1555851 - Assertion failure: tmpDist >= 0.0f (distance values must be non-negative), at src/dom/smil/SMILAnimationFunction.cpp:584

Status: RESOLVED FIXED

(Core :: SVG, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20190528101320
SourceStamp=5cc220ddf028de011a922042ee9ba691b94d055d

Assertion failure: tmpDist >= 0.0f (distance values must be non-negative), at src/dom/smil/SMILAnimationFunction.cpp:584

#0 mozilla::SMILAnimationFunction::ComputePacedTotalDistance(FallibleTArray<mozilla::SMILValue> const&) const src/dom/smil/SMILAnimationFunction.cpp:585:15
#1 mozilla::SMILAnimationFunction::ComputePacedPosition(FallibleTArray<mozilla::SMILValue> const&, double, double&, mozilla::SMILValue const*&, mozilla::SMILValue const*&) src/dom/smil/SMILAnimationFunction.cpp:498:26
#2 mozilla::SMILAnimationFunction::InterpolateResult(FallibleTArray<mozilla::SMILValue> const&, mozilla::SMILValue&, mozilla::SMILValue&) src/dom/smil/SMILAnimationFunction.cpp:369:12
#3 mozilla::SMILAnimationFunction::ComposeResult(mozilla::SMILAttr const&, mozilla::SMILValue&) src/dom/smil/SMILAnimationFunction.cpp:231:9
#4 mozilla::SMILCompositor::ComposeAttribute(bool&) src/dom/smil/SMILCompositor.cpp:97:29
#5 mozilla::SMILAnimationController::DoSample(bool) src/dom/smil/SMILAnimationController.cpp:415:17
#6 mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4166:46
#7 nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1952:22
#8 mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:326:7
#9 mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:343:5
#10 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:709:16
#11 mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:604:9
#12 mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#13 mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
#14 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:4717:32
#15 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2158:25
#16 mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2082:9
#17 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1939:3
#18 mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1970:13
#19 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1176:14
#20 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#21 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
#22 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#23 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#24 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#25 XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:911:20
#26 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:238:9
#27 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:315:10
#28 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#29 XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:749:34
#30 content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#31 main src/browser/app/nsBrowserApp.cpp:263:18

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jwatt, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Cameron McCormack (:heycam)]

This is caused by a degenerately large motion path: M 9,2 l 2e37,3 A 40,2 85,102 -1

When we are here, building SVGMotionSMILAnimationFunction::mPathVertices:

#0  0x00007f44904a3848 in TraverseArcAbs (aArgs=0x7f4475792a64, aState=...) at /z/moz/g/dom/svg/SVGPathSegUtils.cpp:344
#1  0x00007f4490497139 in mozilla::SVGPathSegUtils::TraversePathSegment (aData=0x7f4475792a60, aState=...) at /z/moz/g/dom/svg/SVGPathSegUtils.cpp:407
#2  0x00007f4490491598 in mozilla::SVGPathData::GetDistancesFromOriginToEndsOfVisibleSegments (this=0x7ffd865c8fb0, aOutput=0x7f447571de70) at /z/moz/g/dom/svg/SVGPathData.cpp:166
#3  0x00007f44904917ec in mozilla::SVGMotionSMILAnimationFunction::RebuildPathAndVerticesFromPathAttr (this=0x7f447571dde8) at /z/moz/g/dom/svg/SVGMotionSMILAnimationFunction.cpp:240
#4  0x00007f4490491acb in mozilla::SVGMotionSMILAnimationFunction::RebuildPathAndVertices (this=0x7f447571dde8, aTargetElement=0x7f4475cfb400) at /z/moz/g/dom/svg/SVGMotionSMILAnimationFunction.cpp:264
#5  0x00007f4490491ef2 in mozilla::SVGMotionSMILAnimationFunction::GetValues (this=0x7f447571dde8, aSMILAttr=..., aResult=...) at /z/moz/g/dom/svg/SVGMotionSMILAnimationFunction.cpp:298
#6  0x00007f44908ab89d in mozilla::SMILAnimationFunction::ComposeResult (this=0x7f447571dde8, aSMILAttr=..., aResult=...) at /z/moz/g/dom/smil/SMILAnimationFunction.cpp:190
...

our use of SVGArcConverter to compute the length of the ends up failing and producing a NaN somewhere. Probably we should have some error checking somewhere in there.

Although I wonder why TraverseArcAbs doesn't compute the arc length directly, instead of first converting to a Bézier, then flattening it and measuring the line lengths.

Comment 3

[Cameron McCormack (:heycam)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3066144e3f9ba2ef04dd6a34ac63f62cf28dc617

Comment 4

[Cameron McCormack (:heycam)]

Attachment: Bug 1555851 - Detect motion path measurement failures.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/07e44731e886
Detect motion path measurement failures. r=longsonr

Comment 6

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/07e44731e886

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Looks like this is a pretty old issue which can ride the trains. Feel free to nominate for Beta uplift if you feel strongly otherwise, though.

Comment 8

[Cameron McCormack (:heycam)]

I think it's fine to ride the trains.