1270795 - Assertion failure: nsDisplayItem::TYPE_BACKGROUND != i->GetType() && nsDisplayItem::TYPE_BACKGROUND_COLOR != i->GetType(), at nsLayoutUtils.cpp:3456

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Carsten Book [:Tomcat]]

found via bughunter and reproduced on a windows 7 trunk debug build based on m-c tip

Steps to reproduce:
-> Load http://aiadmk.com/en/home/
--> Assertion failure 

Assertion failure: nsDisplayItem::TYPE_BACKGROUND != i->GetType() && nsDisplayItem::TYPE_BACKGROUND_COLOR != i->GetType(), at c:/Users/mozilla/debug-builds/mozilla-central/layout/base/nsLayoutUtils.cpp:3456
#01: nsDisplayItem::ClearsBackground[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4aef453]
#02: nsDisplayBackgroundImage::PaintInternal[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b382c5]
#03: nsDisplayBackgroundImage::Paint[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b35715]
#04: mozilla::FrameLayerBuilder::PaintItems[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a41ba1]
#05: mozilla::FrameLayerBuilder::DrawPaintedLayer[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a2f9eb]
#06: mozilla::layers::ClientPaintedLayer::PaintThebes[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed3bce]
#07: mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed812a]
#08: mozilla::layers::ClientContainerLayer::RenderLayer[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed7013]
#09: mozilla::layers::ClientLayer::RenderLayerWithReadback[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed7f34]
#10: mozilla::layers::ClientContainerLayer::RenderLayer[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed7013]
#11: mozilla::layers::ClientLayerManager::EndTransactionInternal[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ecc37e]
#12: mozilla::layers::ClientLayerManager::EndTransaction[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ecb925]
#13: nsDisplayList::PaintRoot[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b3996a]
#14: nsLayoutUtils::PaintFrame[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b37462]
#15: PresShell::Paint[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b3505f]
#16: nsViewManager::ProcessPendingUpdatesPaint[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x45b0d74]
#17: nsViewManager::ProcessPendingUpdatesForView[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x45b0aff]
#18: nsViewManager::ProcessPendingUpdates[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x45b08e2]
#19: nsRefreshDriver::Tick[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a09eaf]
#20: nsRefreshDriver::DoTick[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a034fb]
#21: nsRefreshDriver::DoRefresh[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a033b0]
#22: nsRefreshDriver::FinishedWaitingForTransaction[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a03f2c]
#23: nsRefreshDriver::NotifyTransactionCompleted[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a051ec]
#24: mozilla::layers::ClientLayerManager::DidComposite[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ec9850]
#25: mozilla::layers::CompositorBridgeChild::RecvDidComposite[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1f712f3]
#26: mozilla::layers::PCompositorBridgeChild::OnMessageReceived[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x15a01d8]
#27: mozilla::ipc::MessageChannel::DispatchAsyncMessage[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xff82b8]
#28: mozilla::ipc::MessageChannel::DispatchMessageW[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xff8ac5]
#29: mozilla::ipc::MessageChannel::OnMaybeDequeueOne[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfff921]
#30: ??$applyImpl@VMessageChannel@ipc@mozilla@@P8123@AE_NXZ$$V$$Z$S@?$nsRunnableMethodArguments@$$V@@SA_NPAVMessageChannel@ipc@mozilla@@P8123@AE_NXZAAV?$Tuple@$$V@3@U?$IndexSequence@$S@3@@Z[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfe39d9]
#31: ??$apply@VMessageChannel@ipc@mozilla@@P8123@AE_NXZ@?$nsRunnableMethodArguments@$$V@@QAE_NPAVMessageChannel@ipc@mozilla@@P8123@AE_NXZ@Z[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfe382f]
#32: ?Run@?$nsRunnableMethodImpl@P8MessageChannel@ipc@mozilla@@AE_NXZ$0A@$00$$V@@UAG?AW4nsresult@@XZ[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1006690]
#33: mozilla::ipc::MessageChannel::RefCountedTask::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1008465]
#34: mozilla::ipc::MessageChannel::DequeueTask::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1006bd5]
#35: MessageLoop::RunTask[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa988c]
#36: MessageLoop::DeferOrRunPendingTask[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa171a]
#37: MessageLoop::DoWork[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa25f2]
#38: mozilla::ipc::DoWorkRunnable::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1006c71]
#39: nsThread::ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x79a2ac]
#40: NS_ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x805a92]
#41: nsThread::Shutdown[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x7a3361]
#42: ShutdownThreadEvent::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x208c240]
#43: nsThread::ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x79a2ac]
#44: NS_ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x805a92]
#45: mozilla::ipc::MessagePump::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x100718c]
#46: MessageLoop::RunInternal[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa980d]
#47: MessageLoop::RunHandler[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa9782]
#48: MessageLoop::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa937d]
#49: nsBaseAppShell::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x45fec60]
#50: nsAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\windows\nsappshell.cpp:262)
#51: nsAppStartup::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x574f1af]
#52: XREMain::XRE_mainRun[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x57f9ebc]
#53: XREMain::XRE_main[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x57f6a7a]
#54: XRE_main[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x57fc7aa]
#55: do_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:220)
#56: NS_internal_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:360)
#57: wmain (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nswindowswmain.cpp:135)
#58: __scrt_common_main_seh (f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:255)
#59: BaseThreadInitThunk[C:\Windows\system32\kernel32.dll +0x4ef1c]
#60: RtlInitializeExceptionChain[C:\Windows\SYSTEM32\ntdll.dll +0x63b53]
#61: RtlInitializeExceptionChain[C:\Windows\SYSTEM32\ntdll.dll +0x63b26]

mozilla@win-7-battlestar ~/debug-builds/mozilla-central/firefox-debug/dist/bin
$

Comment 1

[Jonathan Kew [:jfkthame]]

This seems a lot like bug 1264949; maybe C.J. can take a look?

