Closed Bug 1770063 Opened 2 years ago Closed 2 years ago

Assertion failure: !mStyle (Shouldn't get to this code path on the root), at src/layout/painting/nsDisplayList.cpp:8393

Categories

(Core :: Web Painting, defect, P3)

Product:
Core
Component:
Web Painting
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
103 Branch
Tracking Flags:
Tracking Status
firefox-esr91 --- unaffected
firefox-esr102 --- disabled
firefox101 --- unaffected
firefox102 --- disabled
firefox103 --- verified

People

(Reporter: tsmith, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files)

testcase.html
117 bytes, text/html
Details
Bug 1770063 - Prevent fallback backdrop filters on root. r=#gfx-reviewers
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Found while fuzzing m-c 20220515-338c1afa1635 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !mStyle (Shouldn't get to this code path on the root), at src/layout/painting/nsDisplayList.cpp:8393

#0 0x7fe6c1894e06 in mozilla::nsDisplayFilters::PaintWithContentsPaintCallback(mozilla::nsDisplayListBuilder*, gfxContext*, std::function<void (gfxContext*)> const&) src/layout/painting/nsDisplayList.cpp:8393:3
#1 0x7fe6c1894b13 in mozilla::nsDisplayFilters::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) src/layout/painting/nsDisplayList.cpp:8368:3
#2 0x7fe6c18498e7 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) src/layout/painting/nsDisplayList.cpp:2186:11
#3 0x7fe6bd7cb72b in mozilla::layers::PaintItemByDrawTarget(mozilla::nsDisplayItem*, mozilla::gfx::DrawTarget*, mozilla::gfx::PointTyped<mozilla::LayoutDevicePixel, float> const&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::nsDisplayListBuilder*, mozilla::gfx::SizeTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::Maybe<mozilla::gfx::DeviceColor>&) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:2312:38
#4 0x7fe6bd7ca822 in mozilla::layers::WebRenderCommandBuilder::GenerateFallbackData(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*, mozilla::gfx::RectTyped<mozilla::LayoutDevicePixel, float>&) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:2575:7
#5 0x7fe6bd7c3f33 in mozilla::layers::WebRenderCommandBuilder::PushItemAsImage(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:2862:48
#6 0x7fe6bd7c2709 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:2086:7
#7 0x7fe6c1894212 in CreateWebRenderCommandsNewClipListOption src/layout/painting/nsDisplayList.cpp:4654:30
#8 0x7fe6c1894212 in CreateWebRenderCommands src/layout/painting/nsDisplayList.h:4941:12
#9 0x7fe6c1894212 in mozilla::nsDisplayBackdropRootContainer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) src/layout/painting/nsDisplayList.cpp:8294:22
#10 0x7fe6bd7c3e07 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1823:41
#11 0x7fe6bd7c2709 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:2086:7
#12 0x7fe6c18838f5 in CreateWebRenderCommandsNewClipListOption src/layout/painting/nsDisplayList.cpp:4654:30
#13 0x7fe6c18838f5 in CreateWebRenderCommands src/layout/painting/nsDisplayList.h:4941:12
#14 0x7fe6c18838f5 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) src/layout/painting/nsDisplayList.cpp:5280:22
#15 0x7fe6bd7c3e07 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1823:41
#16 0x7fe6bd7c2709 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:2086:7
#17 0x7fe6bd7c0c71 in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1744:5
#18 0x7fe6bd7d5471 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) src/gfx/layers/wr/WebRenderLayerManager.cpp:363:30
#19 0x7fe6c1872679 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) src/layout/painting/nsDisplayList.cpp:2291:18
#20 0x7fe6c14defc9 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3446:9
#21 0x7fe6c145077e in mozilla::PresShell::PaintInternal(nsView*, mozilla::PaintInternalFlags) src/layout/base/PresShell.cpp:6419:5
#22 0x7fe6c1090630 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:440:18
#23 0x7fe6c10901bb in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:375:22
#24 0x7fe6c10915ce in nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:948:5
#25 0x7fe6c140cf62 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) src/layout/base/nsRefreshDriver.cpp:2700:11
#26 0x7fe6c1414c50 in TickDriver src/layout/base/nsRefreshDriver.cpp:368:13
#27 0x7fe6c1414c50 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:346:7
#28 0x7fe6c1414b53 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:362:5
#29 0x7fe6c1414820 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:884:5
#30 0x7fe6c1413e6f in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:797:5
#31 0x7fe6c14138c5 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:724:5
#32 0x7fe6c14134fa in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() src/layout/base/nsRefreshDriver.cpp:587:14
#33 0x7fe6c141310c in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:544:9
#34 0x7fe6c09240cb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) src/dom/ipc/VsyncMainChild.cpp:68:15
#35 0x7fe6c0ba6f16 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:78
#36 0x7fe6bd021864 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6088:32
#37 0x7fe6bcfb67b1 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:1781:25
#38 0x7fe6bcfb3305 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) src/ipc/glue/MessageChannel.cpp:1706:9
#39 0x7fe6bcfb3ea6 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1506:3
#40 0x7fe6bcfb5231 in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1604:14
#41 0x7fe6bc4068ae in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:475:16
#42 0x7fe6bc3e1263 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:788:26
#43 0x7fe6bc3dfe13 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:620:15
#44 0x7fe6bc3e0083 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:398:36
#45 0x7fe6bc40a036 in operator() src/xpcom/threads/TaskController.cpp:124:37
#46 0x7fe6bc40a036 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#47 0x7fe6bc3f5b0f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1180:16
#48 0x7fe6bc3fc10d in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:465:10
#49 0x7fe6bcfbc236 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
#50 0x7fe6bcee4d47 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:380:10
#51 0x7fe6bcee4c52 in RunHandler src/ipc/chromium/src/base/message_loop.cc:373:3
#52 0x7fe6bcee4c52 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:355:3
#53 0x7fe6c10f70a8 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#54 0x7fe6c323526b in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:874:20
#55 0x7fe6bcfbd12a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
#56 0x7fe6bcee4d47 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:380:10
#57 0x7fe6bcee4c52 in RunHandler src/ipc/chromium/src/base/message_loop.cc:373:3
#58 0x7fe6bcee4c52 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:355:3
#59 0x7fe6c323488c in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:733:34
#60 0x55fda3450e90 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#61 0x55fda3450e90 in main src/browser/app/nsBrowserApp.cpp:329:18
#62 0x7fe6d3278082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#63 0x55fda3426c3c in _start (/home/worker/builds/m-c-20220515094927-fuzzing-debug/firefox-bin+0x15c3c) (BuildId: a3c3f38575613f8bfa5bd34a05d62cc5a64c66fd)
Flags: in-testsuite?

A Pernosco session is available here: https://pernos.co/debug/gBQ4Ay2SeyFwIEgb-iJ77g/index.html

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220518214245-11b3a2e731a9.
The bug appears to have been introduced in the following build range:

Start: a47e970555ccc1ecc6c7d8057ce171544080ca4b (20220513160400)
End: 4aa40d4543da126a325b799542bd3fa72777bb4b (20220513134313)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a47e970555ccc1ecc6c7d8057ce171544080ca4b&tochange=4aa40d4543da126a325b799542bd3fa72777bb4b

Keywords: regression
Whiteboard: [bugmon:bisected,confirmed]

The severity field is not set for this bug.
:miko, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(mikokm)
Severity: -- → S3
Flags: needinfo?(mikokm)
Priority: -- → P3
Regressions: 1423746
Regressed by: 1423746
No longer regressions: 1423746

Set release status flags based on info from the regressing bug 1423746

status-firefox101: --- → unaffected
status-firefox103: --- → affected
status-firefox-esr91: --- → unaffected

:emilio, since you are the author of the regressor, bug 1423746, could you take a look?
For more information, please visit auto_nag documentation.

Flags: needinfo?(emilio)
Has Regression Range: --- → yes
Flags: needinfo?(emilio)
Assignee: nobody → emilio
Status: NEW → ASSIGNED
Attachment #9281179 - Attachment description: Bug 1770063 - Prevent fallback backdrop filters on root. r=nical → Bug 1770063 - Prevent fallback backdrop filters on root. r=#gfx-reviewers
Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/49223a431cd4
Prevent fallback backdrop filters on root. r=gfx-reviewers,gw
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/34441 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/49223a431cd4

Status: ASSIGNED → RESOLVED
Closed: 2 years ago
status-firefox103: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 103 Branch

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220615154659-5093bcd97c9c.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox103: fixed → verified
Keywords: bugmon
Upstream PR merged by moz-wptsync-bot

Set release status flags based on info from the regressing bug 1423746

status-firefox-esr102: --- → affected
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: