1538752 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Should not be called for display item types that are not able to have animations on the compositor), at /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LayerAnimationInfo.h:52

Status: RESOLVED DUPLICATE of bug 1533968

(Core :: DOM: Animation, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 4a692c812a3f.

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Should not be called for display item types that are not able to have animations on the compositor), at /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LayerAnimationInfo.h:52

rax = 0x000056458fa64e40 rdx = 0x0000000000000000
rcx = 0x00007fea89beefe0 rbx = 0x0000000000000041
rsi = 0x00007fea94df08b0 rdi = 0x00007fea94def680
rbp = 0x00007ffc94630700 rsp = 0x00007ffc946306f0
r8 = 0x00007fea94df08b0 r9 = 0x00007fea95f4d740
r10 = 0x0000000000000000 r11 = 0x0000000000000000
r12 = 0x00007fea7ab255a0 r13 = 0x0000000000000041
r14 = 0x00007fea7af6be70 r15 = 0x00007fea7ab22000
rip = 0x00007fea84e2a4e7
OS|Linux|0.0.0 Linux 4.18.0-16-generic #17~18.04.1-Ubuntu SMP Tue Feb 12 13:35:51 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|mozilla::LayerAnimationInfo::GetCSSPropertiesFor(DisplayItemType)|hg:hg.mozilla.org/mozilla-central:layout/style/LayerAnimationInfo.h:4a692c812a3fe2f893d2a6e25b9490b38415c907|49|0x0
0|1|libxul.so|mozilla::EffectSet::GetEffectSetForFrame(nsIFrame const*, DisplayItemType)|hg:hg.mozilla.org/mozilla-central:dom/animation/EffectSet.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|110|0x5
0|2|libxul.so|AddAnimationsForDisplayItem|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|806|0xf
0|3|libxul.so|nsDisplayListBuilder::AddAnimationsAndTransitionsToLayer(mozilla::layers::Layer*, nsDisplayListBuilder*, nsDisplayItem*, nsIFrame*, DisplayItemType)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|958|0x14
0|4|libxul.so|nsDisplayBackgroundColor::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::ContainerLayerParameters const&)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|4713|0xf
0|5|libxul.so|mozilla::ContainerState::ProcessDisplayItems(nsDisplayList*)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|4792|0x24
0|6|libxul.so|mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList*, mozilla::ContainerLayerParameters const&, mozilla::gfx::Matrix4x4Typed<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits, float> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/FrameLayerBuilder.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|6268|0xf
0|7|libxul.so|nsDisplayList::BuildLayers(nsDisplayListBuilder*, mozilla::layers::LayerManager*, unsigned int, bool)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|2629|0x38
0|8|libxul.so|nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/painting/nsDisplayList.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|2845|0x27
0|9|libxul.so|nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/nsLayoutUtils.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|3883|0x5
0|10|libxul.so|mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|6060|0x1b
0|11|libxul.so|nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*)|hg:hg.mozilla.org/mozilla-central:view/nsViewManager.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|461|0x28
0|12|libxul.so|nsViewManager::ProcessPendingUpdatesForView(nsView*, bool)|hg:hg.mozilla.org/mozilla-central:view/nsViewManager.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|396|0xd
0|13|libxul.so|nsViewManager::ProcessPendingUpdates()|hg:hg.mozilla.org/mozilla-central:view/nsViewManager.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|1022|0x11
0|14|libxul.so|nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|2031|0x8
0|15|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|342|0xb
0|16|libxul.so|mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|336|0xf
0|17|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|777|0xf
0|18|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|592|0x11
0|19|libxul.so|mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&)|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|65|0x8
0|20|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:77ce59d8b2c7052469c47c063657e9de1ccc8108986d35814c718a6919e13f00c69b96f485bc73c2590f51f3ea688a95fac179d8497a06fdf9265adfe5cefbb3/ipc/ipdl/PVsyncChild.cpp:|168|0xb
0|21|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|2151|0x6
0|22|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|2078|0xb
0|23|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|1937|0xb
0|24|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|1968|0xc
0|25|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|1180|0x15
0|26|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|482|0x11
0|27|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|88|0xa
0|28|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a692c812a3fe2f893d2a6e25b9490b38415c907|315|0x17
0|29|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a692c812a3fe2f893d2a6e25b9490b38415c907|308|0x8
0|30|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|137|0xd
0|31|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|933|0x11
0|32|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|238|0x5
0|33|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a692c812a3fe2f893d2a6e25b9490b38415c907|315|0x17
0|34|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a692c812a3fe2f893d2a6e25b9490b38415c907|308|0x8
0|35|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|771|0xc
0|36|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|56|0x14
0|37|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:4a692c812a3fe2f893d2a6e25b9490b38415c907|263|0x11
0|38|libc-2.27.so||||0x21b97
0|39|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:4a692c812a3fe2f893d2a6e25b9490b38415c907|184|0x5

Comment 1

[Boris Chiou [:boris]]

The test case uses background-color in a table, so I suspect this function was called by TYPE_TABLE_BACKGROUND_COLOR [1]. Maybe we should add this display item type into LayerAnimationInfo.h.

[1] https://searchfox.org/mozilla-central/rev/2c912888e3b7ae4baf161d98d7a01434f31830aa/layout/painting/nsDisplayList.h#4795

Comment 2

[Boris Chiou [:boris]]

Attachment: Bug 1538752 - Return correct property set for TYPE_TABLE_BACKRGOUND_COLOR.

nsDisplayTableBackgroundColor inherits from nsDisplayBackgroundColor, so
we should also handle its display item type properly when adding
transitions/animations to the compositor.

Comment 3

[Brian Birtles (:birtles, Feb 26~ parental leave)]

This is a dupe of bug 1533968.

Comment 4

[Boris Chiou [:boris]]

(In reply to Brian Birtles (:birtles) from comment #3)

This is a dupe of bug 1533968.

OK. Will move the patch to that one and close this.

Comment 5

[Phabricator Automation]

Comment on attachment 9053387 [details]
Bug 1538752 - Return correct property set for TYPE_TABLE_BACKRGOUND_COLOR.

Revision D24780 was moved to bug 1533968. Setting attachment 9053387 [details] to obsolete.