1402183 - Assertion failure: merged->CanMerge(item) in [@ nsDisplayListBuilder::MergeItems]

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Assertion failure: merged->CanMerge(item), at /src/layout/painting/nsDisplayList.cpp:879

#0 nsDisplayListBuilder::MergeItems(nsTArray<nsDisplayItem*>&) /src/layout/painting/nsDisplayList.cpp:880:15
#1 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*, AnimatedGeometryRoot*, mozilla::ActiveScrolledRoot const*, nsPoint const&, nsPoint&, int, int&) /src/layout/painting/FrameLayerBuilder.cpp:4031:24
#2 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) /src/layout/painting/FrameLayerBuilder.cpp:3983:3
#3 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5697:11
#4 nsDisplayMask::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:8890:5
#5 mozilla::FrameLayerBuilder::AddPaintedDisplayItem(mozilla::PaintedLayerData*, nsDisplayItem*, mozilla::DisplayItemClip const&, mozilla::ContainerState&, mozilla::LayerState, nsPoint const&) /src/layout/painting/FrameLayerBuilder.cpp:4719:16
#6 void mozilla::ContainerState::FinishPaintedLayerData<mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0>(mozilla::PaintedLayerData&, mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0) /src/layout/painting/FrameLayerBuilder.cpp:3167:20
#7 mozilla::PaintedLayerDataNode::PopPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2872:21
#8 mozilla::PaintedLayerDataNode::PopAllPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2882:5
#9 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2836:3
#10 mozilla::PaintedLayerDataNode::FinishAllChildren(bool) /src/layout/painting/FrameLayerBuilder.cpp:2825:19
#11 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2834:3
#12 mozilla::PaintedLayerDataTree::Finish() /src/layout/painting/FrameLayerBuilder.cpp:2896:12
#13 mozilla::ContainerState::Finish(unsigned int*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, nsDisplayList*, bool*) /src/layout/painting/FrameLayerBuilder.cpp:5282:25
#14 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5711:11
#15 nsDisplayMask::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:8890:5
#16 mozilla::FrameLayerBuilder::AddPaintedDisplayItem(mozilla::PaintedLayerData*, nsDisplayItem*, mozilla::DisplayItemClip const&, mozilla::ContainerState&, mozilla::LayerState, nsPoint const&) /src/layout/painting/FrameLayerBuilder.cpp:4719:16
#17 void mozilla::ContainerState::FinishPaintedLayerData<mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0>(mozilla::PaintedLayerData&, mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0) /src/layout/painting/FrameLayerBuilder.cpp:3167:20
#18 mozilla::PaintedLayerDataNode::PopPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2872:21
#19 mozilla::PaintedLayerDataNode::PopAllPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2882:5
#20 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2836:3
#21 mozilla::PaintedLayerDataNode::FinishAllChildren(bool) /src/layout/painting/FrameLayerBuilder.cpp:2825:19
#22 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2834:3
#23 mozilla::PaintedLayerDataTree::Finish() /src/layout/painting/FrameLayerBuilder.cpp:2896:12
#24 mozilla::ContainerState::Finish(unsigned int*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, nsDisplayList*, bool*) /src/layout/painting/FrameLayerBuilder.cpp:5282:25
#25 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5711:11
#26 nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:6528:5
#27 nsDisplaySubDocument::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:6626:44
#28 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*, AnimatedGeometryRoot*, mozilla::ActiveScrolledRoot const*, nsPoint const&, nsPoint&, int, int&) /src/layout/painting/FrameLayerBuilder.cpp:4300:38
#29 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*, AnimatedGeometryRoot*, mozilla::ActiveScrolledRoot const*, nsPoint const&, nsPoint&, int, int&) /src/layout/painting/FrameLayerBuilder.cpp:4039:7
#30 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) /src/layout/painting/FrameLayerBuilder.cpp:3983:3
#31 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5697:11
#32 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /src/layout/painting/nsDisplayList.cpp:2254:9
#33 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /src/layout/base/nsLayoutUtils.cpp:3755:12
#34 mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /src/layout/base/PresShell.cpp:6454:5
#35 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /src/view/nsViewManager.cpp:480:19
#36 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /src/view/nsViewManager.cpp:412:33
#37 nsViewManager::ProcessPendingUpdates() /src/view/nsViewManager.cpp:1102:5
#38 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:2082:11
#39 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:307:7
#40 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:329:5
#41 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:770:5
#42 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:683:35
#43 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /src/layout/base/nsRefreshDriver.cpp:529:20
#44 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1039:14
#45 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:521:10
#46 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#47 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#48 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#49 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#50 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30
#51 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4701:22
#52 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4865:8
#53 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4960:21
#54 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:236:22
#55 main /src/browser/app/nsBrowserApp.cpp:309:16
#56 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#57 _start (firefox+0x41e9e4)

Comment 1

[Hiroyuki Ikezoe (:hiro)]

Different test case, but seems pretty similar stack, bug 1402031.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

INFO: Last good revision: 56a78e06eff868f3581ca509cf510a6a899bd378
INFO: First bad revision: 7bdf8f58bb8b0d18ea7a20bd58a1c26aed07f58d
INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=56a78e06eff868f3581ca509cf510a6a899bd378&tochange=7bdf8f58bb8b0d18ea7a20bd58a1c26aed07f58d

Comment 3

[Miko Mynttinen]

Thank you for the report, I'll investigate this.

Comment 4

[Miko Mynttinen]

Attachment: Bug 1402183 - Part 1: Make nsDisplayMask::CanMerge() symmetric

Review commit: https://reviewboard.mozilla.org/r/182944/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/182944/

Comment 5

[Miko Mynttinen]

Attachment: Bug 1402183 - Part 2: Add crashtest

Review commit: https://reviewboard.mozilla.org/r/182946/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/182946/

Comment 7

[Miko Mynttinen]

The cause for this and Bug 1402031 is nsDisplayMask::CanMerge(), which only checks the frame style for one of the display items.

Comment 8

[Markus Stange [:mstange]]

Comment on attachment 8911493 [details]
Bug 1402183 - Part 1: Make nsDisplayMask::CanMerge() symmetric

https://reviewboard.mozilla.org/r/182944/#review188942

Comment 9

[Markus Stange [:mstange]]

Comment on attachment 8911494 [details]
Bug 1402183 - Part 2: Add crashtest

https://reviewboard.mozilla.org/r/182946/#review188944

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/542962171efc
Part 1: Make nsDisplayMask::CanMerge() symmetric r=mstange
https://hg.mozilla.org/integration/autoland/rev/85684a22314e
Part 2: Add crashtest r=mstange

Comment 11

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/542962171efc
https://hg.mozilla.org/mozilla-central/rev/85684a22314e

Comment 12

[Sylvestre Ledru [:Sylvestre]]

Is that something that you would like to uplift in 57?

Comment 13

[Miko Mynttinen]

Comment on attachment 8911493 [details]
Bug 1402183 - Part 1: Make nsDisplayMask::CanMerge() symmetric

Approval Request Comment
[Feature/Bug causing the regression]: nsDisplayMask>>CanMerge() function worked differently depending on the ordering of display items.
[User impact if declined]: Small. This bug was present before adding the assertion that uncovered this.
[Is this code covered by automated tests?]: Yes, there is a new crashtest.
[Has the fix been verified in Nightly?]: Yes, the debug build of Nightly does not crash with the added crashtest.
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: No.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: The change is trivial and the current test suite passes.
[String changes made/needed]: No.

Comment 14

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Hi Matt, can I get your opinion on whether this is a must fix for 57? It is a recent regression but I am unable to determine the severity or likelihood of real users running into this crash. Appreciate any help.

Comment 15

[Matt Woodrow (:mattwoodrow)]

No, I don't think this is a must fix for 57. It's an existing bug, just a new assertion that shows it. It is a low risk fix though.

Comment 16

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Thanks Matt. Beta57 is seeing an unusual # of uplift request. I want to manage risks to quality by limiting uplifts to must fix items. Sorry!