Bug 1815397 Comment 5 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by

Nicolas Silva [:nical]

on 2023-02-09 06:12:45 PST

It appears that the issue comes from here: https://searchfox.org/mozilla-central/source/layout/generic/nsIFrame.cpp#3262

we untransform a rectangle and store the result in an nsRect. the problem is that the transform has an enormous scaling factor, resulting in a tiny rectangle that is then rounded out to 1x1 pixel (many orders of magnitude larger than the tiny rect) to store as an nsRect.

later this will turn into the nsDiplaItem's BuildingRect which will be scaled by that same transform into something gigantic which will become the blob's visible rect.

Revision 1 by

Nicolas Silva [:nical]

on 2023-02-09 06:15:25 PST

It appears that the issue comes from here: https://searchfox.org/mozilla-central/source/layout/generic/nsIFrame.cpp#3262

we untransform a rectangle and store the result in an nsRect. the problem is that the transform has an enormous scaling factor, resulting in a tiny rectangle that is then rounded out to 1x1 pixel (many orders of magnitude larger than the tiny rect) to store as an nsRect.

later this will turn into the nsDiplaItem's BuildingRect which will be scaled by that same transform into something gigantic which will become the blob's visible rect.

precision is lost at this stack trace:

```
```
#0  0x00007efe8133ce35 in mozilla::nsDisplayTransform::UntransformRect
    at layout/painting/nsDisplayList.cpp:7267
#1  0x00007efe80ff3160 in nsIFrame::BuildDisplayListForStackingContext(..)
    (this=0x7efe670b2ee8, aCreatedContainerItem=0x7fff37a362d7)
    at layout/generic/nsIFrame.cpp:3262
#2  0x00007efe80faebab in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2dd0, aChild=0x7efe670b2ee8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4290
#3  0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(..) (this=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#4  0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2dd0) at layout/generic/nsContainerFrame.h:554
#5  0x00007efe812aad5a in nsMathMLContainerFrame::BuildDisplayList(..)
    (this=0x7efe670b2dd0) at layout/mathml/nsMathMLContainerFrame.cpp:611
#6  0x00007efe80faef1c in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2cd0, aChild=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4340
#7  0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(..) (this=0x7efe670b2cd0, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#8  0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2cd0) at layout/generic/nsContainerFrame.h:554
#9  0x00007efe81028709 in nsInlineFrame::BuildDisplayList(..)
    (this=0x7efe670b2cd0) at layout/generic/nsInlineFrame.cpp:213
#10 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2bb8, aChild=0x7efe670b2cd0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#11 0x00007efe80f16c3a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
    (aBuilder=0x7efe609fb000, aLine=..., aLineInLine=true, aFrame=0x7efe670b2bb8, aTextOverflow=0x0, aLineNumberForTextOverflow=0, aDepth=0, aDrawnLines=@0x7fff37a37a34: -1431655766) at layout/generic/nsBlockFrame.cpp:7059
#12 0x00007efe80f15ae3 in nsBlockFrame::BuildDisplayList(..)
    (this=0x7efe670b2bb8) at layout/generic/nsBlockFrame.cpp:7214
#13 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2af0, aChild=0x7efe670b2bb8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#14 0x00007efe80f16c3a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
    (aBuilder=0x7efe609fb000, aLine=..., aLineInLine=false, aFrame=0x7efe670b2af0, aTextOverflow=0x0, aLineNumberForTextOverflow=0, aDepth=0, aDrawnLines=@0x7fff37a38774: -1431655766) at layout/generic/nsBlockFrame.cpp:7059
#15 0x00007efe80f15ae3 in nsBlockFrame::BuildDisplayList(..)
    (this=0x7efe670b2af0) at layout/generic/nsBlockFrame.cpp:7214
#16 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b20c8, aChild=0x7efe670b2af0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#17 0x00007efe80f1c729 in nsCanvasFrame::BuildDisplayList(..)
    (this=0x7efe670b20c8) at layout/generic/nsCanvasFrame.cpp:584
#18 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2198, aChild=0x7efe670b20c8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#19 0x00007efe80fb19f3 in mozilla::ScrollFrameHelper::BuildDisplayList(..)
    (this=0x7efe670b2250) at layout/generic/nsGfxScrollFrame.cpp:4332
#20 0x00007efe810551dc in nsHTMLScrollFrame::BuildDisplayList(..)
    (this=0x7efe670b2198) at layout/generic/nsGfxScrollFrame.h:937
#21 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2020, aChild=0x7efe670b2198, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#22 0x00007efe80eead19 in mozilla::ViewportFrame::BuildDisplayList(..)
    (this=0x7efe670b2020) at layout/generic/ViewportFrame.cpp:66
#23 0x00007efe80ff3bfa in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
    (this=0x7efe670b2020, aList=0x7efe609fcfd8, aCreatedContainerItem=0x0)
    at layout/generic/nsIFrame.cpp:3462
#24 0x00007efe80e5af59 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) (aRenderingContext=0x0, aFrame=0x7efe670b2020, aDirtyRegion=..., aBackstop=0, aBuilderMode=mozilla::nsDisplayListBuilderMode::Painting, aFlags=(nsLayoutUtils::PaintFrameFlags::WidgetLayers | nsLayoutUtils::PaintFrameFlags::ExistingTransaction | nsLayoutUtils::PaintFrameFlags::ForWebRender))
    at layout/base/nsLayoutUtils.cpp:3349
```

`nsDisplayItem::mBuildingRect` is set from `nsDisplayListBuilder::mVisibleRect` here:

