage* image, nsStyleGradient* gradient);
 NS_DECL_THREADSAFE_FFI_REFCOUNTING(mozilla::css::ImageValue, ImageValue);
-mozilla::css::ImageValue* Gecko_ImageValue_Create(ServoBundledURI aURI);
-void Gecko_SetLayerImageImageValue(nsStyleImage* image,
-                                   mozilla::css::ImageValue* aImageValue);
-
-// XXX cku: remove this function after gecko and stylo side are both ready
 void Gecko_SetUrlImageValue(nsStyleImage* image,
                             ServoBundledURI uri);
 void Gecko_SetImageElement(nsStyleImage* image, nsIAtom* atom);
 void Gecko_CopyImageValueFrom(nsStyleImage* image, const nsStyleImage* other);
 void Gecko_InitializeImageCropRect(nsStyleImage* image);
 
 nsStyleGradient* Gecko_CreateGradient(uint8_t shape,
                                       uint8_t size,
                                       bool repeating,
                                       bool legacy_syntax,
                                       uint32_t stops);
 
 // list-style-image style.
 void Gecko_SetListStyleImageNone(nsStyleList* style_struct);
-void Gecko_SetListStyleImageImageValue(nsStyleList* style_struct,
-                                  mozilla::css::ImageValue* aImageValue);
-// XXX cku: remove this function after gecko and stylo side are both ready
 void Gecko_SetListStyleImage(nsStyleList* style_struct,
                              ServoBundledURI uri);
 void Gecko_CopyListStyleImageFrom(nsStyleList* dest, const nsStyleList* src);
 
 // cursor style.
 void Gecko_SetCursorArrayLength(nsStyleUserInterface* ui, size_t len);
-void Gecko_SetCursorImageValue(nsCursorImage* aCursor,
-                               mozilla::css::ImageValue* aImageValue);
-// XXX cku: remove this function after gecko and stylo side are both ready
 void Gecko_SetCursorImage(nsCursorImage* cursor,
                           ServoBundledURI uri);
 void Gecko_CopyCursorArrayFrom(nsStyleUserInterface* dest,
                                const nsStyleUserInterface* src);
 
-void Gecko_SetContentDataImageValue(nsStyleContentData* aList,
-                                    mozilla::css::ImageValue* aImageValue);
-// XXX cku: remove this function after gecko and stylo side are both ready
 void Gecko_SetContentDataImage(nsStyleContentData* content_data, ServoBundledURI uri);
 void Gecko_SetContentDataArray(nsStyleContentData* content_data, nsStyleContentType type, uint32_t len);
 
 // Dirtiness tracking.
 uint32_t Gecko_GetNodeFlags(RawGeckoNodeBorrowed node);
 void Gecko_SetNodeFlags(RawGeckoNodeBorrowed node, uint32_t flags);
 void Gecko_UnsetNodeFlags(RawGeckoNodeBorrowed node, uint32_t flags);
 void Gecko_SetOwnerDocumentNeedsStyleFlush(RawGeckoElementBorrowed element);
--- a/layout/style/nsCSSValue.cpp
+++ b/layout/style/nsCSSValue.cpp
@@ -3038,34 +3038,37 @@ css::ImageValue::ImageValue(const nsAStr
   : URLValueData(aString, Move(aExtraData))
 {
 }
 
 void
 css::ImageValue::Initialize(nsIDocument* aDocument)
 {
   MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!mInitialized);
 
   // NB: If aDocument is not the original document, we may not be able to load
   // images from aDocument.  Instead we do the image load from the original doc
   // and clone it to aDocument.
   nsIDocument* loadingDoc = aDocument->GetOriginalDocument();
   if (!loadingDoc) {
     loadingDoc = aDocument;
   }
 
-  if (!mLoadedImage) {
-    loadingDoc->StyleImageLoader()->LoadImage(GetURI(),
-                                              mExtraData->GetPrincipal(),
-                                              mExtraData->GetReferrer(), this);
-
-     mLoadedImage = true;
+  loadingDoc->StyleImageLoader()->LoadImage(GetURI(),
+                                            mExtraData->GetPrincipal(),
+                                            mExtraData->GetReferrer(), this);
+
+  if (loadingDoc != aDocument) {
+    aDocument->StyleImageLoader()->MaybeRegisterCSSImage(this);
   }
 
-  aDocument->StyleImageLoader()->MaybeRegisterCSSImage(this);
+#ifdef DEBUG
+  mInitialized = true;
+#endif
 }
 
 css::ImageValue::~ImageValue()
 {
   MOZ_ASSERT(NS_IsMainThread() || mRequests.Count() == 0,
              "Destructor should run on main thread, or on non-main thread "
              "when mRequest is empty!");
 
