Closed Bug 1428906 Opened 6 years ago Closed 6 years ago

Assertion failure: merged->CanMerge(item), at /src/layout/painting/nsDisplayList.cpp:872

Categories

(Core :: Web Painting, defect, P3)

Product:
Core
Component:
Web Painting
Version:
59 Branch
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla59
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- fixed

People

(Reporter: tsmith, Assigned: mikokm)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

testcase.html
262 bytes, text/html
Details
Bug 1428906 - Implement Clone() and copy-constructors for nsDisplayTableBlendMode, nsDisplayTableBlendContainer, and nsDisplayTableFixedPosition
59 bytes, text/x-review-board-request
mattwoodrow
: review+
Details
Attached file testcase.html — 
BuildID=20180108095634
SourceStamp=ca379fcca95b1f4a3744242ea8647004b99b3507

Assertion failure: merged->CanMerge(item), at /src/layout/painting/nsDisplayList.cpp:872

#0 0x7fe4a1aedf3d in nsDisplayListBuilder::MergeItems(nsTArray<nsDisplayItem*>&) /src/layout/painting/nsDisplayList.cpp:873:15
#1 0x7fe4a1ae97de in mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) /src/layout/painting/FrameLayerBuilder.cpp:4010:24
#2 0x7fe4a1af53b0 in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5677:11
#3 0x7fe4a1b7cae2 in nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:8596:5
#4 0x7fe4a1aeb290 in mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) /src/layout/painting/FrameLayerBuilder.cpp:4269:38
#5 0x7fe4a1af53b0 in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5677:11
#6 0x7fe4a1b70fda in nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:6985:5
#7 0x7fe4a1aeb290 in mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) /src/layout/painting/FrameLayerBuilder.cpp:4269:38
#8 0x7fe4a1af53b0 in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5677:11
#9 0x7fe4a1b50f47 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /src/layout/painting/nsDisplayList.cpp:2562:9
#10 0x7fe4a153608e in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /src/layout/base/nsLayoutUtils.cpp:3948:12
#11 0x7fe4a14686c0 in mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /src/layout/base/PresShell.cpp:6485:5
#12 0x7fe4a0e322e8 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /src/view/nsViewManager.cpp:480:19
#13 0x7fe4a0e31c35 in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /src/view/nsViewManager.cpp:412:33
#14 0x7fe4a0e33e78 in nsViewManager::ProcessPendingUpdates() /src/view/nsViewManager.cpp:1102:5
#15 0x7fe4a13e9eca in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:2046:11
#16 0x7fe4a13f27fe in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:306:7
#17 0x7fe4a13f25ac in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:328:5
#18 0x7fe4a13f5c2f in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:769:5
#19 0x7fe4a13f4ba5 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:682:35
#20 0x7fe4a13f0c37 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /src/layout/base/nsRefreshDriver.cpp:528:20
#21 0x7fe49b2506e7 in nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1040:14
#22 0x7fe49b273128 in NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:517:10
#23 0x7fe49be8e743 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21
#24 0x7fe49bdd4848 in MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10
#25 0x7fe49bdd46cc in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3
#26 0x7fe4a0ea6eaa in nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:157:27
#27 0x7fe4a4210f04 in nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30
#28 0x7fe4a4399c3e in XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4709:22
#29 0x7fe4a439bd0e in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4871:8
#30 0x7fe4a439cd41 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4963:21
#31 0x4f013a in do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:231:22
#32 0x4ef96a in main /src/browser/app/nsBrowserApp.cpp:304:16
#33 0x7fe4bb64382f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
#34 0x41f3d4 in _start (firefox+0x41f3d4)
Flags: in-testsuite?
Looks like Miko's been working on display list merging logic recently-ish (bug 1359584 part 5).  CC'ing him in case he's got any thoughts on this.
Component: Layout → Layout: Web Painting
Priority: -- → P3
(Actually it looks like bug 1359584 is where this assertion was created -- adding dependency.)
Depends on: 1359584
This is triggered by TableFixedPosition returning true to CanMerge(), but since TableFixedPosition does not override nsDisplayFixedPosition::Clone(), the resulting merged item will have incorrect type, and will fail the CanMerge() assertion.
Assignee: nobody → mikokm
Status: NEW → ASSIGNED
This same bug also affects nsDisplayTableBlendMode items.
Comment on attachment 8941399 [details]
Bug 1428906 - Implement Clone() and copy-constructors for nsDisplayTableBlendMode, nsDisplayTableBlendContainer, and nsDisplayTableFixedPosition

https://reviewboard.mozilla.org/r/211718/#review217632
Attachment #8941399 - Flags: review?(matt.woodrow) → review+
Pushed by mikokm@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/ec9db833ef5b
Implement Clone() and copy-constructors for nsDisplayTableBlendMode, nsDisplayTableBlendContainer, and nsDisplayTableFixedPosition r=mattwoodrow
https://hg.mozilla.org/mozilla-central/rev/ec9db833ef5b
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
status-firefox59: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
status-firefox57: --- → wontfix
status-firefox58: --- → wontfix
status-firefox-esr52: --- → unaffected
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: