1835127 - With animated theme and no decode surface recycling, SharedSurfacesAnimation::SetCurrentFrame asserts on window close and reopen.

Status: NEW

(Core :: Graphics, defect, P3)

Description

[Brad Werth [:bradwerth]]

Steps to Reproduce on a debug build:

1. Install and enable the theme https://github.com/nicoth-in/Dark-Space-Theme.
2. Navigate to about:config and set the image.animated.decode-on-demand.recycle pref to false.
3. Quit and restart Firefox.
4. When the initial Firefox window appears, close the window.
5. Create a new browser window.

Expected Result: Window appears, Firefox continues to run normally.
Actual Result: Firefox crashes.

Relevant part of crash stack:

Assertion failure: !entry.mManager->IsDestroyed(), at gfx/layers/ipc/SharedSurfacesChild.cpp:466
#01: mozilla::layers::SharedSurfacesAnimation::SetCurrentFrame(mozilla::gfx::SourceSurfaceSharedData*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)[toolkit/library/build/XUL +0x36e4a38]
#02: mozilla::image::AnimationSurfaceProvider::Advance(unsigned long)[toolkit/library/build/XUL +0x3c7090c]
#03: mozilla::image::DrawableSurface::Advance(unsigned long)[toolkit/library/build/XUL +0x3c87840]
#04: mozilla::image::FrameAnimator::AdvanceFrame(mozilla::image::AnimationState&, mozilla::image::DrawableSurface&, RefPtr<mozilla::image::imgFrame>&, mozilla::TimeStamp)[toolkit/library/build/XUL +0x3c8761c]
#05: mozilla::image::FrameAnimator::RequestRefresh(mozilla::image::AnimationState&, mozilla::TimeStamp const&)[toolkit/library/build/XUL +0x3c88034]
#06: mozilla::image::RasterImage::RequestRefresh(mozilla::TimeStamp const&)[toolkit/library/build/XUL +0x3cc5410]
#07: nsRefreshDriver::UpdateAnimatedImages(mozilla::TimeStamp, mozilla::TimeStamp)[toolkit/library/build/XUL +0x9e461a8]

Comment 1

[Brad Werth [:bradwerth]]

Seems like the registration of the SharedSurfacesAnimation with the RenderRootStateManager should be unconditional. Likewise with the deregistration. I'll build a patch that does that.

Comment 2

[Brad Werth [:bradwerth]]

Attachment: Bug 1835127: Make SharedSurfacesChild.cpp unconditionally register and deregister with its manager.

When the RenderRootStateManager is destroyed (such as when the window is
closed), it needs to invalidate the SharedSurfacesAnimation instances that
reference it in all cases. Otherwise, when that animation tries to update
the frame (or itself gets destroyed), it will notice that it is attached
to a destroyed manager and assert.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:bhood, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Brad Werth [:bradwerth]]

Sorry, overclassified. This is an S3 since it is a debug-only assert.