```
#0  0x00007efe8115d67f in mozilla::nsDisplayItem::SetBuildingRect(nsRect const&) (this=0x7efe607246e0, aBuildingRect=...)
    at layout/painting/nsDisplayList.h:2665
#1  0x00007efe813251f9 in mozilla::nsDisplayItem::nsDisplayItem(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::ActiveScrolledRoot const*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8, aActiveScrolledRoot=0x7efe609f26c0)
    at layout/painting/nsDisplayList.cpp:2620
#2  0x00007efe80dca0d1 in mozilla::nsPaintedDisplayItem::nsPaintedDisplayItem(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::ActiveScrolledRoot const*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8, aActiveScrolledRoot=0x7efe609f26c0)
    at layout/painting/nsDisplayList.h:2950
#3  0x00007efe80dc95e9 in mozilla::nsPaintedDisplayItem::nsPaintedDisplayItem(mozilla::nsDisplayListBuilder*, nsIFrame*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8) at layout/painting/nsDisplayList.h:2945
#4  0x00007efe8133dd19 in mozilla::nsDisplayText::nsDisplayText(mozilla::nsDisplayListBuilder*, nsTextFrame*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8) at layout/painting/nsDisplayList.cpp:7457
#5  0x00007efe8111b820 in mozilla::MakeDisplayItemWithIndex<mozilla::nsDisplayText, nsTextFrame>(mozilla::nsDisplayListBuilder*, nsTextFrame*, unsigned short)
    (aBuilder=0x7efe609fb000, aFrame=0x7efe670b2fe8, aIndex=0) at layout/painting/nsDisplayList.h:1990
#6  0x00007efe8111b772 in mozilla::nsDisplayList::AppendNewToTopWithIndex<mozilla::nsDisplayText, nsTextFrame>(mozilla::nsDisplayListBuilder*, nsTextFrame*, unsigned short)
    (this=0x7fff37a34798, aFrame=0x7efe670b2fe8, aIndex=0) at layout/painting/nsDisplayList.h:3103
#7  0x00007efe8110a297 in mozilla::nsDisplayList::AppendNewToTop<mozilla::nsDisplayText, nsTextFrame>(mozilla::nsDisplayListBuilder*, nsTextFrame*)
    (this=0x7fff37a34798, aFrame=0x7efe670b2fe8) at layout/painting/nsDisplayList.h:3096
#8  0x00007efe810e862c in nsTextFrame::BuildDisplayList(..)
    (this=0x7efe670b2fe8) at layout/generic/nsTextFrame.cpp:5192
#9  0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b3088, aChild=0x7efe670b2fe8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#10 0x00007efe80f16c3a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
    (aBuilder=0x7efe609fb000, aLine=..., aLineInLine=true, aFrame=0x7efe670b3088, aTextOverflow=0x0, aLineNumberForTextOverflow=0, aDepth=0, aDrawnLines=@0x7fff37a34a64: -1431655766) at layout/generic/nsBlockFrame.cpp:7059
#11 0x00007efe80f15ae3 in nsBlockFrame::BuildDisplayList(..)
    (this=0x7efe670b3088) at layout/generic/nsBlockFrame.cpp:7214
#12 0x00007efe80faef1c in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2ee8, aChild=0x7efe670b3088, aFlags=...)
    at layout/generic/nsIFrame.cpp:4340
#13 0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(.., mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) (this=0x7efe670b2ee8, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#14 0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2ee8) at layout/generic/nsContainerFrame.h:554
#15 0x00007efe812aad5a in nsMathMLContainerFrame::BuildDisplayList(..)
    (this=0x7efe670b2ee8) at layout/mathml/nsMathMLContainerFrame.cpp:611
#16 0x00007efe80ff3bfa in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
    (this=0x7efe670b2ee8, aCreatedContainerItem=0x7fff37a362d7)
    at layout/generic/nsIFrame.cpp:3462
#17 0x00007efe80faebab in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2dd0, aChild=0x7efe670b2ee8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4290
#18 0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(.., mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) (this=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#19 0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2dd0) at layout/generic/nsContainerFrame.h:554
#20 0x00007efe812aad5a in nsMathMLContainerFrame::BuildDisplayList(..)
    (this=0x7efe670b2dd0) at layout/mathml/nsMathMLContainerFrame.cpp:611
#21 0x00007efe80faef1c in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2cd0, aChild=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4340
```

Revision 2 by

Nicolas Silva [:nical]

on 2023-02-09 06:15:37 PST

It appears that the issue comes from here: https://searchfox.org/mozilla-central/source/layout/generic/nsIFrame.cpp#3262

we untransform a rectangle and store the result in an nsRect. the problem is that the transform has an enormous scaling factor, resulting in a tiny rectangle that is then rounded out to 1x1 pixel (many orders of magnitude larger than the tiny rect) to store as an nsRect.

later this will turn into the nsDiplaItem's BuildingRect which will be scaled by that same transform into something gigantic which will become the blob's visible rect.

precision is lost at this stack trace:

```
#0  0x00007efe8133ce35 in mozilla::nsDisplayTransform::UntransformRect
    at layout/painting/nsDisplayList.cpp:7267
#1  0x00007efe80ff3160 in nsIFrame::BuildDisplayListForStackingContext(..)
    (this=0x7efe670b2ee8, aCreatedContainerItem=0x7fff37a362d7)
    at layout/generic/nsIFrame.cpp:3262
#2  0x00007efe80faebab in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2dd0, aChild=0x7efe670b2ee8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4290
#3  0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(..) (this=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#4  0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2dd0) at layout/generic/nsContainerFrame.h:554
#5  0x00007efe812aad5a in nsMathMLContainerFrame::BuildDisplayList(..)
    (this=0x7efe670b2dd0) at layout/mathml/nsMathMLContainerFrame.cpp:611
#6  0x00007efe80faef1c in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2cd0, aChild=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4340
#7  0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(..) (this=0x7efe670b2cd0, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#8  0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2cd0) at layout/generic/nsContainerFrame.h:554
#9  0x00007efe81028709 in nsInlineFrame::BuildDisplayList(..)
    (this=0x7efe670b2cd0) at layout/generic/nsInlineFrame.cpp:213
#10 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2bb8, aChild=0x7efe670b2cd0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#11 0x00007efe80f16c3a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
    (aBuilder=0x7efe609fb000, aLine=..., aLineInLine=true, aFrame=0x7efe670b2bb8, aTextOverflow=0x0, aLineNumberForTextOverflow=0, aDepth=0, aDrawnLines=@0x7fff37a37a34: -1431655766) at layout/generic/nsBlockFrame.cpp:7059
#12 0x00007efe80f15ae3 in nsBlockFrame::BuildDisplayList(..)
    (this=0x7efe670b2bb8) at layout/generic/nsBlockFrame.cpp:7214
#13 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2af0, aChild=0x7efe670b2bb8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#14 0x00007efe80f16c3a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
    (aBuilder=0x7efe609fb000, aLine=..., aLineInLine=false, aFrame=0x7efe670b2af0, aTextOverflow=0x0, aLineNumberForTextOverflow=0, aDepth=0, aDrawnLines=@0x7fff37a38774: -1431655766) at layout/generic/nsBlockFrame.cpp:7059
#15 0x00007efe80f15ae3 in nsBlockFrame::BuildDisplayList(..)
    (this=0x7efe670b2af0) at layout/generic/nsBlockFrame.cpp:7214
#16 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b20c8, aChild=0x7efe670b2af0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#17 0x00007efe80f1c729 in nsCanvasFrame::BuildDisplayList(..)
    (this=0x7efe670b20c8) at layout/generic/nsCanvasFrame.cpp:584
#18 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2198, aChild=0x7efe670b20c8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#19 0x00007efe80fb19f3 in mozilla::ScrollFrameHelper::BuildDisplayList(..)
    (this=0x7efe670b2250) at layout/generic/nsGfxScrollFrame.cpp:4332
#20 0x00007efe810551dc in nsHTMLScrollFrame::BuildDisplayList(..)
    (this=0x7efe670b2198) at layout/generic/nsGfxScrollFrame.h:937
#21 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2020, aChild=0x7efe670b2198, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#22 0x00007efe80eead19 in mozilla::ViewportFrame::BuildDisplayList(..)
    (this=0x7efe670b2020) at layout/generic/ViewportFrame.cpp:66
#23 0x00007efe80ff3bfa in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
    (this=0x7efe670b2020, aList=0x7efe609fcfd8, aCreatedContainerItem=0x0)
    at layout/generic/nsIFrame.cpp:3462
#24 0x00007efe80e5af59 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) (aRenderingContext=0x0, aFrame=0x7efe670b2020, aDirtyRegion=..., aBackstop=0, aBuilderMode=mozilla::nsDisplayListBuilderMode::Painting, aFlags=(nsLayoutUtils::PaintFrameFlags::WidgetLayers | nsLayoutUtils::PaintFrameFlags::ExistingTransaction | nsLayoutUtils::PaintFrameFlags::ForWebRender))
    at layout/base/nsLayoutUtils.cpp:3349
```

`nsDisplayItem::mBuildingRect` is set from `nsDisplayListBuilder::mVisibleRect` here:

```
#0  0x00007efe8115d67f in mozilla::nsDisplayItem::SetBuildingRect(nsRect const&) (this=0x7efe607246e0, aBuildingRect=...)
    at layout/painting/nsDisplayList.h:2665
#1  0x00007efe813251f9 in mozilla::nsDisplayItem::nsDisplayItem(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::ActiveScrolledRoot const*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8, aActiveScrolledRoot=0x7efe609f26c0)
    at layout/painting/nsDisplayList.cpp:2620
#2  0x00007efe80dca0d1 in mozilla::nsPaintedDisplayItem::nsPaintedDisplayItem(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::ActiveScrolledRoot const*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8, aActiveScrolledRoot=0x7efe609f26c0)
    at layout/painting/nsDisplayList.h:2950
#3  0x00007efe80dc95e9 in mozilla::nsPaintedDisplayItem::nsPaintedDisplayItem(mozilla::nsDisplayListBuilder*, nsIFrame*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8) at layout/painting/nsDisplayList.h:2945
#4  0x00007efe8133dd19 in mozilla::nsDisplayText::nsDisplayText(mozilla::nsDisplayListBuilder*, nsTextFrame*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8) at layout/painting/nsDisplayList.cpp:7457
#5  0x00007efe8111b820 in mozilla::MakeDisplayItemWithIndex<mozilla::nsDisplayText, nsTextFrame>(mozilla::nsDisplayListBuilder*, nsTextFrame*, unsigned short)
    (aBuilder=0x7efe609fb000, aFrame=0x7efe670b2fe8, aIndex=0) at layout/painting/nsDisplayList.h:1990
#6  0x00007efe8111b772 in mozilla::nsDisplayList::AppendNewToTopWithIndex<mozilla::nsDisplayText, nsTextFrame>(mozilla::nsDisplayListBuilder*, nsTextFrame*, unsigned short)
    (this=0x7fff37a34798, aFrame=0x7efe670b2fe8, aIndex=0) at layout/painting/nsDisplayList.h:3103
#7  0x00007efe8110a297 in mozilla::nsDisplayList::AppendNewToTop<mozilla::nsDisplayText, nsTextFrame>(mozilla::nsDisplayListBuilder*, nsTextFrame*)
    (this=0x7fff37a34798, aFrame=0x7efe670b2fe8) at layout/painting/nsDisplayList.h:3096
#8  0x00007efe810e862c in nsTextFrame::BuildDisplayList(..)
    (this=0x7efe670b2fe8) at layout/generic/nsTextFrame.cpp:5192
#9  0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b3088, aChild=0x7efe670b2fe8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#10 0x00007efe80f16c3a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
    (aBuilder=0x7efe609fb000, aLine=..., aLineInLine=true, aFrame=0x7efe670b3088, aTextOverflow=0x0, aLineNumberForTextOverflow=0, aDepth=0, aDrawnLines=@0x7fff37a34a64: -1431655766) at layout/generic/nsBlockFrame.cpp:7059
#11 0x00007efe80f15ae3 in nsBlockFrame::BuildDisplayList(..)
    (this=0x7efe670b3088) at layout/generic/nsBlockFrame.cpp:7214
#12 0x00007efe80faef1c in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2ee8, aChild=0x7efe670b3088, aFlags=...)
    at layout/generic/nsIFrame.cpp:4340
#13 0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(.., mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) (this=0x7efe670b2ee8, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#14 0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2ee8) at layout/generic/nsContainerFrame.h:554
#15 0x00007efe812aad5a in nsMathMLContainerFrame::BuildDisplayList(..)
    (this=0x7efe670b2ee8) at layout/mathml/nsMathMLContainerFrame.cpp:611
#16 0x00007efe80ff3bfa in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
    (this=0x7efe670b2ee8, aCreatedContainerItem=0x7fff37a362d7)
    at layout/generic/nsIFrame.cpp:3462
#17 0x00007efe80faebab in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2dd0, aChild=0x7efe670b2ee8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4290
#18 0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(.., mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) (this=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#19 0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2dd0) at layout/generic/nsContainerFrame.h:554
#20 0x00007efe812aad5a in nsMathMLContainerFrame::BuildDisplayList(..)
    (this=0x7efe670b2dd0) at layout/mathml/nsMathMLContainerFrame.cpp:611
#21 0x00007efe80faef1c in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2cd0, aChild=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4340
```

Revision 3 by

Nicolas Silva [:nical]

on 2023-02-09 06:16:02 PST

It appears that the issue comes from here: https://searchfox.org/mozilla-central/source/layout/generic/nsIFrame.cpp#3262

we untransform a rectangle and store the result in an nsRect. the problem is that the transform has an enormous scaling factor, resulting in a tiny rectangle that is then rounded out to 1x1 pixel (many orders of magnitude larger than the tiny rect) to store as an nsRect.

later this will turn into the nsDiplaItem's BuildingRect which will be scaled by that same transform into something gigantic which will become the blob's visible rect.

precision is lost at this stack trace:

```
#0  0x00007efe8133ce35 in mozilla::nsDisplayTransform::UntransformRect
    at layout/painting/nsDisplayList.cpp:7267
#1  0x00007efe80ff3160 in nsIFrame::BuildDisplayListForStackingContext(..)
    (this=0x7efe670b2ee8, aCreatedContainerItem=0x7fff37a362d7)
    at layout/generic/nsIFrame.cpp:3262
#2  0x00007efe80faebab in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2dd0, aChild=0x7efe670b2ee8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4290
#3  0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(..) (this=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#4  0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2dd0) at layout/generic/nsContainerFrame.h:554
#5  0x00007efe812aad5a in nsMathMLContainerFrame::BuildDisplayList(..)
    (this=0x7efe670b2dd0) at layout/mathml/nsMathMLContainerFrame.cpp:611
#6  0x00007efe80faef1c in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2cd0, aChild=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4340
#7  0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(..) (this=0x7efe670b2cd0, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#8  0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2cd0) at layout/generic/nsContainerFrame.h:554
#9  0x00007efe81028709 in nsInlineFrame::BuildDisplayList(..)
    (this=0x7efe670b2cd0) at layout/generic/nsInlineFrame.cpp:213
#10 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2bb8, aChild=0x7efe670b2cd0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#11 0x00007efe80f16c3a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
    (aBuilder=0x7efe609fb000, aLine=..., aLineInLine=true, aFrame=0x7efe670b2bb8, aTextOverflow=0x0, aLineNumberForTextOverflow=0, aDepth=0, aDrawnLines=@0x7fff37a37a34: -1431655766) at layout/generic/nsBlockFrame.cpp:7059
#12 0x00007efe80f15ae3 in nsBlockFrame::BuildDisplayList(..)
    (this=0x7efe670b2bb8) at layout/generic/nsBlockFrame.cpp:7214
#13 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2af0, aChild=0x7efe670b2bb8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#14 0x00007efe80f16c3a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
    (aBuilder=0x7efe609fb000, aLine=..., aLineInLine=false, aFrame=0x7efe670b2af0, aTextOverflow=0x0, aLineNumberForTextOverflow=0, aDepth=0, aDrawnLines=@0x7fff37a38774: -1431655766) at layout/generic/nsBlockFrame.cpp:7059
#15 0x00007efe80f15ae3 in nsBlockFrame::BuildDisplayList(..)
    (this=0x7efe670b2af0) at layout/generic/nsBlockFrame.cpp:7214
#16 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b20c8, aChild=0x7efe670b2af0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#17 0x00007efe80f1c729 in nsCanvasFrame::BuildDisplayList(..)
    (this=0x7efe670b20c8) at layout/generic/nsCanvasFrame.cpp:584
#18 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2198, aChild=0x7efe670b20c8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#19 0x00007efe80fb19f3 in mozilla::ScrollFrameHelper::BuildDisplayList(..)
    (this=0x7efe670b2250) at layout/generic/nsGfxScrollFrame.cpp:4332
#20 0x00007efe810551dc in nsHTMLScrollFrame::BuildDisplayList(..)
    (this=0x7efe670b2198) at layout/generic/nsGfxScrollFrame.h:937
#21 0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2020, aChild=0x7efe670b2198, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#22 0x00007efe80eead19 in mozilla::ViewportFrame::BuildDisplayList(..)
    (this=0x7efe670b2020) at layout/generic/ViewportFrame.cpp:66
#23 0x00007efe80ff3bfa in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
    (this=0x7efe670b2020, aList=0x7efe609fcfd8, aCreatedContainerItem=0x0)
    at layout/generic/nsIFrame.cpp:3462
#24 0x00007efe80e5af59 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) (aRenderingContext=0x0, aFrame=0x7efe670b2020, aDirtyRegion=..., aBackstop=0, aBuilderMode=mozilla::nsDisplayListBuilderMode::Painting, aFlags=(nsLayoutUtils::PaintFrameFlags::WidgetLayers | nsLayoutUtils::PaintFrameFlags::ExistingTransaction | nsLayoutUtils::PaintFrameFlags::ForWebRender))
    at layout/base/nsLayoutUtils.cpp:3349
```

`nsDisplayItem::mBuildingRect` is set from `nsDisplayListBuilder::mVisibleRect` here:


