1617900 - Assertion failure: previousValue->Transform() .mTransformInDevSpace.FuzzyEqualsMultiplicative( transformInDevice), at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:726

Status: NEW

(Core :: Graphics: Layers, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

The following testcase crashes on mozilla-central rev 81f420f057e4 (build with --enable-debug --enable-fuzzing).

Assertion failure: previousValue->Transform() .mTransformInDevSpace.FuzzyEqualsMultiplicative( transformInDevice), at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:726

rax = 0x00005594e2a93340   rdx = 0x0000000000000000
rcx = 0x00007f2580ed4637   rbx = 0x00007f2562a1cf40
rsi = 0x00007f258cccd8b0   rdi = 0x00007f258cccc680
rbp = 0x00007f258c841410   rsp = 0x00007f258c841310
r8 = 0x00007f258cccd8b0    r9 = 0x00007f258c842700
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x00007f258c8417c8   r13 = 0x00007f2568ca9800
r14 = 0x00007f258c841398   r15 = 0x00007f258c841358
rip = 0x00007f257bd26633
OS|Linux|0.0.0 Linux 5.3.0-28-generic #30~18.04.1-Ubuntu SMP Fri Jan 17 06:14:09 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|2
2|0|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>, mozilla::layers::ForEachNode(Node, const PreAction&) [with Iterator = mozilla::layers::ForwardIterator; Node = mozilla::layers::Layer*; PreAction = mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>]::<lambda(mozilla::layers::Layer*)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:81f420f057e45d76c2ea5a9533588341154c92fb|138|0x1ea
2|1|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>, mozilla::layers::ForEachNode(Node, const PreAction&) [with Iterator = mozilla::layers::ForwardIterator; Node = mozilla::layers::Layer*; PreAction = mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>]::<lambda(mozilla::layers::Layer*)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:81f420f057e45d76c2ea5a9533588341154c92fb|142|0x19
2|2|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>, mozilla::layers::ForEachNode(Node, const PreAction&) [with Iterator = mozilla::layers::ForwardIterator; Node = mozilla::layers::Layer*; PreAction = mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>]::<lambda(mozilla::layers::Layer*)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:81f420f057e45d76c2ea5a9533588341154c92fb|142|0x19
2|3|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>, mozilla::layers::ForEachNode(Node, const PreAction&) [with Iterator = mozilla::layers::ForwardIterator; Node = mozilla::layers::Layer*; PreAction = mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>]::<lambda(mozilla::layers::Layer*)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:81f420f057e45d76c2ea5a9533588341154c92fb|142|0x19
2|4|libxul.so|mozilla::layers::AsyncCompositionManager::TransformShadowTree(mozilla::TimeStamp, mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>, mozilla::layers::CompositorBridgeParentBase::TransformsToSkip)|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:81f420f057e45d76c2ea5a9533588341154c92fb|1449|0x86
2|5|libxul.so|mozilla::layers::CompositorBridgeParent::CompositeToTarget(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::gfx::DrawTarget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorBridgeParent.cpp:81f420f057e45d76c2ea5a9533588341154c92fb|1022|0x1d
2|6|libxul.so|mozilla::layers::CompositorVsyncScheduler::Composite(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorVsyncScheduler.cpp:81f420f057e45d76c2ea5a9533588341154c92fb|250|0x6
2|7|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp), true, (mozilla::RunnableKind)1, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:81f420f057e45d76c2ea5a9533588341154c92fb|1212|0x17
2|8|libxul.so|MessageLoop::RunTask(already_AddRefed<nsIRunnable>)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:81f420f057e45d76c2ea5a9533588341154c92fb|442|0x45
2|9|libxul.so|MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:81f420f057e45d76c2ea5a9533588341154c92fb|448|0x17
2|10|libxul.so|MessageLoop::DoWork()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:81f420f057e45d76c2ea5a9533588341154c92fb|502|0x71
2|11|libxul.so|base::MessagePumpDefault::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_pump_default.cc:81f420f057e45d76c2ea5a9533588341154c92fb|35|0x9
2|12|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:81f420f057e45d76c2ea5a9533588341154c92fb|315|0x19
2|13|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:81f420f057e45d76c2ea5a9533588341154c92fb|290|0x8
2|14|libxul.so|base::Thread::ThreadMain()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/thread.cc:81f420f057e45d76c2ea5a9533588341154c92fb|192|0x8
2|15|libxul.so|ThreadFunc|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/platform_thread_posix.cc:81f420f057e45d76c2ea5a9533588341154c92fb|40|0x3
2|16|libpthread-2.27.so||||0x76db
2|17|libc-2.27.so||||0x12188f

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: prefs.js

Comment 2

[Jason Kratzer [:jkratzer]]

BugMon: Verified bug as reproducible on 81f420f057e45d76c2ea5a9533588341154c92fb

Comment 3

[Jason Kratzer [:jkratzer]]

Bugmon: Reduced build range to...
> Start: 7c3489dfee6082bec00f05d0f02f502ec4686743 (20191008041542)
> End: 035f52aed4427b22facfa883067e298f10ef9e97 (20191008093420)
> Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7c3489dfee6082bec00f05d0f02f502ec4686743&tochange=035f52aed4427b22facfa883067e298f10ef9e97

Comment 4

[Hiroyuki Ikezoe (:hiro)]

Thank you Jason! Probably https://hg.mozilla.org/mozilla-central/rev/bb30c0d750556c4db5163efe7f00c3067b1d955c .

Comment 5

[Boris Chiou [:boris]]

I can reproduce this on Linux last week, but now I cannot on Mac. Will try again later on linux.

Comment 6

[Boris Chiou [:boris]]

Attachment: reordered_test

Comment 7

[Boris Chiou [:boris]]

Comment on attachment 9132718 [details]
reordered_test

This can be reproduced by replacing `'rotate': ['0deg', '45deg']` with `transform': ['rotate(0deg)', 'rotate(45deg)']}`. In other words, this is an issue related to web animations and transform compositor animations.

Comment 8

[Boris Chiou [:boris]]

Attachment: reordered_test