1608858 - Assertion failure: animation->IsRelevant() (Only relevant animations should be added to an element's effect set), at /builds/worker/workspace/build/src/dom/base/Element.cpp:3349

Status: RESOLVED FIXED

(Core :: DOM: Animation, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 7295ca89e880.

Assertion failure: animation->IsRelevant() (Only relevant animations should be added to an element's effect set), at /builds/worker/workspace/build/src/dom/base/Element.cpp:3349

rax = 0x000055ed13db8320   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007f617e1a6e16
rsi = 0x00007f6189ec48b0   rdi = 0x00007f6189ec3680
rbp = 0x00007ffc5258a950   rsp = 0x00007ffc5258a8a0
r8 = 0x00007f6189ec48b0    r9 = 0x00007f618b02b780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007ffc5258a8a8   r13 = 0x00007ffc5258a8e0
r14 = 0x00007ffc5258a9f0   r15 = 0x00007f6155c2fe80
rip = 0x00007f617932a458
OS|Linux|0.0.0 Linux 5.0.0-36-generic #39~18.04.1-Ubuntu SMP Tue Nov 12 11:09:50 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::Element::GetAnimationsUnsorted(mozilla::dom::Element*, mozilla::PseudoStyleType, nsTArray<RefPtr<mozilla::dom::Animation> >&)|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|3334|0x2e
0|1|libxul.so|mozilla::dom::Element::GetAnimations(mozilla::dom::GetAnimationsOptions const&, nsTArray<RefPtr<mozilla::dom::Animation> >&, mozilla::dom::Element::Flush)|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|3305|0xe
0|2|libxul.so|mozilla::dom::Element_Binding::getAnimations|s3:gecko-generated-sources:ce5f1b92c75a855fe229d4dbc21e14fc76fdee3aeac44f86d10ddb95f36143d16b4a748401867b14c2585b726294619723a2c64283a28ea569d1b97c7d4ec7a0/dom/bindings/ElementBinding.cpp:|5106|0x14
0|3|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|3151|0x21
0|4|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|452|0x19
0|5|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|544|0x12
0|6|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|608|0x10
0|7|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|3042|0x16
0|8|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|388|0xfe
0|9|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|580|0xf
0|10|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|608|0x10
0|11|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|625|0x8
0|12|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|2786|0x1f
0|13|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:9ca8646d8042e9b4b76d2e1b358b984be17743b71b832c0897d61bb500e0fecbe38fa54273dc522878c87fcb2c9bfd274a8190c7bc56fbbb58cb3ca68462e527/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|14|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|15|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|1263|0x1c
0|16|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|326|0x6b
0|17|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|558|0x12
0|18|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|1056|0x1a
0|19|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|1161|0x16
0|20|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|1119|0x5
0|21|libxul.so|nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|4094|0x2a
0|22|libxul.so|nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|4064|0x16
0|23|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|7182|0x5
0|24|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:7295ca89e880c1c930643e72ff0600cb71cebb9e|1216|0x5
0|25|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|1248|0x15
0|26|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|486|0x11
0|27|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|87|0xa
0|28|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:7295ca89e880c1c930643e72ff0600cb71cebb9e|315|0x19
0|29|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:7295ca89e880c1c930643e72ff0600cb71cebb9e|290|0x8
0|30|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|137|0xd
0|31|libxul.so|nsAppStartup::Run()|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|272|0x10
0|32|libxul.so|XREMain::XRE_mainRun()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|4594|0x16
0|33|libxul.so|XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|4731|0x8
0|34|libxul.so|XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|4812|0x5
0|35|firefox-bin|do_main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|217|0x26
0|36|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|339|0xf
0|37|libc-2.27.so||||0x21b97
0|38|firefox-bin|__cxa_throw_bad_array_new_length|hg:hg.mozilla.org/mozilla-central:build/unix/stdc++compat/stdc++compat.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|82|0x12
0|39|firefox-bin|_GLOBAL__sub_I_TimeStamp.cpp|hg:hg.mozilla.org/mozilla-central:mozglue/misc/TimeStamp.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|150|0x4b
0|40|||||0x7ffc5258dea0
0|41|ld-2.27.so||||0x10733
0|42|libdl-2.27.so||||0x202d80
0|43|libpthread-2.27.so||||0x219bb0
0|44|firefox-bin|_GLOBAL__sub_I_TimeStamp.cpp|hg:hg.mozilla.org/mozilla-central:mozglue/misc/TimeStamp.cpp:7295ca89e880c1c930643e72ff0600cb71cebb9e|150|0x4b
0|45|||||0x7ffc5258dea0
0|46|firefox-bin|_start|||0x29

Comment 1

[Brian Birtles (:birtles, Feb 26~ parental leave)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=a0370b92bc4c5339583fd81827fcb10c93889652
(Accidentally pushed Daisuke's DevTools patch as well, but oh well)

Comment 2

[Brian Birtles (:birtles, Feb 26~ parental leave)]

Attachment: Bug 1608858 - Update the effect set when an animation changes relevance due to a call to updatePlaybackRate; r?boris

In this particular case where we're paused, we don't need to repaint or
synchronize animations on layers, but we do need to update the effect set so
that getAnimations() returns the correct result.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/450d16df2770
Update the effect set when an animation changes relevance due to a call to updatePlaybackRate; r=boris

Comment 4

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/21524 for changes under testing/web-platform/tests

Comment 5

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Can't merge web-platform-tests PR due to failing upstream checks:
Github PR https://github.com/web-platform-tests/wpt/pull/21524
* Community-TC (pull_request) (https://community-tc.services.mozilla.com/tasks/groups/XS-jM-bUSsCmXiGGwMjPPQ)

Comment 6

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/450d16df2770

Comment 7

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged by stephenmcgruer