1547986 - Crash in [@ RetainedDisplayListBuilder::PreProcessDisplayList ][@ nsDisplayList::~nsDisplayList]

Status: RESOLVED FIXED

(Core :: Web Painting, defect, P1)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-0b0daa07-3db3-48c8-9917-5cc190190429.

Top 10 frames of crashing thread:

0 libxul.so nsDisplayList::~nsDisplayList layout/painting/nsDisplayList.h:3169
1 libxul.so RetainedDisplayListBuilder::PreProcessDisplayList layout/painting/RetainedDisplayListBuilder.cpp:272
2 libxul.so RetainedDisplayListBuilder::PreProcessDisplayList layout/painting/RetainedDisplayListBuilder.cpp:227
3 libxul.so RetainedDisplayListBuilder::PreProcessDisplayList layout/painting/RetainedDisplayListBuilder.cpp:227
4 libxul.so RetainedDisplayListBuilder::PreProcessDisplayList layout/painting/RetainedDisplayListBuilder.cpp:227
5 libxul.so RetainedDisplayListBuilder::PreProcessDisplayList layout/painting/RetainedDisplayListBuilder.cpp:227
6 libxul.so RetainedDisplayListBuilder::PreProcessDisplayList layout/painting/RetainedDisplayListBuilder.cpp:227
7 libxul.so RetainedDisplayListBuilder::AttemptPartialUpdate layout/painting/RetainedDisplayListBuilder.cpp:1400
8 libxul.so nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3829
9 libxul.so mozilla::PresShell::Paint layout/base/PresShell.cpp:6078

There are 5 crashes (from 3 installations) in nightly 68 with buildid 20190429095544. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1544948.

[1] https://hg.mozilla.org/mozilla-central/rev?node=900ceaf4d39c

Comment 1

[Emilio Cobos Álvarez [:emilio]]

https://www.lightningmaps.org/ crashes after a while with this assertion.

Comment 2

[Matt Woodrow (:mattwoodrow)]

Thanks Emilio! Looks like the current signature is just the Android one, but we have similar crashes on OSX (and almost certainly all platforms).

Comment 3

[Matt Woodrow (:mattwoodrow)]

Attachment: Bug 1547986 - Don't early return in PreProcessDisplayList if we need to re-link the display list on exit. r?miko

This early return is just an optimization to prevent the DAG from becoming too complex, and if we're keeping the list linked, then we know it won't be getting more complex on the current paint.
Future paints that actually modify the list will still take this path.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/984c175f86f9
Don't early return in PreProcessDisplayList if we need to re-link the display list on exit. r=miko

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/984c175f86f9