1962862 - Frequent crash (diagnostic assert) in [@ mozilla::nsDisplayItem::GetOldListIndex] in chatgpt.com

Status: RESOLVED FIXED

(Core :: Web Painting, defect, P2)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

43 reports from 26 installs of Firefox 139.0a1 with build IDs 20250425212424 and 20250426091604 on all desktop OS. Only few crash reporters shared the url but it was always ChatGPT. I could not reproduce with a basic query.

Push log in which the regression has likely started.

Emilio: Is this a regression from enabling view transitions in bug 1950759?

Crash report: https://crash-stats.mozilla.org/report/index/7e8055c4-2d10-4fb3-bdef-0c7530250426

MOZ_CRASH Reason:

Item found was in the wrong list! type 20 (outer type was 21 at depth 6, now is 21)

Top 10 frames:

0  xul.dll  MOZ_Crash(char const*, int, char const*)  mfbt/Assertions.h:381
0  xul.dll  mozilla::nsDisplayItem::GetOldListIndex(mozilla::nsDisplayList*, unsigned int...  layout/painting/nsDisplayList.h:2218
0  xul.dll  mozilla::MergeState::HasMatchingItemInOldList(mozilla::nsDisplayItem*, mozill...  layout/painting/RetainedDisplayListBuilder.cpp:633
0  xul.dll  mozilla::MergeState::ProcessItemFromNewList(mozilla::nsDisplayItem*, mozilla:...  layout/painting/RetainedDisplayListBuilder.cpp:460
0  xul.dll  mozilla::RetainedDisplayListBuilder::MergeDisplayLists(mozilla::nsDisplayList...  layout/painting/RetainedDisplayListBuilder.cpp:835
1  xul.dll  mozilla::MergeState::MergeChildLists(mozilla::nsDisplayItem*, mozilla::nsDisp...  layout/painting/RetainedDisplayListBuilder.cpp:509
1  xul.dll  mozilla::MergeState::ProcessItemFromNewList(mozilla::nsDisplayItem*, mozilla:...  layout/painting/RetainedDisplayListBuilder.cpp:481
1  xul.dll  mozilla::RetainedDisplayListBuilder::MergeDisplayLists(mozilla::nsDisplayList...  layout/painting/RetainedDisplayListBuilder.cpp:835
2  xul.dll  mozilla::MergeState::MergeChildLists(mozilla::nsDisplayItem*, mozilla::nsDisp...  layout/painting/RetainedDisplayListBuilder.cpp:509
2  xul.dll  mozilla::MergeState::ProcessItemFromNewList(mozilla::nsDisplayItem*, mozilla:...  layout/painting/RetainedDisplayListBuilder.cpp:481

Comment 1

[Emilio Cobos Álvarez [:emilio]]

Seems likely (thus nightly only).

Jason, ni?ing just in case you have a test case since I suspect fuzzers will hit it relatively soon

Comment 2

[Timothy Nikkel (:tnikkel)]

Have the fuzzers been trained to produce view transitions testcases?

Comment 3

[Emilio Cobos Álvarez [:emilio]]

(In reply to Timothy Nikkel (:tnikkel) from comment #2)

Have the fuzzers been trained to produce view transitions testcases?

Afaiui yeah (I checked a while ago and I got told that once the pref gets turned on they should start hitting it).

Comment 4

[Jason Kratzer [:jkratzer]]

Emilio, is this not the same issue as bug 1936080?

Comment 5

[Jason Kratzer [:jkratzer]]

If not, I have another testcase the produces the nearly the same assertion mentioned in comment 0.

Hit MOZ_CRASH(Item found was in the wrong list! type 20 (outer type was 21 at depth 2, now is 2)) at /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.h:2221

Comment 6

[Emilio Cobos Álvarez [:emilio]]

Hmm, not quite, we want something that requires document.startViewTransition(), otherwise it's likely not to be the same root cause...

Comment 7

[Timothy Nikkel (:tnikkel)]

(In reply to Jason Kratzer [:jkratzer] from comment #4)

Emilio, is this not the same issue as bug 1936080?

The testcase in that bug uses overflow-clip-box: content-box which is not something we ever plan on enabling for content for users.

Comment 8

[Donal Meehan [:dmeehan]]

:emilio do you plan on landing a fix for this? Or, should we disable it for now since it is a top crash in nighty?

Comment 9

[Chris Peterson [:cpeterson]]

I can reliably reproduce this crash in Nightly 140.0a1 (2025-04-29) on macOS: log into chatgpt.com and start a new chat.

Comment 10

[Emilio Cobos Álvarez [:emilio]]

Would be great to have a reproducible test-case here but will try to debug without it.

Comment 11

[Tyson Smith [:tsmith]]

Pernosco session incoming...

Comment 12

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/n3RdGY8BGsGLfS7uWHzbog/index.html

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criteria:

• Top 10 desktop browser crashes on nightly
• Top 10 AArch64 and ARM crashes on nightly

For more information, please visit BugBot documentation.

Comment 14

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1962862 - Changes to view-transition-name from / to none should invalidate paint. r=#vt,tnikkel

Since they create a stacking context.

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c17c6e33bb4b
Changes to view-transition-name from / to none should invalidate paint. r=tnikkel

Comment 16

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/52269 for changes under testing/web-platform/tests

Comment 17

[amarc]

https://hg.mozilla.org/mozilla-central/rev/c17c6e33bb4b

Comment 18

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot