The attached testcase causes an assertion in m-c 20180607-199a08519981. #0: mozilla::PresShell::RenderDocument(nsRect const&, unsigned int, unsigned int, gfxContext*) at layout/base/PresShell.cpp:4641 #1: mozilla::image::SVGDrawingCallback::operator()(gfxContext*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, double> const&, mozilla::gfx::SamplingFilter, mozilla::gfx::BaseMatrix<double> const&) at image/VectorImage.cpp:327 #2: gfxCallbackDrawable::Draw(gfxContext*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, double> const&, mozilla::gfx::ExtendMode, mozilla::gfx::SamplingFilter, double, mozilla::gfx::BaseMatrix<double> const&) at gfx/thebes/gfxDrawable.cpp:172 #3: gfxUtils::DrawPixelSnapped(gfxContext*, gfxDrawable*, mozilla::gfx::SizeTyped<mozilla::gfx::UnknownUnits, double> const&, mozilla::image::ImageRegion const&, mozilla::gfx::SurfaceFormat, mozilla::gfx::SamplingFilter, unsigned int, double) at gfx/thebes/gfxUtils.cpp:344 #4: mozilla::image::VectorImage::Show(gfxDrawable*, mozilla::image::SVGDrawingParameters const&) at image/VectorImage.cpp:1216 #5: mozilla::image::VectorImage::Draw(gfxContext*, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::image::ImageRegion const&, unsigned int, mozilla::gfx::SamplingFilter, mozilla::Maybe<mozilla::SVGImageContext> const&, unsigned int, float) at image/VectorImage.cpp:1037 #6: DrawImageInternal at layout/base/nsLayoutUtils.cpp:6825 #7: nsLayoutUtils::DrawBackgroundImage(gfxContext&, nsIFrame*, nsPresContext*, imgIContainer*, mozilla::gfx::IntSizeTyped<mozilla::CSSPixel> const&, mozilla::gfx::SamplingFilter, nsRect const&, nsRect const&, nsSize const&, nsPoint const&, nsRect const&, unsigned int, mozilla::gfx::ExtendMode, float) at layout/base/nsLayoutUtils.cpp:7106 #8: mozilla::nsImageRenderer::Draw(nsPresContext*, gfxContext&, nsRect const&, nsRect const&, nsRect const&, nsPoint const&, nsSize const&, mozilla::gfx::IntRectTyped<mozilla::CSSPixel> const&, float) at layout/painting/nsImageRenderer.cpp:506 #9: mozilla::nsImageRenderer::DrawLayer(nsPresContext*, gfxContext&, nsRect const&, nsRect const&, nsPoint const&, nsRect const&, nsSize const&, float) at layout/painting/nsImageRenderer.cpp:714 #10: nsCSSRendering::PaintStyleImageLayerWithSC(nsCSSRendering::PaintBGParams const&, gfxContext&, mozilla::ComputedStyle*, nsStyleBorder const&) at layout/painting/nsCSSRendering.cpp:2838 #11: PaintMaskSurface at layout/svg/nsSVGIntegrationUtils.cpp:503 #12: nsSVGIntegrationUtils::PaintMaskAndClipPath(nsSVGIntegrationUtils::PaintFramesParams const&) at layout/svg/nsSVGIntegrationUtils.cpp:580 #13: nsDisplayMask::PaintAsLayer(nsDisplayListBuilder*, gfxContext*, mozilla::layers::LayerManager*) at layout/painting/nsDisplayList.cpp:9721 #14: mozilla::FrameLayerBuilder::PaintItems(nsTArray<mozilla::AssignedDisplayItem>&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, gfxContext*, nsDisplayListBuilder*, nsPresContext*, mozilla::gfx::IntPointTyped<mozilla::gfx::UnknownUnits> const&, float, float) at layout/painting/FrameLayerBuilder.cpp:4045 #15: mozilla::FrameLayerBuilder::DrawPaintedLayer(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*) at layout/painting/FrameLayerBuilder.cpp:6597 #16: mozilla::layers::ClientPaintedLayer::PaintThebes(nsTArray<mozilla::layers::ReadbackProcessor::Update>*) at gfx/layers/client/ClientPaintedLayer.cpp:164 #17: mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) at gfx/layers/client/ClientPaintedLayer.cpp:314 #18: mozilla::layers::ClientContainerLayer::RenderLayer() at gfx/layers/client/ClientContainerLayer.h:58 #19: mozilla::layers::ClientContainerLayer::RenderLayer() at gfx/layers/client/ClientContainerLayer.h:58 #20: mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, vo id*), void*, mozilla::layers::LayerManager::EndTransactionFlags) at gfx/layers/client/ClientLayerManager.cpp:372 #21: mozilla::layers::ClientLayerManager::EndTransaction(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), vo id*, mozilla::layers::LayerManager::EndTransactionFlags) at gfx/layers/client/ClientLayerManager.cpp:430 #22: nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) at layout/painting/nsDisplayList.cpp:2799 #23: nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) at layout/base/nsLayoutUtils.cpp:3843 #24: mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) at layout/base/PresShell.cpp:6315 #25: nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) at view/nsViewManager.cpp:480 #26: nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) at view/nsViewManager.cpp:412

This is fallout from bug 1210560 which removed the handling of operators other than OP_OVER in PresShell::RenderDocument. In this case, VectorImage::Show calls DrawPixelSnapped, which internally sometimes creates a sampling-restricted drawable that may or may not select OP_SOURCE. So when we get down to SVGDrawingCallback which then calls PresShell::RenderDocument, kaboom. The simplest thing to do here seems to be to just allow DrawPixelSnapped to selectively not use the "optimal fill op". In this case, it is more optimal to just take OP_OVER, since that prevents us from having to use a group. This is now governed by a boolean option to DrawPixelSnapped.

Comment on attachment 8984286 [details] [diff] [review] make VectorImage::Show force OP_OVER Review of attachment 8984286 [details] [diff] [review]: ----------------------------------------------------------------- Hmm, we have OP_SOURCE natively in D2D these days, I wonder if we can make it a little better in general. But for now this is a good improvement.

Pushed by lsalzman@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/7f5ff1e7158b make VectorImage::Show force OP_OVER. r=bas