Last Comment Bug 686513 - RenderFrameParent::BuildDisplayList crash when shadow root layer is null
: RenderFrameParent::BuildDisplayList crash when shadow root layer is null
Product: Core
Classification: Components
Component: Layout (show other bugs)
: Trunk
: x86 Linux
-- normal (vote)
: mozilla9
Assigned To: Oleg Romashin (:romaxa)
: Jet Villegas (:jet)
Depends on:
  Show dependency treegraph
Reported: 2011-09-13 12:29 PDT by Oleg Romashin (:romaxa)
Modified: 2011-09-14 06:55 PDT (History)
6 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Possible fix (1.28 KB, patch)
2011-09-13 12:31 PDT, Oleg Romashin (:romaxa)
roc: review+
roc: feedback+
Details | Diff | Splinter Review

Description User image Oleg Romashin (:romaxa) 2011-09-13 12:29:54 PDT
While playing with MediaBridge I found case when RenderFrameParent::BuildDisplayList crashes because GetRootLayer() return null;

#6  mozilla::layout::GetFrameMetrics (aLayer=0x0) at layout/ipc/RenderFrameParent.cpp:168
#7  0xb5ad3120 in mozilla::layout::BuildListForLayer (aLayer=0x0, aRootFrameLoader=0xad8a7280, aTransform=..., aBuilder=0xbf8149c4, aShadowTree=..., aSubdocFrame=0xac05b710)
    at layout/ipc/RenderFrameParent.cpp:237
#8  0xb5ad3fbd in mozilla::layout::RenderFrameParent::BuildDisplayList (this=0xa88d6740, aBuilder=0xbf8149c4, aFrame=0xac05b710, aDirtyRect=..., aLists=...)
    at layout/ipc/RenderFrameParent.cpp:819
#9  0xb5ab895c in nsSubDocumentFrame::BuildDisplayList (this=0xac05b710, aBuilder=0xbf8149c4, aDirtyRect=..., aLists=...)
    at layout/generic/nsSubDocumentFrame.cpp:281
#10 0xb5a73913 in nsIFrame::BuildDisplayListForStackingContext (this=0xac05b710, aBuilder=0xbf8149c4, aDirtyRect=..., aList=0xbf80fc98)
    at layout/generic/nsFrame.cpp:1585
#11 0xb5a74645 in nsIFrame::BuildDisplayListForChild (this=0xac05b6a0, aBuilder=0xbf8149c4, aChild=0xac05b710, aDirtyRect=..., aLists=..., aFlags=2)
    at layout/generic/nsFrame.cpp:1878
#12 0xb5b8fd41 in nsStackFrame::BuildDisplayListForChildren (this=0xac05b6a0, aBuilder=0xbf8149c4, aDirtyRect=..., aLists=...)
    at layout/xul/base/src/nsStackFrame.cpp:93
#13 0xb5b8c068 in nsBoxFrame::BuildDisplayList (this=0xac05b6a0, aBuilder=0xbf8149c4, aDirtyRect=..., aLists=...)
    at layout/xul/base/src/nsBoxFrame.cpp:1332
#14 0xb5a73913 in nsIFrame::BuildDisplayListForStackingContext (this=0xac05b6a0, aBuilder=0xbf8149c4, aDirtyRect=..., aList=0xbf810268)
Comment 1 User image Oleg Romashin (:romaxa) 2011-09-13 12:31:08 PDT
Created attachment 560016 [details] [diff] [review]
Possible fix

Here is possible fix for this issue, not sure if that is correct, probably real problem hiding somewhere else..
Comment 2 User image Robert O'Callahan (:roc) (email my personal email if necessary) 2011-09-13 14:08:31 PDT
Comment on attachment 560016 [details] [diff] [review]
Possible fix

Review of attachment 560016 [details] [diff] [review]:

Seems good.
Comment 3 User image Ed Morley [:emorley] 2011-09-13 17:10:50 PDT
Author and commit message added; now in my queue of bits and pieces for try then inbound.
Comment 6 User image Matt Brubeck (:mbrubeck) 2011-09-14 06:55:37 PDT

Note You need to log in before you can comment on or make changes to this bug.