1153426 - crash in nsStyleTransformMatrix::MatrixForTransformFunction when animating a transform to or from 'none'

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Dietrich Ayala (:dietrich)]

This bug was filed from the Socorro interface and is 
report bp-e04656d3-6682-472f-9fca-a29d42150410.
=============================================================

100% reproducible by loading https://cssanimation.rocks/principles/

Started in the last couple of days.

Comment 1

[(Away)]

More reports: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=nsStyleTransformMatrix%3A%3AMatrixForTransformFunction

|aData| is 0x5a5a5a5a in MatrixForTransformFunction, so whatever object was holding that pointer is now dead.

First seen 20150407030207. Mostly Windows and a few Mac, so I'm guessing bug 980770.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Yes; the stack is something that would happen only with OMT animations on.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Also reproducable on Linux with OMTA on.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The immediate cause is that it's being passed a single-item list whose unit is eCSSUnit_None, rather than a list of transform functions that it expects.  Need to figure out why it has that expectation and/or why we're not meeting it.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: testcase

We crash when animating transform to or from 'none'.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

FWIW, I have a patch; most of the time is debugging why the existing tests in layout/style/test/test_transitions_per_property.html don't show this bug.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

... which is because it never samples at the start or end of the animations, only in the middle.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: Don't crash when doing an off-main-thread animation of a transform to or from the 'none' value

I confirmed locally (with ./mach mochitest-plain --e10s on Linux) that
the added test crashes without the patch and passes with the patch.

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/62b47badf9f9

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/62b47badf9f9