Comment 2

[u459114]

Yes, it is.

Comment 3

[Bob Clary [:bc] (inactive)]

cjku: It would be helpful for us if when you file an assertion failure bug that you include the text of the assertion message as it appears in stderr either in the summary (preferred) or the content of the bug. We search for bugs based on the full text of the assertion message and when we don't find matching bugs, we go ahead and file one. Placing the assertion message in the summary allows us to use a much faster bugzilla search than searching all comments.

Comment 4

[Carsten Book [:Tomcat]]

cjku, bug 1264949 was marked fixed at 2016-04-20 02:57:55 PDT so since this is still happing with a debug build with todays m-c is this really fixed ?

Comment 5

[u459114]

(In reply to Bob Clary [:bc:] from comment #3)
> cjku: It would be helpful for us if when you file an assertion failure bug
> that you include the text of the assertion message as it appears in stderr
> either in the summary (preferred) or the content of the bug. We search for
> bugs based on the full text of the assertion message and when we don't find
> matching bugs, we go ahead and file one. Placing the assertion message in
> the summary allows us to use a much faster bugzilla search than searching
> all comments.
So, add this string
"Assertion failure: nsDisplayItem::TYPE_BACKGROUND != i->GetType() && nsDisplayItem::TYPE_BACKGROUND_COLOR != i->GetType()"
in summary help people find associate bug. Now I know, thank for sharing.

Comment 6

[u459114]

(In reply to Carsten Book [:Tomcat] from comment #4)
> cjku, bug 1264949 was marked fixed at 2016-04-20 02:57:55 PDT so since this
> is still happing with a debug build with todays m-c is this really fixed ?
Checking

Comment 7

[u459114]

This web site(http://aiadmk.com/en/home/) do make this assertion fail. Debugging.

Comment 8

[u459114]

Attachment: MozReview Request: bug 1270795 - do not generate any background items in glyph path generating process;

Review commit: https://reviewboard.mozilla.org/r/51097/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/51097/

Comment 9

[u459114]

There are two paths to create background display item, in bug 759568, I only block one of them
1. (blocked) nsFrame::DisplayBorderBackgroundOutline >> DisplayBackgroundUnconditional >> nsDisplayBackgroundImage::AppendBackgroundItemsToTop
2. (not blocked) nsTableFrame::BuildDisplayList >> DisplayBackgroundUnconditional >> nsDisplayBackgroundImage::AppendBackgroundItemsToTop

The most robust way is to move the switch down to nsDisplayBackgroundImage::AppendBackgroundItemsToTop

Comment 12

[u459114]

[Tracking Requested - why for this release]:
In debug build, assertion abort. In release version, seg fault caused by infinite recursion calls.
Since background-clip:text is turn on by default in 48, we should also uplift these patches onto aurora.

Comment 13

[Jonathan Kew [:jfkthame]]

Comment on attachment 8749689 [details]
MozReview Request: bug 1270795 - do not generate any background items in glyph path generating process;

https://reviewboard.mozilla.org/r/51097/#review48003

Comment 14

[Jonathan Kew [:jfkthame]]

Comment on attachment 8749708 [details]
MozReview Request: Bug 1270795 - Crash test;

https://reviewboard.mozilla.org/r/51107/#review48005

Comment 15

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d7b395cc7601
https://hg.mozilla.org/integration/mozilla-inbound/rev/7865878fa033

Comment 16

[u459114]

Comment on attachment 8749689 [details]
MozReview Request: bug 1270795 - do not generate any background items in glyph path generating process;

Approval Request Comment
[Feature/regressing bug #]: bug 759568 
[User impact if declined]: browser crash while access a page put a div with background-clip:text attribute inside a table.
[Describe test coverage new/current, TreeHerder]: manually test done. done a try run on m-c
[Risks and why]: Low risk
[String/UUID change made/needed]: NA

Comment 17

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/d7b395cc7601
https://hg.mozilla.org/mozilla-central/rev/7865878fa033

Comment 18

[Liz Henry (:lizzard) (relman/hg->git project)]

Noting from comment 12 that this affects 48.

Comment 19

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8749689 [details]
MozReview Request: bug 1270795 - do not generate any background items in glyph path generating process;

Try run, manual testing, fixes a crash in 48. Let's uplift this!

Comment 20

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/96622c844cda
https://hg.mozilla.org/releases/mozilla-aurora/rev/eb377e675575