1419546 - Crash in RetainedDisplayListBuilder::MergeDisplayLists

Status: RESOLVED FIXED

(Core :: Web Painting, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-b3cb89aa-ba20-40f6-86f9-8d0c20171118.
=============================================================

Seen while looking at nightly crash data: http://bit.ly/2zWeknf

Top 10 frames of crashing thread:

0 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:415
1 xul.dll RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:468
2 xul.dll RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:853
3 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3827
4 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6506
5 xul.dll nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:480
6 xul.dll nsViewManager::ProcessPendingUpdatesForView view/nsViewManager.cpp:412
7 xul.dll nsViewManager::ProcessPendingUpdates view/nsViewManager.cpp:1102
8 xul.dll nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:2027
9 xul.dll mozilla::RefreshDriverTimer::TickDriver layout/base/nsRefreshDriver.cpp:336

=============================================================

Comment 1

[Matt Woodrow (:mattwoodrow)]

I can reproduce this on https://battlegrounds.leagueoflegends.com/de

Comment 2

[Matt Woodrow (:mattwoodrow)]

This is another duplicated table display item bug: https://pastebin.mozilla.org/9074242

Morris, would you be able to take a look at this one too please?

Comment 3

[Marcia Knous [:marcia]]

Adding 58 as affected.

Comment 4

[Morris Tseng [:mtseng] [:Morris] (Inactive)]

Sure

Comment 5

[Morris Tseng [:mtseng] [:Morris] (Inactive)]

Attachment: Bug 1419546 - Consider mLayer in nsDisplayTableBackgroundImage::GetPerFrameKey().

Review commit: https://reviewboard.mozilla.org/r/207366/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/207366/

Comment 6

[Matt Woodrow (:mattwoodrow)]

Comment on attachment 8936625 [details]
Bug 1419546 - Consider mLayer in nsDisplayTableBackgroundImage::GetPerFrameKey().

https://reviewboard.mozilla.org/r/207366/#review213256

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1444a77d7e45
Consider mLayer in nsDisplayTableBackgroundImage::GetPerFrameKey(). r=mattwoodrow

Comment 8

[Natalia Csoregi [:nataliaCs]]

Backed out for build bustage

backout: https://hg.mozilla.org/integration/autoland/rev/b027efb62997101a3b888ee0c875fd9909b85fe3

push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=1444a77d7e453402776fd08bfa72de2d40de46cf

failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=151498588&repo=autoland&lineNumber=977

Comment 9

[Morris Tseng [:mtseng] [:Morris] (Inactive)]

I submitted a try again and it looks like all green. https://treeherder.mozilla.org/#/jobs?repo=try&revision=7c8b817dbe994947eeef4b0610256fedf84f9210

And I also re-triggered the fail build in https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=1444a77d7e453402776fd08bfa72de2d40de46cf&group_state=expanded and it looks like green.

So I think the build bustage is not related to my patch. I'm going to reland it.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/97043a5a2d5e
Consider mLayer in nsDisplayTableBackgroundImage::GetPerFrameKey(). r=mattwoodrow

Comment 11

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/97043a5a2d5e

Comment 12

[Julien Cristau [:jcristau]]

I'll call this disabled in 58.