1660039 - Hit MOZ_CRASH(Item found was in the wrong list! type 587 (outer type was 0 at depth 0, now is 2)) at src/layout/painting/nsDisplayList.h:2364

Status: RESOLVED WORKSFORME

(Core :: Web Painting, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Hit MOZ_CRASH(Item found was in the wrong list! type 587 (outer type was 0 at depth 0, now is 2)) at src/layout/painting/nsDisplayList.h:2364

#0 0x7f30d30019a9 in MOZ_Crash(char const*, int, char const*) src/objdir-ff-debug/dist/include/mozilla/Assertions.h:254:3
#1 0x7f30d30019a9 in nsDisplayItemBase::GetOldListIndex(nsDisplayList*, unsigned int, Index<OldListUnits>*) src/layout/painting/nsDisplayList.h:2361:7
#2 0x7f30d3000d0b in MergeState::HasMatchingItemInOldList(nsDisplayItem*, Index<OldListUnits>*) src/layout/painting/RetainedDisplayListBuilder.cpp:628:16
#3 0x7f30d2fe5e66 in MergeState::ProcessItemFromNewList(nsDisplayItem*, mozilla::Maybe<Index<MergedListUnits> > const&) src/layout/painting/RetainedDisplayListBuilder.cpp:450:9
#4 0x7f30d2f776e5 in RetainedDisplayListBuilder::MergeDisplayLists(nsDisplayList*, RetainedDisplayList*, RetainedDisplayList*, mozilla::Maybe<mozilla::ActiveScrolledRoot const*>&, nsDisplayItem*) src/layout/painting/RetainedDisplayListBuilder.cpp:838:31
#5 0x7f30d3000f90 in MergeState::MergeChildLists(nsDisplayItem*, nsDisplayItem*, nsDisplayItem*) src/layout/painting/RetainedDisplayListBuilder.cpp:515:37
#6 0x7f30d2fe61cb in MergeState::ProcessItemFromNewList(nsDisplayItem*, mozilla::Maybe<Index<MergedListUnits> > const&) src/layout/painting/RetainedDisplayListBuilder.cpp:484:9
#7 0x7f30d2f776e5 in RetainedDisplayListBuilder::MergeDisplayLists(nsDisplayList*, RetainedDisplayList*, RetainedDisplayList*, mozilla::Maybe<mozilla::ActiveScrolledRoot const*>&, nsDisplayItem*) src/layout/painting/RetainedDisplayListBuilder.cpp:838:31
#8 0x7f30d2f79617 in RetainedDisplayListBuilder::AttemptPartialUpdate(unsigned int, mozilla::DisplayListChecker*) src/layout/painting/RetainedDisplayListBuilder.cpp:1498:7
#9 0x7f30d2a920a8 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:4210:40
#10 0x7f30d29b96e4 in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) src/layout/base/PresShell.cpp:6371:5
#11 0x7f30d24f5f9e in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:460:18
#12 0x7f30d24f5af0 in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:395:22
#13 0x7f30d24f6fd1 in nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:1018:5
#14 0x7f30d2964aef in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2280:11
#15 0x7f30d2970331 in mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:373:13
#16 0x7f30d2970153 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:352:7
#17 0x7f30d296ff95 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:367:5
#18 0x7f30d297b131 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:819:5
#19 0x7f30d297a55b in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:737:16
#20 0x7f30d2979e1a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() src/layout/base/nsRefreshDriver.cpp:639:7
#21 0x7f30d296d6f9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() src/layout/base/nsRefreshDriver.cpp:538:20
#22 0x7f30cb048bae in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:242:16
#23 0x7f30cb03c410 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:512:26
#24 0x7f30cb03ae09 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:371:15
#25 0x7f30cb03b091 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:168:36
#26 0x7f30cb03dbba in mozilla::TaskController::InitializeInternal()::$_4::operator()() const src/xpcom/threads/TaskController.cpp:83:37
#27 0x7f30cb03db2d in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run() src/objdir-ff-debug/dist/include/nsThreadUtils.h:577:5
#28 0x7f30cb06d84c in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1242:14
#29 0x7f30cb073946 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:513:10
#30 0x7f30cc1a8d2e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
#31 0x7f30cc1aa5f0 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:270:30
#32 0x7f30cc03d716 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#33 0x7f30cc03d694 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:327:3
#34 0x7f30cc03d652 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#35 0x7f30d256e9a0 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#36 0x7f30d575ffc6 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:913:20
#37 0x7f30cc1aa369 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:237:9
#38 0x7f30cc03d716 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#39 0x7f30cc03d694 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:327:3
#40 0x7f30cc03d652 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#41 0x7f30d575f5f9 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:744:34
#42 0x7f30d576ea06 in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/Bootstrap.cpp:67:12
#43 0x555ac90dd1a7 in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#44 0x555ac90dd3b5 in main src/browser/app/nsBrowserApp.cpp:303:18

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/bQimT9_urv4wckLs5zYOKw/index.html

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Unable to reproduce bug using the following builds:
> mozilla-central 20200819212829-b0888d07df69
> mozilla-central 20200819100116-157db696462d
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:mattwoodrow, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Miko Mynttinen]

(In reply to Jason Kratzer [:jkratzer] from comment #2)

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20200819212829-b0888d07df69
mozilla-central 20200819100116-157db696462d
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

I could not reproduce this bug locally. Does this comment mean that bugmon is not able reproduce this either anymore?

Comment 5

[Jason Kratzer [:jkratzer]]

Miko, I'm not quite sure why Bugmon was unable to reproduce it as I could locally. I'll remove the status flag to trigger it again.

Comment 6

[Jason Kratzer [:jkratzer]]

Attachment: prefs.js

Miko, could you try using these prefs?

Comment 7

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Comment 8

[Timothy Nikkel (:tnikkel)]

Are you able to reproduce this anymore?

I just tried and failed.

Comment 9

[Tyson Smith [:tsmith]]

The attached test case no longer triggers the issue. The fuzzers are reporting a similar assertion: Hit MOZ_CRASH(Item found was in the wrong list! type 281 (outer type was 263 at depth 2, now is 2)) at /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.h:2210

Should I attach a reduced test case here or open a new issue?

Comment 10

[Timothy Nikkel (:tnikkel)]

Let's open a new issue.

Comment 11

[Tyson Smith [:tsmith]]

I've opened bug 1870380 and bug 1870415. Should we close this?

Comment 12

[Timothy Nikkel (:tnikkel)]

Thanks for filing those.

Since these testcases no longer reproduce let's close this.