1645141 - Assertion failure: !aParent || result->mParentAGR == aParent, at /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:741

Status: RESOLVED DUPLICATE of bug 1494676

(Core :: Web Painting, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 10ad7868f3ca (built with --enable-debug).

Assertion failure: !aParent || result->mParentAGR == aParent, at /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:741

rax = 0x00007fdbe293e7b8   rdx = 0x0000000000000000
rcx = 0x00005653cf269a58   rbx = 0x00005653d080ced0
rsi = 0x00007fdbf38998b0   rdi = 0x00007fdbf3898680
rbp = 0x00007ffd28fd1e00   rsp = 0x00007ffd28fd1db0
r8 = 0x00007fdbf38998b0    r9 = 0x00007fdbf49ff780
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x0000000000000000   r13 = 0x00005653d080ced0
r14 = 0x00005653d067c5d0   r15 = 0x00005653d07c8938
rip = 0x00007fdbdd45c446
OS|Linux|0.0.0 Linux 5.3.0-51-generic #44~18.04.2-Ubuntu SMP Thu Apr 23 14:27:18 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsDisplayListBuilder::WrapAGRForFrame(nsIFrame*, bool, AnimatedGeometryRoot*)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|741|0x29
0|1|libxul.so|nsDisplayListBuilder::AutoBuildingDisplayList::AutoBuildingDisplayList(nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsRect const&, bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|10135|0x16
0|2|libxul.so|nsIFrame::BuildDisplayListForSimpleChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4044|0xe
0|3|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4146|0xe
0|4|libxul.so|mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|3732|0x5
0|5|libxul.so|nsIFrame::BuildDisplayListForSimpleChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4056|0x12
0|6|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4146|0xe
0|7|libxul.so|DisplayLine(nsDisplayListBuilder*, nsLineList_iterator&, bool, nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|6845|0x2e
0|8|libxul.so|nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|7002|0x40
0|9|libxul.so|nsIFrame::BuildDisplayListForSimpleChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4056|0x12
0|10|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4146|0xe
0|11|libxul.so|mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|3732|0x5
0|12|libxul.so|nsIFrame::BuildDisplayListForSimpleChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4056|0x12
0|13|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4146|0xe
0|14|libxul.so|DisplayLine(nsDisplayListBuilder*, nsLineList_iterator&, bool, nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|6845|0x2e
0|15|libxul.so|nsBlockFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsBlockFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|7002|0x40
0|16|libxul.so|nsIFrame::BuildDisplayListForSimpleChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4056|0x12
0|17|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4146|0xe
0|18|libxul.so|nsCanvasFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsCanvasFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|615|0x14
0|19|libxul.so|nsIFrame::BuildDisplayListForSimpleChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4056|0x12
0|20|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4146|0xe
0|21|libxul.so|mozilla::ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsGfxScrollFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|3732|0x5
0|22|libxul.so|nsIFrame::BuildDisplayListForSimpleChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4056|0x12
0|23|libxul.so|nsIFrame::BuildDisplayListForChild(nsDisplayListBuilder*, nsIFrame*, nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4146|0xe
0|24|libxul.so|mozilla::ViewportFrame::BuildDisplayList(nsDisplayListBuilder*, nsDisplayListSet const&)|hg:hg.mozilla.org/mozilla-central:layout/generic/ViewportFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|62|0x1d
0|25|libxul.so|nsIFrame::BuildDisplayListForStackingContext(nsDisplayListBuilder*, nsDisplayList*, bool*)|hg:hg.mozilla.org/mozilla-central:layout/generic/nsFrame.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|3530|0x1a
0|26|libxul.so|RetainedDisplayListBuilder::AttemptPartialUpdate(unsigned int, mozilla::DisplayListChecker*)|hg:hg.mozilla.org/mozilla-central:layout/painting/RetainedDisplayListBuilder.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|1461|0x15
0|27|libxul.so|nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|4007|0x8
0|28|libxul.so|mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|6347|0x1d
0|29|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|640|0xb
0|30|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|640|0xb
0|31|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|640|0xb
0|32|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|640|0xb
0|33|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/prtpd.c:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|205|0x5
0|34|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|636|0x3
0|35|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/prtpd.c:10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd|205|0x5

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200611093454-10ad7868f3ca.
Failed to bisect testcase (Start build crashes!):
> Start: 4a63f0a3a1f26e2a377ffbd477ba050e16577445 (20190613035031)
> End: 10ad7868f3ca27cb90db9bd1d392ff4d7852a0cd (20200611093454)
> BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 2

[Intermittent Failures Robot]

1 failures in 3966 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 1

Platform and build breakdown:

• windows7-32-mingwclang: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1645141&startday=2021-02-01&endday=2021-02-07&tree=all

Comment 3

[Intermittent Failures Robot]

1 failures in 4327 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• linux1804-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1645141&startday=2021-02-22&endday=2021-02-28&tree=all

Comment 4

[Intermittent Failures Robot]

3 failures in 4622 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 3

Platform and build breakdown:

• linux1804-64: 3
  • debug: 3

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1645141&startday=2021-03-08&endday=2021-03-14&tree=all

Comment 5

[Intermittent Failures Robot]

3 failures in 3967 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 3

Platform and build breakdown:

• linux1804-64-qr: 3
  • debug: 3

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1645141&startday=2021-03-22&endday=2021-03-28&tree=all

Comment 6

[Miko Mynttinen]

Couldn't reproduce with the latest Nightly on Mac/Win/Linux.

Comment 7

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

My apologies. It looks like the fission related prefs need to be enabled in order to reproduce this issue. I've updated the testcase to include the prefs needed to repro.

Comment 8

[Intermittent Failures Robot]

1 failures in 3125 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• linux1804-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1645141&startday=2021-03-29&endday=2021-04-04&tree=all

Comment 9

[Intermittent Failures Robot]

2 failures in 3854 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 2

Platform and build breakdown:

• linux1804-64-qr: 2
  • debug: 2

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1645141&startday=2021-04-05&endday=2021-04-11&tree=all

Comment 10

[Intermittent Failures Robot]

1 failures in 3065 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 1

Platform and build breakdown:

• linux1804-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1645141&startday=2021-05-31&endday=2021-06-06&tree=all

Comment 11

[Intermittent Failures Robot]

1 failures in 2888 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 1

Platform and build breakdown:

• linux1804-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1645141&startday=2021-06-14&endday=2021-06-20&tree=all

Comment 12

[Jason Kratzer [:jkratzer]]

Bugmon Analysis
The bug appears to have been fixed in the following build range:

Start: f092d76bde6ed523386f39c7ef340be72e06a0ff (20210612234503)
End: f092d76bde6ed523386f39c7ef340be72e06a0ff (20210613092033)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=f092d76bde6ed523386f39c7ef340be72e06a0ff&tochange=f092d76bde6ed523386f39c7ef340be72e06a0ff
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 13

[Timothy Nikkel (:tnikkel)]

Empty range, doesn't make sense.

Comment 14

[Miko Mynttinen]

I think the bot gets confused because there should be two bugs that fix this, bug 1494676 because the testcase has will-change scroll, and bug 1697639 that does not cache intermediate AGR nodes.