Assertion failure: merged->CanMerge(item), at /src/layout/painting/nsDisplayList.cpp:879 #0 nsDisplayListBuilder::MergeItems(nsTArray<nsDisplayItem*>&) /src/layout/painting/nsDisplayList.cpp:880:15 #1 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*, AnimatedGeometryRoot*, mozilla::ActiveScrolledRoot const*, nsPoint const&, nsPoint&, int, int&) /src/layout/painting/FrameLayerBuilder.cpp:4031:24 #2 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) /src/layout/painting/FrameLayerBuilder.cpp:3983:3 #3 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5697:11 #4 nsDisplayMask::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:8890:5 #5 mozilla::FrameLayerBuilder::AddPaintedDisplayItem(mozilla::PaintedLayerData*, nsDisplayItem*, mozilla::DisplayItemClip const&, mozilla::ContainerState&, mozilla::LayerState, nsPoint const&) /src/layout/painting/FrameLayerBuilder.cpp:4719:16 #6 void mozilla::ContainerState::FinishPaintedLayerData<mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0>(mozilla::PaintedLayerData&, mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0) /src/layout/painting/FrameLayerBuilder.cpp:3167:20 #7 mozilla::PaintedLayerDataNode::PopPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2872:21 #8 mozilla::PaintedLayerDataNode::PopAllPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2882:5 #9 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2836:3 #10 mozilla::PaintedLayerDataNode::FinishAllChildren(bool) /src/layout/painting/FrameLayerBuilder.cpp:2825:19 #11 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2834:3 #12 mozilla::PaintedLayerDataTree::Finish() /src/layout/painting/FrameLayerBuilder.cpp:2896:12 #13 mozilla::ContainerState::Finish(unsigned int*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, nsDisplayList*, bool*) /src/layout/painting/FrameLayerBuilder.cpp:5282:25 #14 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5711:11 #15 nsDisplayMask::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:8890:5 #16 mozilla::FrameLayerBuilder::AddPaintedDisplayItem(mozilla::PaintedLayerData*, nsDisplayItem*, mozilla::DisplayItemClip const&, mozilla::ContainerState&, mozilla::LayerState, nsPoint const&) /src/layout/painting/FrameLayerBuilder.cpp:4719:16 #17 void mozilla::ContainerState::FinishPaintedLayerData<mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0>(mozilla::PaintedLayerData&, mozilla::PaintedLayerDataNode::PopPaintedLayerData()::$_0) /src/layout/painting/FrameLayerBuilder.cpp:3167:20 #18 mozilla::PaintedLayerDataNode::PopPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2872:21 #19 mozilla::PaintedLayerDataNode::PopAllPaintedLayerData() /src/layout/painting/FrameLayerBuilder.cpp:2882:5 #20 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2836:3 #21 mozilla::PaintedLayerDataNode::FinishAllChildren(bool) /src/layout/painting/FrameLayerBuilder.cpp:2825:19 #22 mozilla::PaintedLayerDataNode::Finish(bool) /src/layout/painting/FrameLayerBuilder.cpp:2834:3 #23 mozilla::PaintedLayerDataTree::Finish() /src/layout/painting/FrameLayerBuilder.cpp:2896:12 #24 mozilla::ContainerState::Finish(unsigned int*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, nsDisplayList*, bool*) /src/layout/painting/FrameLayerBuilder.cpp:5282:25 #25 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5711:11 #26 nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:6528:5 #27 nsDisplaySubDocument::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&) /src/layout/painting/nsDisplayList.cpp:6626:44 #28 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*, AnimatedGeometryRoot*, mozilla::ActiveScrolledRoot const*, nsPoint const&, nsPoint&, int, int&) /src/layout/painting/FrameLayerBuilder.cpp:4300:38 #29 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*, AnimatedGeometryRoot*, mozilla::ActiveScrolledRoot const*, nsPoint const&, nsPoint&, int, int&) /src/layout/painting/FrameLayerBuilder.cpp:4039:7 #30 mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*) /src/layout/painting/FrameLayerBuilder.cpp:3983:3 #31 mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> const*, unsigned int) /src/layout/painting/FrameLayerBuilder.cpp:5697:11 #32 nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) /src/layout/painting/nsDisplayList.cpp:2254:9 #33 nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /src/layout/base/nsLayoutUtils.cpp:3755:12 #34 mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /src/layout/base/PresShell.cpp:6454:5 #35 nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /src/view/nsViewManager.cpp:480:19 #36 nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /src/view/nsViewManager.cpp:412:33 #37 nsViewManager::ProcessPendingUpdates() /src/view/nsViewManager.cpp:1102:5 #38 nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:2082:11 #39 mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /src/layout/base/nsRefreshDriver.cpp:307:7 #40 mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:329:5 #41 mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:770:5 #42 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:683:35 #43 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /src/layout/base/nsRefreshDriver.cpp:529:20 #44 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1039:14 #45 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:521:10 #46 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21 #47 MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10 #48 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3 #49 nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:158:27 #50 nsAppStartup::Run() /src/toolkit/components/startup/nsAppStartup.cpp:288:30 #51 XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4701:22 #52 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4865:8 #53 XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4960:21 #54 do_main(int, char**, char**) /src/browser/app/nsBrowserApp.cpp:236:22 #55 main /src/browser/app/nsBrowserApp.cpp:309:16 #56 __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 #57 _start (firefox+0x41e9e4)

Different test case, but seems pretty similar stack, bug 1402031.

INFO: Last good revision: 56a78e06eff868f3581ca509cf510a6a899bd378 INFO: First bad revision: 7bdf8f58bb8b0d18ea7a20bd58a1c26aed07f58d INFO: Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=56a78e06eff868f3581ca509cf510a6a899bd378&tochange=7bdf8f58bb8b0d18ea7a20bd58a1c26aed07f58d

Thank you for the report, I'll investigate this.

The cause for this and Bug 1402031 is nsDisplayMask::CanMerge(), which only checks the frame style for one of the display items.

Comment on attachment 8911493 [details] Bug 1402183 - Part 1: Make nsDisplayMask::CanMerge() symmetric https://reviewboard.mozilla.org/r/182944/#review188942

Comment on attachment 8911494 [details] Bug 1402183 - Part 2: Add crashtest https://reviewboard.mozilla.org/r/182946/#review188944

Pushed by mikokm@gmail.com: https://hg.mozilla.org/integration/autoland/rev/542962171efc Part 1: Make nsDisplayMask::CanMerge() symmetric r=mstange https://hg.mozilla.org/integration/autoland/rev/85684a22314e Part 2: Add crashtest r=mstange

https://hg.mozilla.org/mozilla-central/rev/542962171efc https://hg.mozilla.org/mozilla-central/rev/85684a22314e

Is that something that you would like to uplift in 57?

Comment on attachment 8911493 [details] Bug 1402183 - Part 1: Make nsDisplayMask::CanMerge() symmetric Approval Request Comment [Feature/Bug causing the regression]: nsDisplayMask>>CanMerge() function worked differently depending on the ordering of display items. [User impact if declined]: Small. This bug was present before adding the assertion that uncovered this. [Is this code covered by automated tests?]: Yes, there is a new crashtest. [Has the fix been verified in Nightly?]: Yes, the debug build of Nightly does not crash with the added crashtest. [Needs manual test from QE? If yes, steps to reproduce]: No. [List of other uplifts needed for the feature/fix]: No. [Is the change risky?]: No. [Why is the change risky/not risky?]: The change is trivial and the current test suite passes. [String changes made/needed]: No.

Hi Matt, can I get your opinion on whether this is a must fix for 57? It is a recent regression but I am unable to determine the severity or likelihood of real users running into this crash. Appreciate any help.

No, I don't think this is a must fix for 57. It's an existing bug, just a new assertion that shows it. It is a low risk fix though.

Thanks Matt. Beta57 is seeing an unusual # of uplift request. I want to manage risks to quality by limiting uplifts to must fix items. Sorry!