Closed Bug 1551389 Opened 11 months ago Closed 10 months ago

Assertion failure: mListLink == aOther.mListLink (comparing iterators over different lists), at /builds/worker/workspace/build/src/layout/generic/nsLineBox.h:812

Categories

(Core :: Web Painting, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla69
Tracking Status
firefox-esr60 --- wontfix
firefox67 --- wontfix
firefox68 --- wontfix
firefox69 --- fixed

People

(Reporter: tsmith, Assigned: mattwoodrow)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file testcase.html

Reduced with m-c:
BuildID=20190513215004
SourceStamp=a0403c2bfae40a8b3cebd532ce730fa824181fee

Marked s-s as a precaution.

Assertion failure: mListLink == aOther.mListLink (comparing iterators over different lists), at src/layout/generic/nsLineBox.h:824

#0 nsLineList_iterator::operator==(nsLineList_iterator) src/layout/generic/nsLineBox.h:822:5
#1 InlineBackgroundData::AreOnSameLine(nsIFrame*, nsIFrame*) src/layout/painting/nsCSSRendering.cpp:392:28
#2 InlineBackgroundData::SetFrame(nsIFrame*) src/layout/painting/nsCSSRendering.cpp:290:38
#3 InlineBackgroundData::GetContinuousRect(nsIFrame*) src/layout/painting/nsCSSRendering.cpp:105:5
#4 InlineBackgroundData::GetBorderContinuousRect(nsIFrame*, nsRect) src/layout/painting/nsCSSRendering.cpp:196:15
#5 JoinBoxesForSlice(nsIFrame*, nsRect const&, InlineBoxOrder) src/layout/painting/nsCSSRendering.cpp:552:34
#6 nsCSSRendering::BoxDecorationRectForBorder(nsIFrame*, nsRect const&, mozilla::Sides, nsStyleBorder const*) src/layout/painting/nsCSSRendering.cpp:574:16
#7 nsCSSRendering::GetShadowRect(nsRect const&, bool, nsIFrame*) src/layout/painting/nsCSSRendering.cpp:1373:15
#8 nsCSSRendering::PaintBoxShadowOuter(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&, nsRect const&, float) src/layout/painting/nsCSSRendering.cpp:1412:22
#9 nsDisplayBoxShadowOuter::Paint(nsDisplayListBuilder*, gfxContext*) src/layout/painting/nsDisplayList.cpp:5342:5
#10 mozilla::FrameLayerBuilder::PaintItems(std::vector<mozilla::AssignedDisplayItem, std::allocator<mozilla::AssignedDisplayItem> >&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float) src/layout/painting/FrameLayerBuilder.cpp:7058:20
#11 mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) src/layout/painting/FrameLayerBuilder.cpp:7218:19
#12 mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) src/gfx/layers/client/ClientPaintedLayer.cpp:159:9
#13 mozilla::layers::ClientContainerLayer::RenderLayer() src/gfx/layers/client/ClientContainerLayer.h:53:29
#14 mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/client/ClientLayerManager.cpp:318:13
#15 mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/client/ClientLayerManager.cpp:381:3
#16 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) src/layout/painting/nsDisplayList.cpp:2878:19
#17 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3984:12
#18 mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) src/layout/base/PresShell.cpp:6142:5
#19 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:462:18
#20 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:397:22
#21 nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:1020:5
#22 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2067:11
#23 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:325:7
#24 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:342:5
#25 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:708:16
#26 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:603:9
#27 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#28 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:168:54
#29 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:4061:28
#30 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2151:21
#31 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2078:9
#32 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1937:3
#33 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1968:13
#34 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1175:14
#35 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#36 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:110:5
#37 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#38 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#39 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#40 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:919:20
#41 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#42 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#43 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#44 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:757:34
#45 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#46 main src/browser/app/nsBrowserApp.cpp:263:18
Flags: in-testsuite?

This seems to come from the inline background painting code.

Component: Layout: Block and Inline → Web Painting
Assignee: nobody → matt.woodrow

I don't think this needs to be s-s, it should just paint the wrong thing.

Group: layout-core-security

it should just paint the wrong thing

Does it even do that? It seems to me this it should work just fine
in a non-DEBUG build. A line can never be in two line lists at the
same time, so the GetLine() test should always be false if it's two
different line lists. The assertion is merely there as a "this is
probably not what you intended" kind of warning.

Priority: -- → P2
Pushed by mwoodrow@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/9d6897b968f6
Compare line lists as well as lines when deciding if two frames are on the same line. r=mats

Yeah, I think the simpler way to avoid the assertion would be to stick a .get() on both sides of the comparison, i.e. it1.GetLine().get() == it2.GetLine().get().

Flags: needinfo?(matt.woodrow)

Got backed out for unrelated assertions, so I've updated the patch with your suggestion dbaron.

Flags: needinfo?(matt.woodrow)
Attachment #9064907 - Attachment description: Bug 1551389 - Compare line lists as well as lines when deciding if two frames are on the same line. r?mats → Bug 1551389 - Compare line pointers directly, since we're ok with it failing if the lines are in different lists. r?mats
Pushed by mwoodrow@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/73f63a3633bd
Compare line pointers directly, since we're ok with it failing if the lines are in different lists. r=mats
Status: NEW → RESOLVED
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla69

Is this worth getting into 68? Comment 4 suggests probably not.

Flags: needinfo?(matt.woodrow)
Flags: in-testsuite?
Flags: in-testsuite+

This just fixes a debug assertion, so I don't think it's worth it.

Flags: needinfo?(matt.woodrow)
You need to log in before you can comment on or make changes to this bug.