```
#0  0x00007efe8115d67f in mozilla::nsDisplayItem::SetBuildingRect(nsRect const&) (this=0x7efe607246e0, aBuildingRect=...)
    at layout/painting/nsDisplayList.h:2665
#1  0x00007efe813251f9 in mozilla::nsDisplayItem::nsDisplayItem(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::ActiveScrolledRoot const*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8, aActiveScrolledRoot=0x7efe609f26c0)
    at layout/painting/nsDisplayList.cpp:2620
#2  0x00007efe80dca0d1 in mozilla::nsPaintedDisplayItem::nsPaintedDisplayItem(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::ActiveScrolledRoot const*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8, aActiveScrolledRoot=0x7efe609f26c0)
    at layout/painting/nsDisplayList.h:2950
#3  0x00007efe80dc95e9 in mozilla::nsPaintedDisplayItem::nsPaintedDisplayItem(mozilla::nsDisplayListBuilder*, nsIFrame*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8) at layout/painting/nsDisplayList.h:2945
#4  0x00007efe8133dd19 in mozilla::nsDisplayText::nsDisplayText(mozilla::nsDisplayListBuilder*, nsTextFrame*)
    (this=0x7efe607246e0, aFrame=0x7efe670b2fe8) at layout/painting/nsDisplayList.cpp:7457
#5  0x00007efe8111b820 in mozilla::MakeDisplayItemWithIndex<mozilla::nsDisplayText, nsTextFrame>(mozilla::nsDisplayListBuilder*, nsTextFrame*, unsigned short)
    (aBuilder=0x7efe609fb000, aFrame=0x7efe670b2fe8, aIndex=0) at layout/painting/nsDisplayList.h:1990
#6  0x00007efe8111b772 in mozilla::nsDisplayList::AppendNewToTopWithIndex<mozilla::nsDisplayText, nsTextFrame>(mozilla::nsDisplayListBuilder*, nsTextFrame*, unsigned short)
    (this=0x7fff37a34798, aFrame=0x7efe670b2fe8, aIndex=0) at layout/painting/nsDisplayList.h:3103
#7  0x00007efe8110a297 in mozilla::nsDisplayList::AppendNewToTop<mozilla::nsDisplayText, nsTextFrame>(mozilla::nsDisplayListBuilder*, nsTextFrame*)
    (this=0x7fff37a34798, aFrame=0x7efe670b2fe8) at layout/painting/nsDisplayList.h:3096
#8  0x00007efe810e862c in nsTextFrame::BuildDisplayList(..)
    (this=0x7efe670b2fe8) at layout/generic/nsTextFrame.cpp:5192
#9  0x00007efe80faee2e in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b3088, aChild=0x7efe670b2fe8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4325
#10 0x00007efe80f16c3a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
    (aBuilder=0x7efe609fb000, aLine=..., aLineInLine=true, aFrame=0x7efe670b3088, aTextOverflow=0x0, aLineNumberForTextOverflow=0, aDepth=0, aDrawnLines=@0x7fff37a34a64: -1431655766) at layout/generic/nsBlockFrame.cpp:7059
#11 0x00007efe80f15ae3 in nsBlockFrame::BuildDisplayList(..)
    (this=0x7efe670b3088) at layout/generic/nsBlockFrame.cpp:7214
#12 0x00007efe80faef1c in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2ee8, aChild=0x7efe670b3088, aFlags=...)
    at layout/generic/nsIFrame.cpp:4340
#13 0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(.., mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) (this=0x7efe670b2ee8, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#14 0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2ee8) at layout/generic/nsContainerFrame.h:554
#15 0x00007efe812aad5a in nsMathMLContainerFrame::BuildDisplayList(..)
    (this=0x7efe670b2ee8) at layout/mathml/nsMathMLContainerFrame.cpp:611
#16 0x00007efe80ff3bfa in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
    (this=0x7efe670b2ee8, aCreatedContainerItem=0x7fff37a362d7)
    at layout/generic/nsIFrame.cpp:3462
#17 0x00007efe80faebab in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2dd0, aChild=0x7efe670b2ee8, aFlags=...)
    at layout/generic/nsIFrame.cpp:4290
#18 0x00007efe80f23af0 in nsContainerFrame::BuildDisplayListForNonBlockChildren(.., mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) (this=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsContainerFrame.cpp:385
#19 0x00007efe80f4f80d in nsContainerFrame::BuildDisplayListForInline(..)
    (this=0x7efe670b2dd0) at layout/generic/nsContainerFrame.h:554
#20 0x00007efe812aad5a in nsMathMLContainerFrame::BuildDisplayList(..)
    (this=0x7efe670b2dd0) at layout/mathml/nsMathMLContainerFrame.cpp:611
#21 0x00007efe80faef1c in nsIFrame::BuildDisplayListForChild(..) (this=0x7efe670b2cd0, aChild=0x7efe670b2dd0, aFlags=...)
    at layout/generic/nsIFrame.cpp:4340
```

Back to Bug 1815397 Comment 5