1497059 - Crash in mozilla::gfx::DrawEventRecorderMemory::FlushItem

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P2, critical)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-a9287712-ca16-471f-a51a-098a70181007.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::gfx::DrawEventRecorderMemory::FlushItem gfx/2d/DrawEventRecorder.cpp:130
1 xul.dll struct already_AddRefed<mozilla::layers::WebRenderFallbackData> mozilla::layers::WebRenderCommandBuilder::GenerateFallbackData gfx/layers/wr/WebRenderCommandBuilder.cpp:1917
2 xul.dll mozilla::layers::WebRenderCommandBuilder::PushItemAsImage gfx/layers/wr/WebRenderCommandBuilder.cpp:2024
3 xul.dll mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList gfx/layers/wr/WebRenderCommandBuilder.cpp:1447
4 xul.dll nsDisplayTransform::CreateWebRenderCommands layout/painting/nsDisplayList.cpp:8769
5 xul.dll mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList gfx/layers/wr/WebRenderCommandBuilder.cpp:1443
6 xul.dll nsDisplayOpacity::CreateWebRenderCommands layout/painting/nsDisplayList.cpp:6678
7 xul.dll mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList gfx/layers/wr/WebRenderCommandBuilder.cpp:1443
8 xul.dll nsDisplayTransform::CreateWebRenderCommands layout/painting/nsDisplayList.cpp:8769
9 xul.dll mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList gfx/layers/wr/WebRenderCommandBuilder.cpp:1443

=============================================================

There are 6 crashes (from 5 installations) in nightly 64 with buildid 20181006220113. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1444185.

[1] https://hg.mozilla.org/mozilla-central/rev?node=86cc3618811a

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bail out on empty dtRect.

I thought it was going to be trivial to add a test-case for this with a scale
transform and such, but I haven't been able to.

This restores the wallpaper that there was before my change.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8995622893ec
Bail out on empty dtRect. r=mstange

Comment 3

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/8995622893ec