1186407 - Crashing on pages while clicking-selecting-dragging text

Status: RESOLVED DUPLICATE of bug 1156238

(Core :: Layout, defect)

Description

[Kartikaya Gupta (email:[e-mail])]

+++ This bug was initially created as a clone of Bug #1181135 +++

STR:
- Enable APZ and e10s
- Load https://groups.google.com/forum/#!topic/mozilla.dev.platform/-cDq6DqBZ2k
- Select text and try to drag it. I find that selecting text across post boundaries seems to be the most effective

AR: Child process crashes.

This might actually be the same crash as bug 1181135, but since I'm running a debug build it's crashing on a MOZ_ASSERT so the stack is a little different. On a production build it might just go off into the weeds somewhere resulting in a different crash stack.

Comment 1

[Kartikaya Gupta (email:[e-mail])]

Attachment: Backtrace

Comment 2

[Kartikaya Gupta (email:[e-mail])]

Attachment: Backtrace

I caught it in rr, here's a backtrace from the recording (the addresses will line up with the rest of the attachments I'm going to post)

Comment 3

[Kartikaya Gupta (email:[e-mail])]

Attachment: Frame dump

Attached is a frame dump of the frame tree that contains mContainerAnimatedGeometryRoot.

(gdb) p mContainerAnimatedGeometryRoot
$8 = (const ViewportFrame *) 0x2aaacc356900
(gdb) p mBuilder->mReferenceFrame
$9 = (nsBlockFrame *) 0x2aaad5e0b168

The mContainerAnimatedGeometryRoot is actually an ancestor of the builder's reference frame, rather than the other way around (which is what the assert is expecting).

Comment 4

[Markus Stange [:mstange]]

Attachment: MozReview Request: Bug 1186407 - Make sure the result of nsDisplayListBuilder::FindAnimatedGeometryRootFor is always an ancestor of aStopAtAncestor.

Bug 1186407 - Make sure the result of nsDisplayListBuilder::FindAnimatedGeometryRootFor is always an ancestor of aStopAtAncestor.

Comment 5

[Kartikaya Gupta (email:[e-mail])]

Comment on attachment 8637251 [details]
MozReview Request: Bug 1186407 - Make sure the result of nsDisplayListBuilder::FindAnimatedGeometryRootFor is always an ancestor of aStopAtAncestor.

When I tried this patch it resulted in a crash (assertion failure at nsFrame.cpp:2439) right on page load. Also the patch doesn't compile for lack of proper const propagation.

Comment 6

[Kartikaya Gupta (email:[e-mail])]

Oh, hey, this is the same thing as bug 1156238.

Comment 7

[Kartikaya Gupta (email:[e-mail])]

Oh, not exactly the same thing, but probably very related. That one happens at a different line in FrameLayerBuilder.

Also for posterity here's the discussion from when Markus and I were investigating this earlier today:

http://logs.glob.uno/?c=mozilla%23apz&s=22%20Jul%202015&e=22%20Jul%202015#c10913