Assertion failure: !mIsNewBuffer (Bad! Did we create a buffer twice without painting?), at /src/gfx/layers/client/ContentClient.cpp:719 #0 0x7fcac6b1ec38 in mozilla::layers::ContentClientRemoteBuffer::CreateBuffer(gfxContentType, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, unsigned int) /src/gfx/layers/client/ContentClient.cpp:721:59 #1 0x7fcac6b1afe7 in mozilla::layers::ContentClient::BeginPaint(mozilla::layers::PaintedLayer*, unsigned int) /src/gfx/layers/client/ContentClient.cpp:246:39 #2 0x7fcac6b0f55f in mozilla::layers::ClientPaintedLayer::PaintThebes(nsTArray<mozilla::layers::ReadbackProcessor::Update>*) /src/gfx/layers/client/ClientPaintedLayer.cpp:144:38 #3 0x7fcac6b10f26 in mozilla::layers::ClientPaintedLayer::RenderLayerWithReadback(mozilla::layers::ReadbackProcessor*) /src/gfx/layers/client/ClientPaintedLayer.cpp:301:3 #4 0x7fcac6b39f10 in mozilla::layers::ClientContainerLayer::RenderLayer() /src/gfx/layers/client/ClientContainerLayer.h:58:29 #5 0x7fcac6b39f10 in mozilla::layers::ClientContainerLayer::RenderLayer() /src/gfx/layers/client/ClientContainerLayer.h:58:29 #6 0x7fcac6b39f10 in mozilla::layers::ClientContainerLayer::RenderLayer() /src/gfx/layers/client/ClientContainerLayer.h:58:29 #7 0x7fcac6b0af80 in mozilla::layers::ClientLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags) /src/gfx/layers/client/ClientLayerManager.cpp:362:13 #8 0x7fcac6b0cf52 in mozilla::layers::ClientLayerManager::EndEmptyTransaction(mozilla::layers::LayerManager::EndTransactionFlags) /src/gfx/layers/client/ClientLayerManager.cpp:453:8 #9 0x7fcacaa12a37 in mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) /src/layout/base/PresShell.cpp:6459:25 #10 0x7fcaca41d2ea in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /src/view/nsViewManager.cpp:480:19 #11 0x7fcaca41cca5 in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /src/view/nsViewManager.cpp:412:33 #12 0x7fcaca41ed69 in nsViewManager::ProcessPendingUpdates() /src/view/nsViewManager.cpp:1102:5 #13 0x7fcaca99916b in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /src/layout/base/nsRefreshDriver.cpp:2027:11 #14 0x7fcaca99d4e7 in nsRefreshDriver::FinishedWaitingForTransaction() /src/layout/base/nsRefreshDriver.cpp:2135:5 #15 0x7fcac6b0d31f in mozilla::layers::ClientLayerManager::DidComposite(unsigned long, mozilla::TimeStamp const&, mozilla::TimeStamp const&) /src/gfx/layers/client/ClientLayerManager.cpp:520:32 #16 0x7fcac9e964c3 in mozilla::dom::TabChild::DidComposite(unsigned long, mozilla::TimeStamp const&, mozilla::TimeStamp const&) /src/dom/ipc/TabChild.cpp:3231:7 #17 0x7fcac6bcab78 in mozilla::layers::CompositorBridgeChild::RecvDidComposite(unsigned long const&, unsigned long const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&) /src/gfx/layers/ipc/CompositorBridgeChild.cpp:546:14 #18 0x7fcac5e365f5 in mozilla::layers::PCompositorBridgeChild::OnMessageReceived(IPC::Message const&) /src/obj-firefox/ipc/ipdl/PCompositorBridgeChild.cpp:1441:20 #19 0x7fcac581579a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /src/ipc/glue/MessageChannel.cpp:2114:25 #20 0x7fcac5813422 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /src/ipc/glue/MessageChannel.cpp:2044:17 #21 0x7fcac5813fe8 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /src/ipc/glue/MessageChannel.cpp:1890:5 #22 0x7fcac5814733 in mozilla::ipc::MessageChannel::MessageTask::Run() /src/ipc/glue/MessageChannel.cpp:1923:15 #23 0x7fcac4c1b6b9 in mozilla::SchedulerGroup::Runnable::Run() /src/xpcom/threads/SchedulerGroup.cpp:396:25 #24 0x7fcac4c504af in nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14 #25 0x7fcac4c718d0 in NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:513:10 #26 0x7fcac581c335 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:97:21 #27 0x7fcac576e287 in MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10 #28 0x7fcac576e119 in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3 #29 0x7fcaca48c6ca in nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:159:27 #30 0x7fcacd82dc26 in XRE_RunAppShell() /src/toolkit/xre/nsEmbedFunctions.cpp:877:22 #31 0x7fcac581cf55 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:269:9 #32 0x7fcac576e287 in MessageLoop::RunInternal() /src/ipc/chromium/src/base/message_loop.cc:326:10 #33 0x7fcac576e119 in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299:3 #34 0x7fcacd82d408 in XRE_InitChildProcess(int, char**, XREChildData const*) /src/toolkit/xre/nsEmbedFunctions.cpp:703:34 #35 0x4ec36e in content_process_main(mozilla::Bootstrap*, int, char**) /src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30 #36 0x4ec5c9 in main /src/browser/app/nsBrowserApp.cpp:280:18 #37 0x7fcae3ba882f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 #38 0x41e424 in _start (firefox+0x41e424)

Can't seem to reproduce this on Ubuntu. What platform/hardware are you seeing this on?

It was found by our fuzzing cluster and I reproduced locally using Ubuntu 16.04 x64 in a VM. I just verified that it repros with the latest debug build from TC: Changeset: ba283baf4e98aa3a5f45a17981077b98697aa73a Build ID: 20171130102254 Be sure to use the attached pref.js file to help repro.

This test cases is causing shmem failures, which is causing read lock failures, which is causing us to create buffers repeatedly. But each time we create a new buffer, we clear out the old ones so the mIsNewBuffer flag is invalid. We should clear it each time.

Comment on attachment 8934640 [details] Be sure to clear the mIsNewBuffer flag when we clear buffers (bug 1420531, ) https://reviewboard.mozilla.org/r/205516/#review211918