1551389 - Assertion failure: mListLink == aOther.mListLink (comparing iterators over different lists), at /builds/worker/workspace/build/src/layout/generic/nsLineBox.h:812

Status: RESOLVED FIXED

(Core :: Web Painting, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20190513215004
SourceStamp=a0403c2bfae40a8b3cebd532ce730fa824181fee

Marked s-s as a precaution.

Assertion failure: mListLink == aOther.mListLink (comparing iterators over different lists), at src/layout/generic/nsLineBox.h:824

#0 nsLineList_iterator::operator==(nsLineList_iterator) src/layout/generic/nsLineBox.h:822:5
#1 InlineBackgroundData::AreOnSameLine(nsIFrame*, nsIFrame*) src/layout/painting/nsCSSRendering.cpp:392:28
#2 InlineBackgroundData::SetFrame(nsIFrame*) src/layout/painting/nsCSSRendering.cpp:290:38
#3 InlineBackgroundData::GetContinuousRect(nsIFrame*) src/layout/painting/nsCSSRendering.cpp:105:5
#4 InlineBackgroundData::GetBorderContinuousRect(nsIFrame*, nsRect) src/layout/painting/nsCSSRendering.cpp:196:15
#5 JoinBoxesForSlice(nsIFrame*, nsRect const&, InlineBoxOrder) src/layout/painting/nsCSSRendering.cpp:552:34
#6 nsCSSRendering::BoxDecorationRectForBorder(nsIFrame*, nsRect const&, mozilla::Sides, nsStyleBorder const*) src/layout/painting/nsCSSRendering.cpp:574:16
#7 nsCSSRendering::GetShadowRect(nsRect const&, bool, nsIFrame*) src/layout/painting/nsCSSRendering.cpp:1373:15
#8 nsCSSRendering::PaintBoxShadowOuter(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&, nsRect const&, float) src/layout/painting/nsCSSRendering.cpp:1412:22
#9 nsDisplayBoxShadowOuter::Paint(nsDisplayListBuilder*, gfxContext*) src/layout/painting/nsDisplayList.cpp:5342:5
#10 mozilla::FrameLayerBuilder::PaintItems(std::vector<mozilla::AssignedDisplayItem, std::allocator<mozilla::AssignedDisplayItem> >&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float) src/layout/painting/FrameLayerBuilder.cpp:7058:20
#11 mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) src/layout/painting/FrameLayerBuilder.cpp:7218:19
#12 mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) src/gfx/layers/client/ClientPaintedLayer.cpp:159:9
#13 mozilla::layers::ClientContainerLayer::RenderLayer() src/gfx/layers/client/ClientContainerLayer.h:53:29
#14 mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/client/ClientLayerManager.cpp:318:13
#15 mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) src/gfx/layers/client/ClientLayerManager.cpp:381:3
#16 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) src/layout/painting/nsDisplayList.cpp:2878:19
#17 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3984:12
#18 mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) src/layout/base/PresShell.cpp:6142:5
#19 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:462:18
#20 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:397:22
#21 nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:1020:5
#22 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2067:11
#23 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:325:7
#24 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:342:5
#25 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:708:16
#26 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:603:9
#27 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#28 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:168:54
#29 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:4061:28
#30 mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2151:21
#31 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2078:9
#32 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1937:3
#33 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1968:13
#34 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1175:14
#35 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#36 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:110:5
#37 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#38 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#39 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#40 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:919:20
#41 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#42 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#43 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#44 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:757:34
#45 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#46 main src/browser/app/nsBrowserApp.cpp:263:18

Comment 1

[Emilio Cobos Álvarez (:emilio)]

This seems to come from the inline background painting code.

Comment 2

[Matt Woodrow (:mattwoodrow)]

Attachment: Bug 1551389 - Compare line pointers directly, since we're ok with it failing if the lines are in different lists. r?mats

Comment 3

[Matt Woodrow (:mattwoodrow)]

I don't think this needs to be s-s, it should just paint the wrong thing.

Comment 4

[Mats Palmgren (inactive)]

it should just paint the wrong thing

Does it even do that? It seems to me this it should work just fine
in a non-DEBUG build. A line can never be in two line lists at the
same time, so the GetLine() test should always be false if it's two
different line lists. The assertion is merely there as a "this is
probably not what you intended" kind of warning.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9d6897b968f6
Compare line lists as well as lines when deciding if two frames are on the same line. r=mats

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Yeah, I think the simpler way to avoid the assertion would be to stick a .get() on both sides of the comparison, i.e. it1.GetLine().get() == it2.GetLine().get().

Comment 7

[Narcis Beleuzu [:NarcisB]]

Backed out for crashtest failures on 1551389-1.html

Backout link: https://hg.mozilla.org/integration/autoland/rev/b2bd4ee26110bb05115a37fa6affd756b048ee46
Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=246513070&repo=autoland&lineNumber=80633

Comment 8

[Matt Woodrow (:mattwoodrow)]

Got backed out for unrelated assertions, so I've updated the patch with your suggestion dbaron.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/73f63a3633bd
Compare line pointers directly, since we're ok with it failing if the lines are in different lists. r=mats

Comment 10

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/73f63a3633bd

Comment 11

[Julien Cristau [:jcristau] (back April 22)]

Is this worth getting into 68? Comment 4 suggests probably not.

Comment 12

[Matt Woodrow (:mattwoodrow)]

This just fixes a debug assertion, so I don't think it's worth it.