1464749 - Assertion failure: false (Duplicate display item!), at src/layout/painting/nsDisplayList.cpp:141

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20180527130648
SourceStamp=6b9076ac236cb0f9f301bc601eac03f9ec4205df

Assertion failure: false (Duplicate display item!), at src/layout/painting/nsDisplayList.cpp:141

#0 0x7f79528dd169 in AssertUniqueItem(nsDisplayItem*) src/layout/painting/nsDisplayList.cpp:141:7
#1 0x7f7952438029 in nsDisplayPerspective* MakeDisplayItem<nsDisplayPerspective, nsIFrame*, nsIFrame*, nsDisplayList*>(nsDisplayListBuilder*, nsIFrame*&&, nsIFrame*&&, nsDisplayList*&&) src/layout/painting/nsDisplayList.h:2059:5
#2 0x7f79524342ff in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsFrame.cpp:3370:9
#3 0x7f795238b5a8 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int) src/layout/generic/nsFrame.cpp:3779:12
#4 0x7f79523ce905 in DisplayLine(nsDisplayListBuilder*, nsRect const&, nsLineList_iterator&, int, int&, nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int) src/layout/generic/nsBlockFrame.cpp:6651:13
#5 0x7f79523cd505 in nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/nsBlockFrame.cpp:6746:7
#6 0x7f79524332cd in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsFrame.cpp:3096:5
#7 0x7f795238b5a8 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int) src/layout/generic/nsFrame.cpp:3779:12
#8 0x7f79523ce905 in DisplayLine(nsDisplayListBuilder*, nsRect const&, nsLineList_iterator&, int, int&, nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int) src/layout/generic/nsBlockFrame.cpp:6651:13
#9 0x7f79523cd505 in nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/nsBlockFrame.cpp:6746:7
#10 0x7f795238bd86 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int) src/layout/generic/nsFrame.cpp:3841:14
#11 0x7f79523efadb in nsColumnSetFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/nsColumnSetFrame.cpp:1249:5
#12 0x7f79524332cd in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsFrame.cpp:3096:5
#13 0x7f795238b5a8 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int) src/layout/generic/nsFrame.cpp:3779:12
#14 0x7f79523e2eab in nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/nsCanvasFrame.cpp:561:5
#15 0x7f795238bd86 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int) src/layout/generic/nsFrame.cpp:3841:14
#16 0x7f79524be59f in mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/nsGfxScrollFrame.cpp:3615:15
#17 0x7f795238bd86 in nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, unsigned int) src/layout/generic/nsFrame.cpp:3841:14
#18 0x7f795238a296 in mozilla::ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&) src/layout/generic/ViewportFrame.cpp:66:5
#19 0x7f79524332cd in nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*) src/layout/generic/nsFrame.cpp:3096:5
#20 0x7f79522ce56c in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3721:17
#21 0x7f7952209d0f in mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) src/layout/base/PresShell.cpp:6316:5
#22 0x7f7951d6ece8 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:480:19
#23 0x7f7951d6e635 in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:412:33
#24 0x7f7951d708d8 in nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:1102:5
#25 0x7f79521abd4a in nsRefreshDriver::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2039:11
#26 0x7f79521b4cd5 in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:301:7
#27 0x7f79521b4aae in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:320:5
#28 0x7f79521b816f in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:760:5
#29 0x7f79521b70e5 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:673:35
#30 0x7f79521b6d0e in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NormalPriorityNotify() src/layout/base/nsRefreshDriver.cpp:599:9
#31 0x7f79521b78f5 in mozilla::detail::RunnableMethodImpl<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver*, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(), true, (mozilla::RunnableKind)0>::Run() src/obj-firefox/dist/include/nsThreadUtils.h:1216:13
#32 0x7f794c15abc3 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1088:14
#33 0x7f794c17daf8 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:519:10
#34 0x7f794cddbe33 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#35 0x7f794cd1d398 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10
#36 0x7f794cd1d21c in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3
#37 0x7f7951de5faa in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:157:27
#38 0x7f7954ec4480 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:893:22
#39 0x7f794cddca55 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:269:9
#40 0x7f794cd1d398 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:326:10
#41 0x7f794cd1d21c in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299:3
#42 0x7f7954ec3bce in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:719:34
#43 0x4f3606 in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30
#44 0x4f388e in main src/browser/app/nsBrowserApp.cpp:282:18
#45 0x7f796be3382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#46 0x423434 in _start (firefox+0x423434)

Comment 1

[Matt Woodrow (:mattwoodrow)]

Sigh, this code is wrong: https://searchfox.org/mozilla-central/source/layout/generic/nsFrame.cpp#3372

We're finding the containing block, and then jumping to the primary frame for that element.

This testcase has a block split across columns, so we choose the frame in the first column. One perspective in each column, both referring to the frame in the first == duplicate.

This will be fixed by bug 1464737.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Meant to ask a question there - is there a user impact here which requires us to track for 61?

Comment 3

[Matt Woodrow (:mattwoodrow)]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #2)
> Meant to ask a question there - is there a user impact here which requires
> us to track for 61?

User impact, yes. Multiple display items for the same frame/key combo will share layer assignments/invalidation state in FLB, and we'll only end up building one Layer and overwriting the child list when we process the second item.

I don't think we need to track for 61 really, since this is an existing bug. Would be nice to get it fixed, but I'd want bug 1464737 to have a bit of bake time on Nightly first.

Comment 4

[Matt Woodrow (:mattwoodrow)]

Oh, I guess there is a new impact, in 61 dev edition, this is now a crash instead of broken rendering (thanks to the assert).

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Calling this fix-optional for 61 then. We should probably include this testcase with the patch for bug 1464737 as a crashtest too.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Fixed by bug 1464737.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

We're not going to uplift bug 1464737.