Closed Bug 1585770 Opened 6 months ago Closed 6 months ago

MOZ_CRASH [@ SampleAnimationForProperty]

Categories

(Core :: DOM: Animation, defect, P2, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla71
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- disabled
firefox67 --- unaffected
firefox68 --- disabled
firefox69 --- disabled
firefox70 --- disabled
firefox71 --- fixed

People

(Reporter: jkratzer, Assigned: hiro)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase)

Attachments

(2 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev c8b9ae708d8e.

==56505==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7efe14162c83 bp 0x7efd65134980 sp 0x7efd65134980 T43)
==56505==The signal is caused by a WRITE memory access.
==56505==Hint: address points to the zero page.
    #0 0x7efe14162c82 in MOZ_Crash /src/obj-firefox/dist/include/mozilla/Assertions.h:313:3
    #1 0x7efe14162c82 in GeckoCrash /src/toolkit/xre/nsAppRunner.cpp:5088
    #2 0x7efe16552956 in gkrust_shared::panic_hook::h1120f3fb2ac457fc /src/toolkit/library/rust/shared/lib.rs:248:8
    #3 0x7efe1655287b in core::ops::function::Fn::call::h937d2e9fc9b202f6 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libcore/ops/function.rs:69:4
    #4 0x7efe16e1e3ec in std::panicking::rust_panic_with_hook::hffcefc09751839d1 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:481:16
    #5 0x7efe16e1e14d in std::panicking::continue_panic_fmt::hc0f142c930c846fc /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:384:4
    #6 0x7efe16e2b7c5 in rust_begin_unwind /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:311:4
    #7 0x7efe16e35ddb in core::panicking::panic_fmt::h2daf88b2616ca2b2 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libcore/panicking.rs:85:13
    #8 0x7efe16e3b555 in core::option::expect_failed::h4b77ebe6e62ec3a1 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libcore/option.rs:1034:4
    #9 0x7efe16aacd4b in geckoservo::glue::composite_endpoint::hd4149aa8947ce1e6 /src/servo/ports/geckolib/glue.rs
    #10 0x7efe16aac940 in geckoservo::glue::compose_animation_segment::hd75bf3744028b17d /src/servo/ports/geckolib/glue.rs:530:8
    #11 0x7efe16aac808 in Servo_ComposeAnimationSegment /src/servo/ports/geckolib/glue.rs:604:17
    #12 0x7efe09f7e78c in SampleAnimationForProperty /src/gfx/layers/AnimationHelper.cpp:289:9
    #13 0x7efe09f7e78c in mozilla::layers::AnimationHelper::SampleAnimationForEachNode(mozilla::TimeStamp, mozilla::TimeStamp, mozilla::layers::AnimatedValue const*, nsTArray<mozilla::layers::PropertyAnimationGroup>&, nsTArray<RefPtr<RawServoAnimationValue> >&) /src/gfx/layers/AnimationHelper.cpp:348
    #14 0x7efe0a539ca8 in operator() /src/gfx/layers/composite/AsyncCompositionManager.cpp:698:9
    #15 0x7efe0a539ca8 in mozilla::EnableIf<(IsSame<decltype(fp0(fp)), void>::value) && (IsSame<decltype(fp1(fp)), void>::value), void>::Type mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9, mozilla::EnableIf<IsSame<decltype(fp0(fp)), void>::value, void>::Type mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9>(mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9 const&)::'lambda'(mozilla::layers::Layer*)>(mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9 const&, mozilla::EnableIf<IsSame<decltype(fp0(fp)), void>::value, void>::Type mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9>(mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9 const&)::'lambda'(mozilla::layers::Layer*) const&) /src/gfx/layers/TreeTraversal.h:138
    #16 0x7efe0a53ab41 in mozilla::EnableIf<(IsSame<decltype(fp0(fp)), void>::value) && (IsSame<decltype(fp1(fp)), void>::value), void>::Type mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9, mozilla::EnableIf<IsSame<decltype(fp0(fp)), void>::value, void>::Type mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9>(mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9 const&)::'lambda'(mozilla::layers::Layer*)>(mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9 const&, mozilla::EnableIf<IsSame<decltype(fp0(fp)), void>::value, void>::Type mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9>(mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9 const&)::'lambda'(mozilla::layers::Layer*) const&) /src/gfx/layers/TreeTraversal.h:142:5
