686513 - RenderFrameParent::BuildDisplayList crash when shadow root layer is null

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Oleg Romashin (:romaxa)]

While playing with MediaBridge I found case when RenderFrameParent::BuildDisplayList crashes because GetRootLayer() return null;

#6  mozilla::layout::GetFrameMetrics (aLayer=0x0) at layout/ipc/RenderFrameParent.cpp:168
#7  0xb5ad3120 in mozilla::layout::BuildListForLayer (aLayer=0x0, aRootFrameLoader=0xad8a7280, aTransform=..., aBuilder=0xbf8149c4, aShadowTree=..., aSubdocFrame=0xac05b710)
    at layout/ipc/RenderFrameParent.cpp:237
#8  0xb5ad3fbd in mozilla::layout::RenderFrameParent::BuildDisplayList (this=0xa88d6740, aBuilder=0xbf8149c4, aFrame=0xac05b710, aDirtyRect=..., aLists=...)
    at layout/ipc/RenderFrameParent.cpp:819
#9  0xb5ab895c in nsSubDocumentFrame::BuildDisplayList (this=0xac05b710, aBuilder=0xbf8149c4, aDirtyRect=..., aLists=...)
    at layout/generic/nsSubDocumentFrame.cpp:281
#10 0xb5a73913 in nsIFrame::BuildDisplayListForStackingContext (this=0xac05b710, aBuilder=0xbf8149c4, aDirtyRect=..., aList=0xbf80fc98)
    at layout/generic/nsFrame.cpp:1585
#11 0xb5a74645 in nsIFrame::BuildDisplayListForChild (this=0xac05b6a0, aBuilder=0xbf8149c4, aChild=0xac05b710, aDirtyRect=..., aLists=..., aFlags=2)
    at layout/generic/nsFrame.cpp:1878
#12 0xb5b8fd41 in nsStackFrame::BuildDisplayListForChildren (this=0xac05b6a0, aBuilder=0xbf8149c4, aDirtyRect=..., aLists=...)
    at layout/xul/base/src/nsStackFrame.cpp:93
#13 0xb5b8c068 in nsBoxFrame::BuildDisplayList (this=0xac05b6a0, aBuilder=0xbf8149c4, aDirtyRect=..., aLists=...)
    at layout/xul/base/src/nsBoxFrame.cpp:1332
#14 0xb5a73913 in nsIFrame::BuildDisplayListForStackingContext (this=0xac05b6a0, aBuilder=0xbf8149c4, aDirtyRect=..., aList=0xbf810268)

Comment 1

[Oleg Romashin (:romaxa)]

Attachment: Possible fix

Here is possible fix for this issue, not sure if that is correct, probably real problem hiding somewhere else..

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 560016 [details] [diff] [review]
Possible fix

Review of attachment 560016 [details] [diff] [review]:
-----------------------------------------------------------------

Seems good.

Comment 3

[Ed Morley [:emorley]]

Author and commit message added; now in my queue of bits and pieces for try then inbound.

Comment 4

[Ed Morley [:emorley]]

https://tbpl.mozilla.org/?tree=Try&usebuildbot=1&rev=5a17479d7da9

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d9a39885a9d2

Comment 6

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/mozilla-central/rev/d9a39885a9d2