Open Bug 1826032 Opened 2 years ago Updated 9 months ago

Assertion failure: IsAncestor(aOne, aTwo) || IsAncestor(aTwo, aOne), at /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:204

Categories

(Core :: Web Painting, defect)

Product:
Core
Component:
Web Painting
Version:
Firefox 111
Type:
defect

Tracking

()

Status:
UNCONFIRMED

People

(Reporter: 2366719611, Unassigned)

References

Details

Attachments

(2 files)

the html that causes the crash
1.72 MB, text/html
Details
2023-04-17 09-43-59.mkv
7.13 MB, video/x-matroska
Details

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36

Steps to reproduce:

open the attached html file with firefox debug version.

Actual results:

the firefox crashed.
log:
Assertion failure: IsAncestor(aOne, aTwo) || IsAncestor(aTwo, aOne), at /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:204
#01: ??? mozilla::ActiveScrolledRoot::PickDescendant(mozilla::ActiveScrolledRoot const*, mozilla::ActiveScrolledRoot const*)
#02: ??? mozilla::nsDisplayListBuilder::CreateClipChainIntersection(mozilla::DisplayItemClipChain const*, mozilla::DisplayItemClipChain const*, mozilla::DisplayItemClipChain const*)
#03: ??? mozilla::DisplayListClipState::GetCurrentCombinedClipChain(mozilla::nsDisplayListBuilder*)
#04: ??? mozilla::nsDisplayListBuilder::MarkFramesForDisplayList(nsIFrame*, nsFrameList const&)
#05: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#06: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#07: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#08: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#09: ??? DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
#10: ??? nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#11: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#12: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#13: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#14: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#15: ??? DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
#16: ??? nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#17: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#18: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#19: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#20: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#21: ??? DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
#22: ??? nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#23: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#24: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#25: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#26: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#27: ??? DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&)
#28: ??? nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#29: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#30: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#31: ??? nsCanvasFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#32: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#33: ??? mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#34: ??? nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>)
#35: ??? mozilla::ViewportFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&)
#36: ??? nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*)
#37: ??? nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)
#38: ??? mozilla::PresShell::PaintInternal(nsView*, mozilla::PaintInternalFlags)
#39: ??? nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*)
#40: ??? nsViewManager::ProcessPendingUpdatesForView(nsView*, bool)
#41: ??? nsViewManager::ProcessPendingUpdates()
#42: ??? nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)
#43: ??? mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)
#44: ??? mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)
#45: ??? mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)
#46: ??? mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)
#47: ??? mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&)
#48: ??? mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread()
#49: ??? mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&)
#50: ??? mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&)
#51: ??? mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&)
#52: ??? mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&)
#53: ??? mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)
#54: ??? mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >)
#55: ??? mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)
#56: ??? mozilla::ipc::MessageChannel::MessageTask::Run()
#57: ??? mozilla::RunnableTask::Run()
#58: ??? mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
#59: ??? mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
#60: ??? mozilla::TaskController::ProcessPendingMTTask(bool)
#61: ??? mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run()
#62: ??? nsThread::ProcessNextEvent(bool, bool*)
#63: ??? NS_ProcessNextEvent(nsIThread*, bool)
#64: ??? mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
#65: ??? MessageLoop::RunInternal()
#66: ??? MessageLoop::Run()
#67: ??? nsBaseAppShell::Run()
#68: ??? XRE_RunAppShell()
#69: ??? mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)
#70: ??? MessageLoop::RunInternal()
#71: ??? MessageLoop::Run()
#72: ??? XRE_InitChildProcess(int, char**, XREChildData const*)
#73: ??? content_process_main(mozilla::Bootstrap*, int, char**)
#74: ??? main
#75: __libc_start_main __libc_start_main
#76: ??? _start
#77: ??? (???:???)

Expected results:

the firefox should not crash.

I didn't experience any crash while loading the attachment in the latest Nightly 113.0a1 and Firefox 111.0.1 versions.
Does this issue occur frequently on your side?
Are you able to reproduce this issue using Firefox in safe mode or with a new profile?

Flags: needinfo?(2366719611)
Attached video 2023-04-17 09-43-59.mkv —
Flags: needinfo?(2366719611)

I opened it on the Ubuntu 22.04 and I added a screen recording in the attachment.

Thanks for the details provided.
Setting the component to have the developer's opinion about it.
If this is not the correct component, please feel free to change it to a more appropriate one.

Component: Untriaged → Graphics
Product: Firefox → Core
Component: Graphics → Web Painting
Severity: -- → S3
See Also: → 1765168
See Also: → 1729589
See Also: → 1427792
See Also: → 1787690
See Also: → 1756669
See Also: → 1855249
See Also: → 1807982, 1882418
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: