Open Bug 1414457 Opened 3 years ago Updated 2 years ago

Assertion failure: value >= 0, at /src/layout/painting/nsCSSRenderingBorders.cpp:4096

Categories

(Core :: CSS Parsing and Computation, defect, P3)

58 Branch
defect

Tracking

()

Tracking Status
firefox-esr52 --- wontfix
firefox56 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- ?

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file testcase.html
Assertion failure: value >= 0, at /src/layout/painting/nsCSSRenderingBorders.cpp:4096

#0 nsCSSBorderImageRenderer::nsCSSBorderImageRenderer(nsIFrame*, nsRect const&, nsStyleBorder const&, mozilla::Sides, mozilla::nsImageRenderer const&) /src/layout/painting/nsCSSRenderingBorders.cpp:4098:5
#1 nsCSSBorderImageRenderer::CreateBorderImageRenderer(nsPresContext*, nsIFrame*, nsRect const&, nsStyleBorder const&, nsRect const&, mozilla::Sides, unsigned int, mozilla::image::DrawResult*) /src/layout/painting/nsCSSRenderingBorders.cpp:3673:28
#2 nsCSSRendering::PaintBorderWithStyleBorder(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, nsStyleContext*, mozilla::PaintBorderFlags, mozilla::Sides) /src/layout/painting/nsCSSRendering.cpp:923:7
#3 nsCSSRendering::PaintBorder(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleContext*, mozilla::PaintBorderFlags, mozilla::Sides) /src/layout/painting/nsCSSRendering.cpp:646:12
#4 nsDisplayBorder::Paint(nsDisplayListBuilder*, gfxContext*) /src/layout/painting/nsDisplayList.cpp:5408:5
#5 mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::FrameLayerBuilder::ClippedDisplayItem>&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float, int) /src/layout/painting/FrameLayerBuilder.cpp:6033:21
#6 mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) /src/layout/painting/FrameLayerBuilder.cpp:6200:19
#7 mozilla::layers::ClientPaintedLayer::PaintThebes(nsTArray<mozilla::layers::ReadbackProcessor::Update>*) /src/gfx/layers/client/ClientPaintedLayer.cpp:164:5
#8 mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) /src/gfx/layers/client/ClientPaintedLayer.cpp:293:3
#9 mozilla::layers::ClientContainerLayer::RenderLayer() /src/gfx/layers/client/ClientContainerLayer.h:58:29
#10 mozilla::layers::ClientContainerLayer::RenderLayer() /src/gfx/layers/client/ClientContainerLayer.h:58:29
#11 mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /src/gfx/layers/client/ClientLayerManager.cpp:384:13
#12 mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /src/gfx/layers/client/ClientLayerManager.cpp:442:3
#13 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /src/layout/painting/nsDisplayList.cpp:2548:17
#14 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /src/layout/base/nsLayoutUtils.cpp:3934:12
#15 mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /src/layout/base/PresShell.cpp:6471:5
#16 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /src/view/nsViewManager.cpp:480:19
#17 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /src/view/nsViewManager.cpp:412:33
#18 nsViewManager::ProcessPendingUpdates() /src/view/nsViewManager.cpp:1102:5
#19 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:2047:11
#20 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:306:7
#21 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:328:5
#22 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:769:5
#23 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:682:35
#24 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /src/layout/base/nsRefreshDriver.cpp:528:20
#25 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14
#26 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:513:10
#27 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#28 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#29 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#30 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27
#31 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30
#32 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4675:22
#33 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4837:8
#34 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4932:21
#35 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:231:22
#36 main /src/browser/app/nsBrowserApp.cpp:304:16
#37 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#38 _start (firefox+0x41ebe4)
Flags: in-testsuite?
Goes back more than a year, which is the furthest back mozregression can bisect debug builds.
Has Regression Range: --- → no
The testcase contains a big length value "5445169mm", so suspect there is some overflow happens.
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.