Closed Bug 1402183 Opened 7 years ago Closed 7 years ago

Assertion failure: merged->CanMerge(item) in [@ nsDisplayListBuilder::MergeItems]

Categories

(Core :: Web Painting, defect)

Product:
Core
Component:
Web Painting
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla58
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox55 --- unaffected
firefox56 --- unaffected
firefox57 --- wontfix
firefox58 --- fixed

People

(Reporter: tsmith, Assigned: mikokm)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

test_case.html
174 bytes, text/html
Details
Bug 1402183 - Part 1: Make nsDisplayMask::CanMerge() symmetric
59 bytes, text/x-review-board-request
mstange
: review+
ritu
: approval-mozilla-beta-
Details
Bug 1402183 - Part 2: Add crashtest
59 bytes, text/x-review-board-request
mstange
: review+
Details
Attached file test_case.html — 
Assertion failure: merged->CanMerge(item), at /src/layout/painting/nsDisplayList.cpp:879

#0 nsDisplayListBuilder::MergeItems(nsTArray<nsDisplayItem*>&) /src/layout/painting/nsDisplayList.cpp:880:15
#1 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*, AnimatedGeometryRoot*, mozilla::ActiveScrolledRoot const*, nsPoint const&, nsPoint&, int, int&) /src/layout/painting/FrameLayerBuilder.cpp:4031:24
#2 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) /src/layout/painting/FrameLayerBuilder.cpp:3983:3
#3 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5697:11
#4 nsDisplayMask::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:8890:5
#5 mozilla::FrameLayerBuilder::AddPaintedDisplayItem(mozilla::PaintedLayerData*, nsDisplayItem*, mozilla::DisplayItemClip const&, mozilla::ContainerState&, mozilla::LayerState, nsPoint const&) /src/layout/painting/FrameLayerBuilder.cpp:4719:16
#6 void mozilla::ContainerState::FinishPaintedLayerData<mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0>(mozilla::PaintedLayerData&, mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0) /src/layout/painting/FrameLayerBuilder.cpp:3167:20
#7 mozilla::PaintedLayerDataNode::PopPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2872:21
#8 mozilla::PaintedLayerDataNode::PopAllPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2882:5
#9 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2836:3
#10 mozilla::PaintedLayerDataNode::FinishAllChildren(bool) /src/layout/painting/FrameLayerBuilder.cpp:2825:19
#11 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2834:3
#12 mozilla::PaintedLayerDataTree::Finish() /src/layout/painting/FrameLayerBuilder.cpp:2896:12
#13 mozilla::ContainerState::Finish(unsigned int*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, nsDisplayList*, bool*) /src/layout/painting/FrameLayerBuilder.cpp:5282:25
#14 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5711:11
#15 nsDisplayMask::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:8890:5
#16 mozilla::FrameLayerBuilder::AddPaintedDisplayItem(mozilla::PaintedLayerData*, nsDisplayItem*, mozilla::DisplayItemClip const&, mozilla::ContainerState&, mozilla::LayerState, nsPoint const&) /src/layout/painting/FrameLayerBuilder.cpp:4719:16
#17 void mozilla::ContainerState::FinishPaintedLayerData<mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0>(mozilla::PaintedLayerData&, mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0) /src/layout/painting/FrameLayerBuilder.cpp:3167:20
#18 mozilla::PaintedLayerDataNode::PopPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2872:21
#19 mozilla::PaintedLayerDataNode::PopAllPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2882:5
#20 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2836:3
#21 mozilla::PaintedLayerDataNode::FinishAllChildren(bool) /src/layout/painting/FrameLayerBuilder.cpp:2825:19
#22 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2834:3
#23 mozilla::PaintedLayerDataTree::Finish() /src/layout/painting/FrameLayerBuilder.cpp:2896:12
#24 mozilla::ContainerState::Finish(unsigned int*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, nsDisplayList*, bool*) /src/layout/painting/FrameLayerBuilder.cpp:5282:25
#25 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5711:11
#26 nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:6528:5
#27 nsDisplaySubDocument::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:6626:44
#28 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*, AnimatedGeometryRoot*, mozilla::ActiveScrolledRoot const*, nsPoint const&, nsPoint&, int, int&) /src/layout/painting/FrameLayerBuilder.cpp:4300:38
#29 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*, AnimatedGeometryRoot*, mozilla::ActiveScrolledRoot const*, nsPoint const&, nsPoint&, int, int&) /src/layout/painting/FrameLayerBuilder.cpp:4039:7
#30 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) /src/layout/painting/FrameLayerBuilder.cpp:3983:3
#31 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5697:11
#32 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /src/layout/painting/nsDisplayList.cpp:2254:9
#33 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /src/layout/base/nsLayoutUtils.cpp:3755:12
#34 mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /src/layout/base/PresShell.cpp:6454:5
#35 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /src/view/nsViewManager.cpp:480:19
#36 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /src/view/nsViewManager.cpp:412:33
#37 nsViewManager::ProcessPendingUpdates() /src/view/nsViewManager.cpp:1102:5
#38 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:2082:11
#39 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:307:7
#40 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:329:5
#41 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:770:5
#42 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:683:35
#43 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /src/layout/base/nsRefreshDriver.cpp:529:20
#44 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1039:14
#45 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:521:10
#46 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#47 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#48 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#49 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#50 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30
#51 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4701:22
#52 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4865:8
#53 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4960:21
#54 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:236:22
#55 main /src/browser/app/nsBrowserApp.cpp:309:16
#56 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#57 _start (firefox+0x41e9e4)
Flags: in-testsuite?
Different test case, but seems pretty similar stack, bug 1402031.
Blocks: 1402031
No longer blocks: grizzly
See Also: → 1402031
INFO: Last good revision: 56a78e06eff868f3581ca509cf510a6a899bd378
INFO: First bad revision: 7bdf8f58bb8b0d18ea7a20bd58a1c26aed07f58d
INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=56a78e06eff868f3581ca509cf510a6a899bd378&tochange=7bdf8f58bb8b0d18ea7a20bd58a1c26aed07f58d
Blocks: 1359584
status-firefox55: --- → unaffected
status-firefox56: --- → unaffected
status-firefox-esr52: --- → unaffected
Flags: needinfo?(mikokm)
Thank you for the report, I'll investigate this.
Assignee: nobody → mikokm
Status: NEW → ASSIGNED
Flags: needinfo?(mikokm)
Component: Layout → Layout: Web Painting
The cause for this and Bug 1402031 is nsDisplayMask::CanMerge(), which only checks the frame style for one of the display items.
Comment on attachment 8911493 [details]
Bug 1402183 - Part 1: Make nsDisplayMask::CanMerge() symmetric

https://reviewboard.mozilla.org/r/182944/#review188942
Attachment #8911493 - Flags: review?(mstange) → review+
Comment on attachment 8911494 [details]
Bug 1402183 - Part 2: Add crashtest

https://reviewboard.mozilla.org/r/182946/#review188944
Attachment #8911494 - Flags: review?(mstange) → review+
Pushed by mikokm@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/542962171efc
Part 1: Make nsDisplayMask::CanMerge() symmetric r=mstange
https://hg.mozilla.org/integration/autoland/rev/85684a22314e
Part 2: Add crashtest r=mstange
https://hg.mozilla.org/mozilla-central/rev/542962171efc
https://hg.mozilla.org/mozilla-central/rev/85684a22314e
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
status-firefox58: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
Is that something that you would like to uplift in 57?
Flags: needinfo?(mikokm)
Flags: in-testsuite? → in-testsuite+
Comment on attachment 8911493 [details]
Bug 1402183 - Part 1: Make nsDisplayMask::CanMerge() symmetric

Approval Request Comment
[Feature/Bug causing the regression]: nsDisplayMask>>CanMerge() function worked differently depending on the ordering of display items.
[User impact if declined]: Small. This bug was present before adding the assertion that uncovered this.
[Is this code covered by automated tests?]: Yes, there is a new crashtest.
[Has the fix been verified in Nightly?]: Yes, the debug build of Nightly does not crash with the added crashtest.
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: No.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: The change is trivial and the current test suite passes.
[String changes made/needed]: No.
Flags: needinfo?(mikokm)
Attachment #8911493 - Flags: approval-mozilla-beta?
Hi Matt, can I get your opinion on whether this is a must fix for 57? It is a recent regression but I am unable to determine the severity or likelihood of real users running into this crash. Appreciate any help.
Flags: needinfo?(matt.woodrow)
No, I don't think this is a must fix for 57. It's an existing bug, just a new assertion that shows it. It is a low risk fix though.
Flags: needinfo?(matt.woodrow)
Thanks Matt. Beta57 is seeing an unusual # of uplift request. I want to manage risks to quality by limiting uplifts to must fix items. Sorry!
status-firefox57: affected → wontfix
Attachment #8911493 - Flags: approval-mozilla-beta? → approval-mozilla-beta-
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: