Crash due to stack overflow in ComputeEffectiveTransformsForChildren

RESOLVED FIXED in Firefox 49

Status

()

Core
Graphics: Layers
--
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: Tomcat, Assigned: mattwoodrow)

Tracking

(Blocks: 1 bug, {crash})

unspecified
mozilla49
Unspecified
All
crash
Points:
---

Firefox Tracking Flags

(firefox49 fixed)

Details

(crash signature, URL)

Attachments

(2 attachments)

(Reporter)

Description

2 years ago
Found via bughunter and reproduced on a windows 7 debug build as well as on a nightly opt build based on m-c tip also on mac

Steps to reproduce: 
--> Load https://prevoty.com/
----> Crash
(Reporter)

Updated

2 years ago
Component: Graphics → Graphics: Layers
Summary: Crash in mozilla::gfx::Matrix4x4Typed<T> mozilla::gfx::Matrix4x4Typed<T>::operator*<T> const → Crash due to stack overflow in ComputeEffectiveTransformsForChildren
Maybe layout should avoid putting us in this situation?
Flags: needinfo?(matt.woodrow)
(Assignee)

Updated

2 years ago
Assignee: nobody → matt.woodrow
Flags: needinfo?(matt.woodrow)
(Assignee)

Comment 3

2 years ago
Created attachment 8750546 [details] [diff] [review]
double-blend-container
Attachment #8750546 - Flags: review?(mstange)
Why is this necessary? What's happening here? Don't we still need different keys for different nsDisplayBlendMode items for the same frame?
(Assignee)

Comment 5

2 years ago
The problem is that we build two nsDisplayBlendContainers for the same frame, and FrameLayerBuilder gets confused and builds a ContainerLayer with itself as its first child.

We had mIndex to prevent this, but it was always zero, so didn't do anything.

As far as I can tell we can only ever have two blend containers per frame (one for mix-blend-mode, and one for background-blend-mode), so switching to a boolean seems sufficient (and clearer).

We can still build an arbitrary number of nsDisplayBlendModes, but those already use indexes correctly.
Oops, I got confused with nsDisplayBlendContainer vs nsDisplayBlendMode. Sounds good.
Comment on attachment 8750546 [details] [diff] [review]
double-blend-container

Review of attachment 8750546 [details] [diff] [review]:
-----------------------------------------------------------------

thanks
Attachment #8750546 - Flags: review?(mstange) → review+
(Reporter)

Comment 9

2 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/486e823cb780
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox49: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla49
You need to log in before you can comment on or make changes to this bug.