Closed Bug 1270795 Opened 8 years ago Closed 8 years ago

Assertion failure: nsDisplayItem::TYPE_BACKGROUND != i->GetType() && nsDisplayItem::TYPE_BACKGROUND_COLOR != i->GetType(), at nsLayoutUtils.cpp:3456

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla49
Tracking Flags:
Tracking Status
firefox48 + fixed
firefox49 --- fixed

People

(Reporter: cbook, Assigned: u459114)

References

(
URL
)

Details

(Keywords: assertion)

Attachments

(2 files)

MozReview Request: bug 1270795 - do not generate any background items in glyph path generating process;
58 bytes, text/x-review-board-request
jfkthame
: review+
lizzard
: approval-mozilla-aurora+
Details
MozReview Request: Bug 1270795 - Crash test;
58 bytes, text/x-review-board-request
jfkthame
: review+
Details 
found via bughunter and reproduced on a windows 7 trunk debug build based on m-c tip

Steps to reproduce:
-> Load http://aiadmk.com/en/home/
--> Assertion failure 

Assertion failure: nsDisplayItem::TYPE_BACKGROUND != i->GetType() && nsDisplayItem::TYPE_BACKGROUND_COLOR != i->GetType(), at c:/Users/mozilla/debug-builds/mozilla-central/layout/base/nsLayoutUtils.cpp:3456
#01: nsDisplayItem::ClearsBackground[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4aef453]
#02: nsDisplayBackgroundImage::PaintInternal[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b382c5]
#03: nsDisplayBackgroundImage::Paint[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b35715]
#04: mozilla::FrameLayerBuilder::PaintItems[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a41ba1]
#05: mozilla::FrameLayerBuilder::DrawPaintedLayer[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a2f9eb]
#06: mozilla::layers::ClientPaintedLayer::PaintThebes[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed3bce]
#07: mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed812a]
#08: mozilla::layers::ClientContainerLayer::RenderLayer[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed7013]
#09: mozilla::layers::ClientLayer::RenderLayerWithReadback[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed7f34]
#10: mozilla::layers::ClientContainerLayer::RenderLayer[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ed7013]
#11: mozilla::layers::ClientLayerManager::EndTransactionInternal[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ecc37e]
#12: mozilla::layers::ClientLayerManager::EndTransaction[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ecb925]
#13: nsDisplayList::PaintRoot[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b3996a]
#14: nsLayoutUtils::PaintFrame[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b37462]
#15: PresShell::Paint[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4b3505f]
#16: nsViewManager::ProcessPendingUpdatesPaint[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x45b0d74]
#17: nsViewManager::ProcessPendingUpdatesForView[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x45b0aff]
#18: nsViewManager::ProcessPendingUpdates[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x45b08e2]
#19: nsRefreshDriver::Tick[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a09eaf]
#20: nsRefreshDriver::DoTick[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a034fb]
#21: nsRefreshDriver::DoRefresh[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a033b0]
#22: nsRefreshDriver::FinishedWaitingForTransaction[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a03f2c]
#23: nsRefreshDriver::NotifyTransactionCompleted[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4a051ec]
#24: mozilla::layers::ClientLayerManager::DidComposite[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1ec9850]
#25: mozilla::layers::CompositorBridgeChild::RecvDidComposite[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1f712f3]
#26: mozilla::layers::PCompositorBridgeChild::OnMessageReceived[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x15a01d8]
#27: mozilla::ipc::MessageChannel::DispatchAsyncMessage[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xff82b8]
#28: mozilla::ipc::MessageChannel::DispatchMessageW[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xff8ac5]
#29: mozilla::ipc::MessageChannel::OnMaybeDequeueOne[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfff921]
#30: ??$applyImpl@VMessageChannel@ipc@mozilla@@P8123@AE_NXZ$$V$$Z$S@?$nsRunnableMethodArguments@$$V@@SA_NPAVMessageChannel@ipc@mozilla@@P8123@AE_NXZAAV?$Tuple@$$V@3@U?$IndexSequence@$S@3@@Z[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfe39d9]
#31: ??$apply@VMessageChannel@ipc@mozilla@@P8123@AE_NXZ@?$nsRunnableMethodArguments@$$V@@QAE_NPAVMessageChannel@ipc@mozilla@@P8123@AE_NXZ@Z[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfe382f]
#32: ?Run@?$nsRunnableMethodImpl@P8MessageChannel@ipc@mozilla@@AE_NXZ$0A@$00$$V@@UAG?AW4nsresult@@XZ[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1006690]
#33: mozilla::ipc::MessageChannel::RefCountedTask::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1008465]
#34: mozilla::ipc::MessageChannel::DequeueTask::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1006bd5]
#35: MessageLoop::RunTask[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa988c]
#36: MessageLoop::DeferOrRunPendingTask[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa171a]
#37: MessageLoop::DoWork[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa25f2]
#38: mozilla::ipc::DoWorkRunnable::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1006c71]
#39: nsThread::ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x79a2ac]
#40: NS_ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x805a92]
#41: nsThread::Shutdown[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x7a3361]
#42: ShutdownThreadEvent::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x208c240]
#43: nsThread::ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x79a2ac]
#44: NS_ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x805a92]
#45: mozilla::ipc::MessagePump::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x100718c]
#46: MessageLoop::RunInternal[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa980d]
#47: MessageLoop::RunHandler[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa9782]
#48: MessageLoop::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xfa937d]
#49: nsBaseAppShell::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x45fec60]
#50: nsAppShell::Run (c:\users\mozilla\debug-builds\mozilla-central\widget\windows\nsappshell.cpp:262)
#51: nsAppStartup::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x574f1af]
#52: XREMain::XRE_mainRun[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x57f9ebc]
#53: XREMain::XRE_main[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x57f6a7a]
#54: XRE_main[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x57fc7aa]
#55: do_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:220)
#56: NS_internal_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:360)
#57: wmain (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nswindowswmain.cpp:135)
#58: __scrt_common_main_seh (f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:255)
#59: BaseThreadInitThunk[C:\Windows\system32\kernel32.dll +0x4ef1c]
#60: RtlInitializeExceptionChain[C:\Windows\SYSTEM32\ntdll.dll +0x63b53]
#61: RtlInitializeExceptionChain[C:\Windows\SYSTEM32\ntdll.dll +0x63b26]

