1476971 - Crash in bool RetainedDisplayListBuilder::MergeDisplayLists

Status: RESOLVED DUPLICATE of bug 1466010

(Core :: Web Painting, defect, P2)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-618cb27c-cc14-42df-a5fb-38d930180718.
=============================================================

Seen while looking at nightly crash data - these crashes started using 20180717100216: https://bit.ly/2O2TOWn.

Most of them have Moz Crash Reason similar to "Item found was in the wrong list! type 53 (outer type was 37 at depth 3, now is 68) "

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2ed1506d1dc7db3d70a3feed95f1456bce05bbee&tochange=afa310dc89beeb4b7a9564d2c89ff32906f427ad

Bug 1471381 landed in that timeframe. NI on :dthayer

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:62
1 xul.dll bool RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:569
2 xul.dll bool RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:563
3 xul.dll bool RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:563
4 xul.dll bool RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:563
5 xul.dll bool RetainedDisplayListBuilder::MergeDisplayLists layout/painting/RetainedDisplayListBuilder.cpp:563
6 xul.dll RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1248
7 xul.dll nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3694
8 xul.dll mozilla::PresShell::Paint layout/base/PresShell.cpp:6320
9 xul.dll nsViewManager::ProcessPendingUpdatesForView view/nsViewManager.cpp:412

=============================================================

Comment 1

[Alex Thayer [:alexical] (she/her)]

Matt, can you think of a way that the changes from bug 1471381 could have brought this about? I'm afraid I'm a bit out of my depth here.

Comment 2

[Matt Woodrow (:mattwoodrow)]

I think this is just a duplicate of bug 1466010, with a slightly different signature (the moz_crash_reason is the same though).

Bug 1475660 in that range is probably the cause of the change to inlining.

Comment 3

[David Durst [:ddurst]]

Marcia's able to reproduce https://bugzilla.mozilla.org/show_bug.cgi?id=1466010#c31 -- should we close this bug and focus there?

Comment 4

[Pascal Chevrel:pascalc]

No crashes in the last weeks with this signature, marking as fix-optional for 63. Marcia do you want to dupe it to bug 1466010?

Comment 5

[Marcia Knous [:marcia]]

(In reply to Pascal Chevrel:pascalc from comment #4)
> No crashes in the last weeks with this signature, marking as fix-optional
> for 63. Marcia do you want to dupe it to bug 1466010?

Yes, I think duping it makes sense.