1686834 - Crash in [@ mozilla::layers::NativeLayerCA::NextSurface] MOZ_RELEASE_ASSERT(!mSize.IsEmpty()) (NextSurface invalid mSize.)

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Andrew McCreight [:mccr8]]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/0575e3da-c9aa-4e44-9b2b-a345f0210114

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(!mSize.IsEmpty()) (NextSurface invalid mSize.)

Top 10 frames of crashing thread:

0 XUL mozilla::layers::NativeLayerCA::NextSurface gfx/layers/NativeLayerCA.mm:621
1 XUL mozilla::layers::NativeLayerCA::NextSurfaceAsDrawTarget gfx/layers/NativeLayerCA.mm:674
2 XUL nsChildView::PaintWindowInContentLayer widget/cocoa/nsChildView.mm:1340
3 XUL -[ChildView updateRootCALayer] widget/cocoa/nsChildView.mm:2560
4 AppKit AppKit@0x11a49b 
5 AppKit AppKit@0x2b7c8 
6 AppKit AppKit@0x28d01e 
7 AppKit AppKit@0x6a1a0 
8 AppKit AppKit@0x119e1d 
9 QuartzCore QuartzCore@0x24863 

It looks like this is a "regression" from bug 1685046, but presumably this is just an assertion getting moved around based on the name of the patch there.

Comment 1

[Andrew McCreight [:mccr8]]

Brad, this might be of interest to you.

Comment 2

[Markus Stange [:mstange]]

Yeah, I think nsChildView::PaintWindowInContentLayer() can sometimes be called on popup windows (menus or tooltips) that haven't been fully initialized yet and still have a zero size.

Comment 3

[Brad Werth [:bradwerth]]

Attachment: Bug 1686834: Increase the specificity of a release assert in NextSurfaceAsFramebuffer.

Some callers of NextSurface can tolerate a false return value. This moves the
release assert one level lower (more specific) towards
RenderCompositorNativeOGL::Bind, which can't handle a missing surface.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b5cf099da28f
Increase the specificity of a release assert in NextSurfaceAsFramebuffer. r=jrmuizel

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/b5cf099da28f

Comment 6

[Markus Stange [:mstange]]

Here's a crash report which returned false because of 0x0. The stack shows that WR is enabled but the OS compositor is disabled.
https://crash-stats.mozilla.org/report/index/5ed2bbce-cc28-4552-bf32-dab2b0210214