1423047 - Assertion failure: aAncestorTransform.FuzzyEqualsMultiplicative(apzc->GetAncestorTransform()), at /builds/worker/workspace/build/src/gfx/layers/apz/src/APZCTreeManager.cpp:940

Status: NEW

(Core :: Web Painting, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev 709f355a7a8c.

OS|Linux|0.0.0 Linux 4.4.0-101-generic #124-Ubuntu SMP Fri Nov 10 18:29:59 UTC 2017 x86_64
CPU|amd64|family 6 model 69 stepping 1|1
GPU|||
Crash|SIGSEGV|0x0|29
29|0|libxul.so|mozilla::layers::APZCTreeManager::PrepareNodeForLayer<mozilla::layers::LayerMetricsWrapper>|hg:hg.mozilla.org/mozilla-central:gfx/layers/apz/src/APZCTreeManager.cpp:709f355a7a8c|821|0x18
29|1|libxul.so|void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(unsigned long, mozilla::layers::LayerMetricsWrapper const&, bool, unsigned long, unsigned int)::{lambda(mozilla::layers::LayerMetricsWrapper)#2}::operator()(mozilla::layers::LayerMetricsWrapper) const|||0xfc
29|2|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)>, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:709f355a7a8c|137|0x5
29|3|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)>, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:709f355a7a8c|142|0x27
29|4|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)>, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:709f355a7a8c|142|0x27
29|5|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)>, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:709f355a7a8c|142|0x27
29|6|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)>, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:709f355a7a8c|142|0x27
29|7|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)>, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:709f355a7a8c|142|0x27
29|8|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)>, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:709f355a7a8c|142|0x27
29|9|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)>, mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl(uint64_t, const ScrollNode&, bool, uint64_t, uint32_t) [with ScrollNode = mozilla::layers::LayerMetricsWrapper]::<lambda(mozilla::layers::LayerMetricsWrapper)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:709f355a7a8c|142|0x27
29|10|libxul.so|mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>|hg:hg.mozilla.org/mozilla-central:gfx/layers/apz/src/APZCTreeManager.cpp:709f355a7a8c|335|0x86
29|11|libxul.so|mozilla::layers::APZCTreeManager::UpdateHitTestingTree|hg:hg.mozilla.org/mozilla-central:gfx/layers/apz/src/APZCTreeManager.cpp:709f355a7a8c|437|0xe
29|12|libxul.so|mozilla::layers::CompositorBridgeParent::ShadowLayersUpdated|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorBridgeParent.cpp:709f355a7a8c|1254|0x19
29|13|libxul.so|mozilla::layers::LayerTransactionParent::RecvUpdate|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/LayerTransactionParent.cpp:709f355a7a8c|479|0x1d
29|14|libxul.so|mozilla::layers::PLayerTransactionParent::OnMessageReceived|s3:gecko-generated-sources:397dde5ee721e330a7dfb2456ef3372e141a160f84cd9b89112d1cc93efc3dccc55da1cb074d470376d1e8cc953398fa8bd52bdc4934ce8015ba7e5938b3247c/ipc/ipdl/PLayerTransactionParent.cpp:|132|0x6
29|15|libxul.so|mozilla::layers::PCompositorManagerParent::OnMessageReceived|s3:gecko-generated-sources:20ff9dd652892fce75f2781821f6f62de746fd2b1b92e17eaca11304cc80fccec307051f7f98199511c85fbe8d0df16d9bf8790ad9fc9d83e244999b7be3b7d5/ipc/ipdl/PCompositorManagerParent.cpp:|118|0xc
29|16|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:709f355a7a8c|2110|0x6
29|17|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:709f355a7a8c|2040|0xb
29|18|libxul.so|mozilla::ipc::MessageChannel::RunMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:709f355a7a8c|1886|0xb
29|19|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:709f355a7a8c|1919|0xc
29|20|libxul.so|MessageLoop::RunTask|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:709f355a7a8c|452|0x6
29|21|libxul.so|MessageLoop::DeferOrRunPendingTask|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:709f355a7a8c|460|0x17
29|22|libxul.so|MessageLoop::DoWork|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:709f355a7a8c|535|0x5
29|23|libxul.so|base::MessagePumpDefault::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_pump_default.cc:709f355a7a8c|36|0xa
29|24|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:709f355a7a8c|326|0x17
29|25|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:709f355a7a8c|319|0x8
29|26|libxul.so|base::Thread::ThreadMain|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/thread.cc:709f355a7a8c|181|0x8
29|27|libxul.so|ThreadFunc|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/platform_thread_posix.cc:709f355a7a8c|38|0x3
29|28|libpthread-2.23.so||||0x76ba
29|29|libc-2.23.so||||0x1073dd

Comment 1

[Botond Ballo [:botond]]

Attachment: Layer dump

Here is a dump of the layer tree that APZ is choking on.

Comment 2

[Botond Ballo [:botond]]

Layout is giving us an unexpected layer tree: two layers (0x7f76ed986800 and 0x7f76ed98c800) both have scroll metadata for [scrollId=4], but their transforms up to their common ancestor are not the same.