1544406 - Crash in [@ nsDisplayListBuilder::AutoBuildingDisplayList::AutoBuildingDisplayList]

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-00c69dbe-7b8e-49f8-bef1-a72690190415.

Regression across all platforms which seems to have started in 20190415094551: https://bit.ly/2Z9gXMp

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ec1f3a922d56e0a9393415872ee1d30c2f895fd7&tochange=6c9e7cba261d72303c39d9f3a9bb45b91fa1fd3e

Bug 1526972 is in that range. ni on dan

Top 10 frames of crashing thread:

0 XUL nsDisplayListBuilder::AutoBuildingDisplayList::AutoBuildingDisplayList layout/painting/nsDisplayList.cpp:10330
1 XUL nsIFrame::BuildDisplayListForStackingContext layout/generic/nsFrame.cpp:3026
2 XUL mozilla::PresShell::CreateRangePaintInfo layout/base/PresShell.cpp:4706
3 XUL mozilla::PresShell::RenderSelection layout/base/PresShell.cpp:4957
4 XUL nsBaseDragService::DrawDrag widget/nsBaseDragService.cpp:620
5 XUL nsDragServiceProxy::InvokeDragSessionImpl widget/nsDragServiceProxy.cpp:48
6 XUL nsBaseDragService::InvokeDragSession widget/nsBaseDragService.cpp:252
7 XUL nsBaseDragService::InvokeDragSessionWithSelection widget/nsBaseDragService.cpp:338
8 XUL mozilla::EventStateManager::GenerateDragGesture dom/events/EventStateManager.cpp:2023
9 XUL mozilla::EventStateManager::PreHandleEvent dom/events/EventStateManager.cpp:624

Comment 3

[Alice0775 White]

Steps

1. Start Nightly with new profile
2. Enter customize mode
3. Dragstart Search widget

Actual results
Browser crashes

Comment 4

[Alice0775 White]

Regression window;
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=587b7bc9ad81e868c672c540907843bf46658071&tochange=815543d81a1d2ab79ed4e27612dba769e4b697a8

Regressed by: Bug 1526972

Comment 5

[Julien Cristau [:jcristau]]

This is looking bad. Asking sheriffs for a backout.

Comment 6

[Darkspirit]

It's not possible to drag emails in Thunderbird Daily because of this. bp-201bdbeb-e16c-430c-8d6f-8fd880190415

Comment 7

[blinky]

Steps to reproduce:

1. Open https://hg.mozilla.org/.
2. Drag the image 'moz://a' on the right side of the page.

Actual results:
Browser crashes.

Comment 8

[Julien Cristau [:jcristau]]

Please don't undo other people's changes when you mid-air.

Comment 9

[Julien Cristau [:jcristau]]

Looks to be all "MOZ_RELEASE_ASSERT(aRecalcInvalidSubtree == nsDisplayListBuilder::RIIS_YES || aForChild == mPrevFrame || ancestor == mPrevFrame)"

Comment 11

[u480271]

It looks like all our tests don't cover this case.

Comment 12

[Takanori MATSUURA]

Though we cannot see in Crash Data section, Thunderbird Daily also crashed when I select email(s) from email list pane and drag it.
bp-ee283223-c84f-49f9-8c79-e89760190416

Comment 13

[ovidiu boca[:Ovidiu]]

I've tested this on Mac OS X 10.14, with FF Nightly 68.0a1(2019-04-15) and I was able to reproduce the issue, unfortunately I don't have the build ID, after that I've update the browser to Nightly 68.0a1(2019-04-15) Build ID: 20190415213626 and the crash is no longer reproducible.
NOTE: I also installed the Nightly build from 2019-04-15 to try to reproduce the initial crash but with no success. Please let me know if there are other information that you need from me.

Comment 14

[Liz Henry (:lizzard) (relman/hg->git project)]

Fixed by the backout in bug 1526972.

Comment 15

[Firefox Bug Husbandry Bot]

Please specify a root cause for this bug. See :tmaity for more information.