    #17 0x7efe0a53ab41 in mozilla::EnableIf<(IsSame<decltype(fp0(fp)), void>::value) && (IsSame<decltype(fp1(fp)), void>::value), void>::Type mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9, mozilla::EnableIf<IsSame<decltype(fp0(fp)), void>::value, void>::Type mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9>(mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9 const&)::'lambda'(mozilla::layers::Layer*)>(mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9 const&, mozilla::EnableIf<IsSame<decltype(fp0(fp)), void>::value, void>::Type mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9>(mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::$_9 const&)::'lambda'(mozilla::layers::Layer*) const&) /src/gfx/layers/TreeTraversal.h:142:5
    #18 0x7efe0a5041fa in ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer *, (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:686:40)> /src/gfx/layers/TreeTraversal.h:166:3
    #19 0x7efe0a5041fa in SampleAnimations /src/gfx/layers/composite/AsyncCompositionManager.cpp:686
    #20 0x7efe0a5041fa in mozilla::layers::AsyncCompositionManager::TransformShadowTree(mozilla::TimeStamp, mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>, mozilla::layers::CompositorBridgeParentBase::TransformsToSkip) /src/gfx/layers/composite/AsyncCompositionManager.cpp:1415
    #21 0x7efe0a608dfa in mozilla::layers::CompositorBridgeParent::CompositeToTarget(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::gfx::DrawTarget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) /src/gfx/layers/ipc/CompositorBridgeParent.cpp:994:28
    #22 0x7efe0a62db08 in mozilla::layers::CompositorVsyncScheduler::Composite(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /src/gfx/layers/ipc/CompositorVsyncScheduler.cpp:251:27
    #23 0x7efe0a66bf4b in applyImpl<mozilla::layers::CompositorVsyncScheduler, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp), StoreCopyPassByConstLRef<mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> >, StoreCopyPassByConstLRef<mozilla::TimeStamp> , 0, 1> /src/obj-firefox/dist/include/nsThreadUtils.h:1124:12
    #24 0x7efe0a66bf4b in apply<mozilla::layers::CompositorVsyncScheduler, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)> /src/obj-firefox/dist/include/nsThreadUtils.h:1130
    #25 0x7efe0a66bf4b in mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp), true, (mozilla::RunnableKind)1, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp>::Run() /src/obj-firefox/dist/include/nsThreadUtils.h:1176
    #26 0x7efe07f4e0e5 in RunTask /src/ipc/chromium/src/base/message_loop.cc:442:9
    #27 0x7efe07f4e0e5 in MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&) /src/ipc/chromium/src/base/message_loop.cc:450
    #28 0x7efe07f4f22b in MessageLoop::DoWork() /src/ipc/chromium/src/base/message_loop.cc:523:13
    #29 0x7efe07f510ba in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /src/ipc/chromium/src/base/message_pump_default.cc:35:31
    #30 0x7efe07f4cbd2 in RunInternal /src/ipc/chromium/src/base/message_loop.cc:315:10
    #31 0x7efe07f4cbd2 in RunHandler /src/ipc/chromium/src/base/message_loop.cc:308
    #32 0x7efe07f4cbd2 in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:290
    #33 0x7efe07f6a790 in base::Thread::ThreadMain() /src/ipc/chromium/src/base/thread.cc:192:16
    #34 0x7efe07f6076c in ThreadFunc(void*) /src/ipc/chromium/src/base/platform_thread_posix.cc:40:13
    #35 0x7efe298b96da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #36 0x7efe2889788e in clone /build/glibc-OTsEL5/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /src/obj-firefox/dist/include/mozilla/Assertions.h:313:3 in MOZ_Crash
Thread T43 (Compositor) created by T0 here:
    #0 0x55f28665229d in __interceptor_pthread_create /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3
    #1 0x7efe07f5bcac in CreateThread /src/ipc/chromium/src/base/platform_thread_posix.cc:123:14
    #2 0x7efe07f5bcac in PlatformThread::Create(unsigned long, PlatformThread::Delegate*, unsigned long*) /src/ipc/chromium/src/base/platform_thread_posix.cc:134
    #3 0x7efe07f69eb3 in base::Thread::StartWithOptions(base::Thread::Options const&) /src/ipc/chromium/src/base/thread.cc:97:8
    #4 0x7efe0a62acaa in CreateCompositorThread /src/gfx/layers/ipc/CompositorThread.cpp:91:26
    #5 0x7efe0a62acaa in mozilla::layers::CompositorThreadHolder::CompositorThreadHolder() /src/gfx/layers/ipc/CompositorThread.cpp:43
    #6 0x7efe0a62b4d1 in mozilla::layers::CompositorThreadHolder::Start() /src/gfx/layers/ipc/CompositorThread.cpp:112:33
    #7 0x7efe0a72353b in gfxPlatform::Init() /src/gfx/thebes/gfxPlatform.cpp:1012:3
    #8 0x7efe0a720f4b in gfxPlatform::GetPlatform() /src/gfx/thebes/gfxPlatform.cpp:498:5
    #9 0x7efe1022334c in mozilla::widget::GfxInfoBase::GetContentBackend(nsTSubstring<char16_t>&) /src/widget/GfxInfoBase.cpp:1517:25
    #10 0x7efe06e77211 in NS_InvokeByIndex /src/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:106
    #11 0x7efe09233d3c in Invoke /src/js/xpconnect/src/XPCWrappedNative.cpp:1650:10
    #12 0x7efe09233d3c in Call /src/js/xpconnect/src/XPCWrappedNative.cpp:1187
    #13 0x7efe09233d3c in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /src/js/xpconnect/src/XPCWrappedNative.cpp:1149
    #14 0x7efe0923a7a9 in GetAttribute /src/js/xpconnect/src/xpcprivate.h:1482:12
    #15 0x7efe0923a7a9 in XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*) /src/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:983
    #16 0x7efe1441bd27 in CallJSNative /src/js/src/vm/Interpreter.cpp:447:13
    #17 0x7efe1441bd27 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:539
    #18 0x7efe14421650 in InternalCall /src/js/src/vm/Interpreter.cpp:594:10
    #19 0x7efe14421650 in Call /src/js/src/vm/Interpreter.cpp:610
    #20 0x7efe14421650 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /src/js/src/vm/Interpreter.cpp:734
    #21 0x7efe1490bfd9 in CallGetter /src/js/src/vm/NativeObject.cpp:2269:12
    #22 0x7efe1490bfd9 in GetExistingProperty<js::CanGC> /src/js/src/vm/NativeObject.cpp:2321
    #23 0x7efe1490bfd9 in NativeGetPropertyInline<js::CanGC> /src/js/src/vm/NativeObject.cpp:2570
    #24 0x7efe1490bfd9 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /src/js/src/vm/NativeObject.cpp:2607
    #25 0x7efe14401718 in GetProperty /src/js/src/vm/ObjectOperations-inl.h:117:10
    #26 0x7efe14401718 in GetObjectElementOperation /src/js/src/vm/Interpreter-inl.h:485
    #27 0x7efe14401718 in GetElementOperation /src/js/src/vm/Interpreter-inl.h:599
    #28 0x7efe14401718 in Interpret(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:2892
    #29 0x7efe143e566f in js::RunScript(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:424:10
    #30 0x7efe1441c82f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:567:13
    #31 0x7efe1441ea52 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /src/js/src/vm/Interpreter.cpp:610:8
    #32 0x7efe14f2e657 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /src/js/src/jsapi.cpp:2659:10
    #33 0x7efe09223048 in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) /src/js/xpconnect/src/XPCWrappedJSClass.cpp:956:17
    #34 0x7efe06e788e6 in PrepareAndDispatch /src/xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:125:37
    #35 0x7efe06e777ea in SharedStub (/home/worker/builds/m-c-20190828214452-fuzzing-asan-opt/libxul.so+0x2fab7ea)
    #36 0x7efe06df5183 in NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) /src/xpcom/components/nsCategoryManager.cpp:676:19
    #37 0x7efe1417ee2b in nsXREDirProvider::DoStartup() /src/toolkit/xre/nsXREDirProvider.cpp:1021:11
    #38 0x7efe1415d930 in XREMain::XRE_mainRun() /src/toolkit/xre/nsAppRunner.cpp:4393:16
    #39 0x7efe1416048e in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4711:8
    #40 0x7efe1416249e in XRE_main(int, char**, mozilla::BootstrapConfig const&) /src/toolkit/xre/nsAppRunner.cpp:4792:21
    #41 0x55f28669c9d4 in do_main /src/browser/app/nsBrowserApp.cpp:213:22
    #42 0x55f28669c9d4 in main /src/browser/app/nsBrowserApp.cpp:295
    #43 0x7efe28797b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

