Open Bug 1553255 Opened 11 months ago Updated 11 months ago

Assertion failure: !mSize.IsEmpty(), at /builds/worker/workspace/build/src/layout/painting/FrameLayerBuilder.cpp:1938

Categories

(Core :: Web Painting, defect, P3)

defect

Tracking

()

Tracking Status
firefox69 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(2 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev b74e5737da64.

Assertion failure: !mSize.IsEmpty(), at /builds/worker/workspace/build/src/layout/painting/FrameLayerBuilder.cpp:1938

rax = 0x0000564407e07e40   rdx = 0x0000000000000000
rcx = 0x00007fac3b9ca1e8   rbx = 0x00007ffe32771018
rsi = 0x00007fac468798b0   rdi = 0x00007fac46878680
rbp = 0x00007ffe32770690   rsp = 0x00007ffe32770690
r8 = 0x00007fac468798b0    r9 = 0x00007fac479e3740
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007fac11dfd700   r13 = 0x00007ffe32770740
r14 = 0x00007ffe327707a8   r15 = 0x00007fac11c6f108
rip = 0x00007fac38317c18
OS|Linux|0.0.0 Linux 4.18.0-17-generic #18~18.04.1-Ubuntu SMP Fri Mar 15 15:27:12 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::MaskImageData::MaskImageData(mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::LayerManager*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1939|0x2e
0|1|libxul.so|mozilla::ContainerState::CreateMaskLayer(mozilla::layers::Layer*, mozilla::DisplayItemClip const&, mozilla::Maybe<unsigned long> const&)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|7414|0x5
0|2|libxul.so|mozilla::ContainerState::SetupMaskLayer(mozilla::layers::Layer*, mozilla::DisplayItemClip const&)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|7307|0x23
0|3|libxul.so|mozilla::ContainerState::FinishPaintedLayerData<mozilla::PaintedLayerDataNode::PopAllPaintedLayerData()::<lambda()> >|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3525|0xf
0|4|libxul.so|mozilla::PaintedLayerDataNode::PopAllPaintedLayerData()|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3108|0xd
0|5|libxul.so|mozilla::PaintedLayerDataNode::Finish(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3075|0x8
0|6|libxul.so|mozilla::PaintedLayerDataNode::FinishAllChildren(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3066|0x1b
0|7|libxul.so|mozilla::PaintedLayerDataNode::Finish(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3073|0x7
0|8|libxul.so|mozilla::PaintedLayerDataNode::FinishAllChildren(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3066|0x1b
0|9|libxul.so|mozilla::PaintedLayerDataNode::Finish(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3073|0x7
0|10|libxul.so|mozilla::PaintedLayerDataNode::FinishAllChildren(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3066|0x1b
0|11|libxul.so|mozilla::PaintedLayerDataNode::Finish(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3073|0x7
0|12|libxul.so|mozilla::PaintedLayerDataNode::FinishAllChildren(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3066|0x1b
0|13|libxul.so|mozilla::PaintedLayerDataNode::Finish(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3073|0x7
0|14|libxul.so|mozilla::PaintedLayerDataNode::FinishAllChildren(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3066|0x1b
0|15|libxul.so|mozilla::PaintedLayerDataNode::Finish(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3073|0x7
0|16|libxul.so|mozilla::PaintedLayerDataNode::FinishAllChildren(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3066|0x1b
0|17|libxul.so|mozilla::PaintedLayerDataNode::Finish(bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3073|0x7
0|18|libxul.so|mozilla::PaintedLayerDataTree::Finish()|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3125|0x13
0|19|libxul.so|mozilla::ContainerState::Finish(unsigned int*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, nsDisplayList*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|5890|0x5
0|20|libxul.so|mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6285|0x11
0|21|libxul.so|nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|8375|0x3a
0|22|libxul.so|mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|4795|0x2d
0|23|libxul.so|mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6278|0xf
0|24|libxul.so|nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|8375|0x3a
0|25|libxul.so|mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|4795|0x2d
0|26|libxul.so|mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6278|0xf
0|27|libxul.so|nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|8375|0x3a
0|28|libxul.so|mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|4795|0x2d
0|29|libxul.so|mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6278|0xf
0|30|libxul.so|nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|8375|0x3a
0|31|libxul.so|mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|4795|0x2d
0|32|libxul.so|mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6278|0xf
0|33|libxul.so|nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|8375|0x3a
0|34|libxul.so|mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|4795|0x2d
0|35|libxul.so|mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6278|0xf
0|36|libxul.so|nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6599|0x39
0|37|libxul.so|mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|4795|0x2d
0|38|libxul.so|mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6278|0xf
0|39|libxul.so|nsDisplayList::BuildLayers(nsDisplayListBuilder*, mozilla::layers::LayerManager*, unsigned int, bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2649|0x38
0|40|libxul.so|nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2865|0x27
0|41|libxul.so||||0x31c8b34
0|42|ld-2.27.so||||0x13800
0|43|libxul.so|NS_LogRelease|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsTraceRefcnt.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|964|0x5
Flags: in-testsuite?
Priority: -- → P3

Thank you for the report Jason.

I did not manage to reproduce this locally on Ubuntu, does this require special preferences?

Flags: needinfo?(jkratzer)
Attached file prefs-default-e10s.js

Miko, I haven't isolated which pref but the testcase reproduces reliably using the attached prefs.js.

Flags: needinfo?(jkratzer)

layout.css.individual-transform.enabled=true would be required for this testcase (and is in the prefs.js).

You need to log in before you can comment on or make changes to this bug.