--- a/layout/style/nsCSSValue.h
+++ b/layout/style/nsCSSValue.h
@@ -225,17 +225,19 @@ protected:
   ~ImageValue();
 
 public:
   // Inherit Equals from URLValueData
 
   nsRefPtrHashtable<nsPtrHashKey<nsIDocument>, imgRequestProxy> mRequests;
 
 private:
-  bool mLoadedImage = false;
+#ifdef DEBUG
+  bool mInitialized = false;
+#endif
 };
 
 struct GridNamedArea {
   nsString mName;
   uint32_t mColumnStart;
   uint32_t mColumnEnd;
   uint32_t mRowStart;
   uint32_t mRowEnd;
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -34,17 +34,16 @@
 
 #include "mozilla/dom/AnimationEffectReadOnlyBinding.h" // for PlaybackDirection
 #include "mozilla/dom/DocGroup.h"
 #include "mozilla/dom/ImageTracker.h"
 #include "mozilla/Likely.h"
 #include "nsIURI.h"
 #include "nsIDocument.h"
 #include <algorithm>
-#include "ImageLoader.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
 
 static_assert((((1 << nsStyleStructID_Length) - 1) &
                ~(NS_STYLE_INHERIT_MASK)) == 0,
               "Not enough bits in NS_STYLE_INHERIT_MASK");
 
@@ -2015,46 +2014,34 @@ nsStyleImageRequest::nsStyleImageRequest
     const nsAString& aURL,
     already_AddRefed<URLExtraData> aExtraData)
   : mImageValue(new css::ImageValue(aURL, Move(aExtraData)))
   , mModeFlags(aModeFlags)
   , mResolved(false)
 {
 }
 
-nsStyleImageRequest::nsStyleImageRequest(
-    Mode aModeFlags,
-    mozilla::css::ImageValue* aImageValue)
-  : mImageValue(aImageValue)
-  , mModeFlags(aModeFlags)
-  , mResolved(false)
-{
-}
-
 nsStyleImageRequest::~nsStyleImageRequest()
 {
   // We may or may not be being destroyed on the main thread.  To clean
   // up, we must untrack and unlock the image (depending on mModeFlags),
   // and release mRequestProxy and mImageValue, all on the main thread.
   {
     RefPtr<StyleImageRequestCleanupTask> task =
         new StyleImageRequestCleanupTask(mModeFlags,
                                          mRequestProxy.forget(),
                                          mImageValue.forget(),
                                          mImageTracker.forget());
-    if (NS_IsMainThread()) {
+    if (NS_IsMainThread() || !IsResolved()) {
       task->Run();
     } else {
-      if (mDocGroup) {
-        mDocGroup->Dispatch("StyleImageRequestCleanupTask",
-                            TaskCategory::Other, task.forget());
-      } else {
-        // if Resolve was not called at some point, mDocGroup is not set.
-        NS_DispatchToMainThread(task.forget());
-      }
+      MOZ_ASSERT(IsResolved() == bool(mDocGroup),
+                 "We forgot to cache mDocGroup in Resolve()?");
+      mDocGroup->Dispatch("StyleImageRequestCleanupTask",
+                          TaskCategory::Other, task.forget());
     }
   }
 
   MOZ_ASSERT(!mRequestProxy);
   MOZ_ASSERT(!mImageValue);
   MOZ_ASSERT(!mImageTracker);
 }
 
--- a/layout/style/nsStyleStruct.h
+++ b/layout/style/nsStyleStruct.h
@@ -342,22 +342,16 @@ public:
 
   // Can be called from any thread, but Resolve() must be called later
   // on the main thread before get() can be used.
   nsStyleImageRequest(
       Mode aModeFlags,
       const nsAString& aURL,
       already_AddRefed<mozilla::URLExtraData> aExtraData);
 
-  // Can be called from any thread, but Resolve() must be called later
-  // on the main thread before get() can be used.
-  nsStyleImageRequest(
-      Mode aModeFlags,
-      mozilla::css::ImageValue* aImageValue);
-
   bool Resolve(nsPresContext* aPresContext);
   bool IsResolved() const { return mResolved; }
 
   imgRequestProxy* get() {
     MOZ_ASSERT(IsResolved(), "Resolve() must be called first");
     MOZ_ASSERT(NS_IsMainThread());
     return mRequestProxy.get();
   }