==56505==ABORTING
Flags: in-testsuite?

Testcase bisects to the following range:

Start: 92d1c344e7c53af9b8ad8a4192d93478f71ba5cf (20190402154905)
End: 48ae682107da10c0d8ffbdf6e1a10771c5fd2e05 (20190402214908)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=92d1c344e7c53af9b8ad8a4192d93478f71ba5cf&tochange=48ae682107da10c0d8ffbdf6e1a10771c5fd2e05

Matt, could this be related to your changes?

Flags: needinfo?(matt.woodrow)

This is an animation bug. We need to copy KeyframeEffect::mBaseValues in the copy constructor of KeyframeEffect. I don't know efficient ways to copy the hash table though.

This is bit worrisome, setting P2.

Component: Graphics: Layers → DOM: Animation
Priority: -- → P2
Flags: needinfo?(matt.woodrow)

I am suspecting this is at least one of the cause of bug 1581121.

Assignee: nobody → hikezoe.birchill
Group: core-security
Status: NEW → ASSIGNED

How's that? This is just a safe panic because we don't find the base value.

That's definitely not how 1581121 looks like, and bug 1581121 is architecture specific, so it doesn't make sense... Am I missing something?

Flags: needinfo?(hikezoe.birchill)

This doesn't look like a security bug to me, we're just effectively failing a release assertion here:

I am not sure yet, I could just reproduce crashes on local opt builds on m-c. Just wondering when the release assertion happens the message is output on opt builds? I don't see the message there.

Flags: needinfo?(hikezoe.birchill)

(In reply to Hiroyuki Ikezoe (:hiro) from comment #7)

I am not sure yet, I could just reproduce crashes on local opt builds on m-c. Just wondering when the release assertion happens the message is output on opt builds? I don't see the message there.

It should, but not in stderr. You should see it in the crash report though. See the MOZ_CRASH Reason field:

https://crash-stats.mozilla.org/report/index/8b828f11-cbe1-4ed2-8dc7-84ad70191003

We should have an underlying value

The reason I didn't get the message is that I am using a slightly different test case which is not including kf_effect.composite = 'accumulate'. In such cases we fail unwrap here, so you are right, this is not related to bug 1581121 at all. A crash report related to this I found is: bp-8b828f11-cbe1-4ed2-8dc7-84ad70191003.

Oops, the crash is the same as Emilio posted in comment 8, so it's not the same as what I see locally.

Once after I set the security sensitive flag, I can't clear the flag, didn't know that. :/

Can we get the security flag removed? See above, this is just effectively a release assertion failure / rust panic.

Flags: needinfo?(dveditz)

To reproduce the crash setting dom.animations-api.implicit-keyframes.enabled which is prefed on only on nightly is required.

The original test case doesn't crash reliably but the test case in this commit
crashes 100% locally without this fix.

Group: core-security
Flags: needinfo?(dveditz)
Pushed by hikezoe.birchill@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/5b8b04d1fd7d
Copy KeyframeEffect::mBaseStyle in the KeyframeEffect copy constructor. r=boris
Status: ASSIGNED → RESOLVED
Closed: 6 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla71

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.