1714944 - Crash in [@ nsDisplayTransform::Collect3DTransformLeaves]

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/e425f697-ba8f-4a4a-84ed-5e6b90210605

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(item->GetType() == DisplayItemType::TYPE_TRANSFORM)

Top 10 frames of crashing thread:

0 xul.dll nsDisplayTransform::Collect3DTransformLeaves layout/painting/nsDisplayList.cpp:8297
1 xul.dll nsDisplayTransform::CollectSorted3DTransformLeaves layout/painting/nsDisplayList.cpp:8324
2 xul.dll nsDisplayTransform::Paint layout/painting/nsDisplayList.cpp:8371
3 xul.dll nsDisplayTransform::Paint layout/painting/nsDisplayList.cpp:8363
4 xul.dll nsDisplayList::Paint layout/painting/nsDisplayList.cpp:2453
5 xul.dll nsDisplayTransform::Paint layout/painting/nsDisplayList.cpp:8394
6 xul.dll nsDisplayTransform::Paint layout/painting/nsDisplayList.cpp:8363
7 xul.dll nsDisplayList::Paint layout/painting/nsDisplayList.cpp:2453
8 xul.dll nsDisplayList::PaintRoot layout/painting/nsDisplayList.cpp:2496
9 xul.dll static nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3492

This crash seems to have been introduced by bug 1540737. Matt can you have a look please?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1540737

Comment 2

[Matt Woodrow (:mattwoodrow)]

Attachment: Bug 1714944 - Flatten away wrapper items while collecting 3D transform leaves. r?miko

Comment 3

[Matt Woodrow (:mattwoodrow)]

I haven't been able to reproduce this using the URLs from crash reports.

The attached patch fixes the most likely cause, and changes the behaviour to log more info for nightly/beta and not crash in release.

Comment 4

[Marco Castelluccio [:marco]]

:miko, can you review the patch?

Comment 5

[Miko Mynttinen]

(In reply to Marco Castelluccio [:marco] from comment #4)

:miko, can you review the patch?

Sorry for the delay, I had completely missed this. Review done.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/239fe77a8037
Flatten away wrapper items while collecting 3D transform leaves. r=miko

Comment 7

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/239fe77a8037

Comment 8

[Julien Cristau [:jcristau] (back August 18)]

Is this worth uplifting to beta? Today (90.0b12) is the last build before the release candidate.

Comment 9

[Matt Woodrow (:mattwoodrow)]

Apologies, didn't see this before I went away. This seems rare, so should be ok to ride the trains.