mozilla@win-7-battlestar ~/debug-builds/mozilla-central/firefox-debug/dist/bin
$
This seems a lot like bug 1264949; maybe C.J. can take a look?
Flags: needinfo?(cku)
Yes, it is.
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(cku)
Resolution: --- → DUPLICATE
cjku: It would be helpful for us if when you file an assertion failure bug that you include the text of the assertion message as it appears in stderr either in the summary (preferred) or the content of the bug. We search for bugs based on the full text of the assertion message and when we don't find matching bugs, we go ahead and file one. Placing the assertion message in the summary allows us to use a much faster bugzilla search than searching all comments.
cjku, bug 1264949 was marked fixed at 2016-04-20 02:57:55 PDT so since this is still happing with a debug build with todays m-c is this really fixed ?
Flags: needinfo?(cku)
(In reply to Bob Clary [:bc:] from comment #3)
> cjku: It would be helpful for us if when you file an assertion failure bug
> that you include the text of the assertion message as it appears in stderr
> either in the summary (preferred) or the content of the bug. We search for
> bugs based on the full text of the assertion message and when we don't find
> matching bugs, we go ahead and file one. Placing the assertion message in
> the summary allows us to use a much faster bugzilla search than searching
> all comments.
So, add this string
"Assertion failure: nsDisplayItem::TYPE_BACKGROUND != i->GetType() && nsDisplayItem::TYPE_BACKGROUND_COLOR != i->GetType()"
in summary help people find associate bug. Now I know, thank for sharing.
Flags: needinfo?(cku)
(In reply to Carsten Book [:Tomcat] from comment #4)
> cjku, bug 1264949 was marked fixed at 2016-04-20 02:57:55 PDT so since this
> is still happing with a debug build with todays m-c is this really fixed ?
Checking
This web site(http://aiadmk.com/en/home/) do make this assertion fail. Debugging.
Assignee: nobody → cku
Status: RESOLVED → REOPENED
Resolution: DUPLICATE → ---
Blocks: 1264905
There are two paths to create background display item, in bug 759568, I only block one of them
1. (blocked) nsFrame::DisplayBorderBackgroundOutline >> DisplayBackgroundUnconditional >> nsDisplayBackgroundImage::AppendBackgroundItemsToTop
2. (not blocked) nsTableFrame::BuildDisplayList >> DisplayBackgroundUnconditional >> nsDisplayBackgroundImage::AppendBackgroundItemsToTop

The most robust way is to move the switch down to nsDisplayBackgroundImage::AppendBackgroundItemsToTop
Attachment #8749689 - Flags: review?(jfkthame)
Attachment #8749708 - Flags: review?(jfkthame)
[Tracking Requested - why for this release]:
In debug build, assertion abort. In release version, seg fault caused by infinite recursion calls.
Since background-clip:text is turn on by default in 48, we should also uplift these patches onto aurora.
tracking-firefox48: --- → ?
Attachment #8749689 - Flags: review?(jfkthame) → review+
Comment on attachment 8749689 [details]
MozReview Request: bug 1270795 - do not generate any background items in glyph path generating process;

https://reviewboard.mozilla.org/r/51097/#review48003
Comment on attachment 8749708 [details]
MozReview Request: Bug 1270795 - Crash test;

https://reviewboard.mozilla.org/r/51107/#review48005
Attachment #8749708 - Flags: review?(jfkthame) → review+
Comment on attachment 8749689 [details]
MozReview Request: bug 1270795 - do not generate any background items in glyph path generating process;

Approval Request Comment
[Feature/regressing bug #]: bug 759568 
[User impact if declined]: browser crash while access a page put a div with background-clip:text attribute inside a table.
[Describe test coverage new/current, TreeHerder]: manually test done. done a try run on m-c
[Risks and why]: Low risk
[String/UUID change made/needed]: NA
Attachment #8749689 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/d7b395cc7601
https://hg.mozilla.org/mozilla-central/rev/7865878fa033
Status: REOPENED → RESOLVED
Closed: 8 years ago → 8 years ago
status-firefox49: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla49
Comment on attachment 8749689 [details]
MozReview Request: bug 1270795 - do not generate any background items in glyph path generating process;

Try run, manual testing, fixes a crash in 48. Let's uplift this!
Attachment #8749689 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.