789396 - Crash when changing opacity of multiple nested elements, with border

Status: VERIFIED FIXED

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Attachment: testcase

With

    user_pref("layers.acceleration.disabled", true);

the testcase causes a crash:

     [@ mozilla::::ContainerState::PopThebesLayerData ]
     bp-87a7ce66-5fb3-49bb-8ac9-f841c2120907

This is similar to bug 770381 (which is WFM)

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Alice0775 White]

I can reproduce the crash in Windows7 with HWA disabled.

bp-f5e5cb43-4eef-4201-b0cb-5f4fb2120907 : Aurora17.0a2
bp-4bf49925-c4f8-4018-9a7e-ba7d42120907 : Nightly18.0a1

Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/82b6c5885345
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120723030606
Crash:
http://hg.mozilla.org/mozilla-central/rev/d78729026fb9
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120723063342
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=82b6c5885345&tochange=d78729026fb9


Regression window(m-c)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/9302468f64fa
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120722192842
Crash:
http://hg.mozilla.org/integration/mozilla-inbound/rev/a5ee3b2e133a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0 ID:20120722200242
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=9302468f64fa&tochange=a5ee3b2e133a

Suspected: Bug 741682

Comment 3

[Alice0775 White]

Bug 777654 ?

Comment 5

[Matt Woodrow (:mattwoodrow)]

Attachment: Don't overwrite mContainerLayerGeneration

Comment 6

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2d37431b49e9

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/2d37431b49e9

Comment 8

[Scoobidiver (away)]

It's #16 top browser crasher in 17.0a2.

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 659931 [details] [diff] [review]
Don't overwrite mContainerLayerGeneration

Review of attachment 659931 [details] [diff] [review]:
-----------------------------------------------------------------

Fairly straightforward fix to a topcrasher.

Comment 10

[Robert O'Callahan (:roc) (email my personal email if necessary)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/f946a4984ba9

Comment 11

[Manuela Muntean [Away]]

I verified the fix using the steps from the description, on build  Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/17.0 Firefox/17.0. The crash didn't occur.
When verifying in Socorro I found some crashes with the same signature:
https://crash-stats.mozilla.com/report/index/63510313-7de7-40d5-9524-e03452121007
https://crash-stats.mozilla.com/report/index/4b84fa5f-b379-4a82-b11f-64f812121002
https://crash-stats.mozilla.com/report/index/5e3647ad-0f66-49df-9983-10ee92120928
https://crash-stats.mozilla.com/report/index/4b84fa5f-b379-4a82-b11f-64f812121002
https://crash-stats.mozilla.com/report/index/4f94edc2-ca27-4f90-87f8-26f812121002


Matt, could you please take a look if the crashes are related to the bug?

Comment 12

[u279076]

Manuela, I think this might be different. The signatures are the same but the stacks are different. Marking this bug verified fixed based on the crash no longer being reproducible.

If someone thinks this should be reopened, please do so.