Closed Bug 1454105 Opened 2 years ago Closed 2 years ago

Assertion failure: mMarkers.empty(), at src/layout/painting/FrameLayerBuilder.cpp:163

Categories

(Core :: Web Painting, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox-esr52 --- unaffected
firefox-esr60 --- unaffected
firefox59 --- unaffected
firefox60 --- unaffected
firefox61 --- fixed

People

(Reporter: tsmith, Assigned: miko)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase.html
Assertion failure: mMarkers.empty(), at src/layout/painting/FrameLayerBuilder.cpp:163

#0 mozilla::FLBDisplayItemIterator::GetNext() src/layout/painting/FrameLayerBuilder.cpp:163:5
#1 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) src/layout/painting/FrameLayerBuilder.cpp:4339:18
#2 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) src/layout/painting/FrameLayerBuilder.cpp:5952:9
#3 nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) src/layout/painting/nsDisplayList.cpp:6986:5
#4 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) src/layout/painting/FrameLayerBuilder.cpp:4618:38
#5 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) src/layout/painting/FrameLayerBuilder.cpp:5952:9
#6 nsDisplayList::BuildLayers(nsDisplayListBuilder*, mozilla::layers::LayerManager*, unsigned int, bool) src/layout/painting/nsDisplayList.cpp:2528:9
#7 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) src/layout/painting/nsDisplayList.cpp:2739:20
#8 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:4010:12
#9 mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) src/layout/base/PresShell.cpp:6319:5
#10 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:480:19
#11 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:412:33
#12 nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:1102:5
#13 nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2053:11
#14 nsRefreshDriver::FinishedWaitingForTransaction() src/layout/base/nsRefreshDriver.cpp:2161:5
#15 mozilla::layers::ClientLayerManager::DidComposite(unsigned long, mozilla::TimeStamp const&, mozilla::TimeStamp const&) src/gfx/layers/client/ClientLayerManager.cpp:532:32
#16 mozilla::layers::CompositorBridgeChild::RecvDidComposite(mozilla::layers::LayersId const&, unsigned long const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&) src/gfx/layers/ipc/CompositorBridgeChild.cpp:544:8
#17 mozilla::layers::PCompositorBridgeChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PCompositorBridgeChild.cpp:1402:20
#18 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2135:25
#19 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2065:17
#20 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1911:5
#21 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1944:15
#22 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1096:14
#23 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:519:10
#24 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#25 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10
#26 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3
#27 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:157:27
#28 nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:290:30
#29 XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4834:22
#30 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4979:8
#31 XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5071:21
#32 do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:231:22
#33 main src/browser/app/nsBrowserApp.cpp:304:16
#34 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#35 _start (firefox+0x423444)
Flags: in-testsuite?
Attached file prefs.js
Assignee: nobody → mikokm
Priority: -- → P2
Status: NEW → ASSIGNED
This seems to be triggering only with e10s disabled. I am currently investigating why.
The problem here is caused by flattening items for IB split frames.

The test case creates roughly this display list:
Opacity
  Filter
Opacity
  Filter
Opacity
  Filter

The first call to FLBDisplayItemIterator::GetNextEntry() flattens the first opacity, sets FLBDisplayItemIterator::mNext to filter item, and then processes the PUSH_OPACITY marker. Second call to GetNextEntry() flattens the second opacity item, and sets mNext to second filter item. The crash occurs when these two filter items are being merged (which would break the opacity marker ordering).
Comment on attachment 8970728 [details]
Bug 1454105 - Do not flatten opacity for IB splits

https://reviewboard.mozilla.org/r/239466/#review245508
Attachment #8970728 - Flags: review?(matt.woodrow) → review+
Pushed by mikokm@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/e561ff49b7cd
Do not flatten opacity for IB splits r=mattwoodrow
https://hg.mozilla.org/mozilla-central/rev/e561ff49b7cd
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Flags: in-testsuite? → in-testsuite+
No longer depends on: 1388973
You need to log in before you can comment on or make changes to this bug.