1656517 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Transition effect has unexpected shape), at /builds/worker/checkouts/gecko/dom/animation/CSSTransition.cpp:333

Status: NEW

(Core :: DOM: Animation, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 161920b70ae4 (built with --enable-debug).

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Transition effect has unexpected shape), at /builds/worker/checkouts/gecko/dom/animation/CSSTransition.cpp:333

    #0 0x7fb25ff04aee in AnnotateMozCrashReason /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:42:19
    #1 0x7fb25ff04aee in mozilla::dom::CSSTransition::SetEffectFromStyle(mozilla::dom::AnimationEffect*) /builds/worker/checkouts/gecko/dom/animation/CSSTransition.cpp:333:5
    #2 0x7fb262ba3aa9 in nsTransitionManager::ConsiderInitiatingTransition(nsCSSPropertyID, nsStyleDisplay const&, unsigned int, mozilla::dom::Element*, mozilla::PseudoStyleType, mozilla::AnimationCollection<mozilla::dom::CSSTransition>*&, mozilla::ComputedStyle const&, mozilla::ComputedStyle const&, nsCSSPropertyIDSet&) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:465:14
    #3 0x7fb262ba2768 in nsTransitionManager::DoUpdateTransitions(nsStyleDisplay const&, mozilla::dom::Element*, mozilla::PseudoStyleType, mozilla::AnimationCollection<mozilla::dom::CSSTransition>*&, mozilla::ComputedStyle const&, mozilla::ComputedStyle const&) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:109:23
    #4 0x7fb262ba252c in nsTransitionManager::UpdateTransitions(mozilla::dom::Element*, mozilla::PseudoStyleType, mozilla::ComputedStyle const&, mozilla::ComputedStyle const&) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:66:10
    #5 0x7fb262b32895 in Gecko_UpdateAnimations /builds/worker/checkouts/gecko/layout/style/GeckoBindings.cpp:557:39
    #6 0x7fb266ff398e in _$LT$style..gecko..wrapper..GeckoElement$u20$as$u20$style..dom..TElement$GT$::update_animations::h7af453f362785f77 /builds/worker/checkouts/gecko/servo/components/style/gecko/wrapper.rs:1525:12
    #7 0x7fb266b4aab1 in style::context::SequentialTask$LT$E$GT$::execute::h7f0b90747ef044fa /builds/worker/checkouts/gecko/servo/components/style/context.rs:499:16
    #8 0x7fb266b4aab1 in _$LT$style..context..SequentialTaskList$LT$E$GT$$u20$as$u20$core..ops..drop..Drop$GT$::drop::h92d30ffbe013aa06 /builds/worker/checkouts/gecko/servo/components/style/context.rs:627:12
    #9 0x7fb266b4aab1 in core::ptr::drop_in_place::h75378d1bc0d5a747 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/ptr/mod.rs:177
    #10 0x7fb266b4aab1 in core::ptr::drop_in_place::h4d77a02bca3e4789 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/ptr/mod.rs:177
    #11 0x7fb266d20fee in style::driver::traverse_dom::h8837a6ab3a365c48 /builds/worker/checkouts/gecko/servo/components/style/driver.rs:193
    #12 0x7fb266d20fee in geckoservo::glue::traverse_subtree::h02e1a994f9d0aa10 /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:259:4
    #13 0x7fb266d22070 in Servo_TraverseSubtree /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:319:4
    #14 0x7fb262b612a9 in mozilla::ServoStyleSet::StyleDocument(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/style/ServoStyleSet.cpp:732:9
    #15 0x7fb262c0bb22 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:2986:20
    #16 0x7fb262be6329 in ProcessPendingRestyles /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3116:3
    #17 0x7fb262be6329 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4190:39
    #18 0x7fb2600a75cb in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1421:5
    #19 0x7fb2600a75cb in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:10091:16
    #20 0x7fb25f6e346d in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:702:14
    #21 0x7fb25f6e4538 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:640:5
    #22 0x7fb25f6e4d8c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp
    #23 0x7fb25e34bb66 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:615:22
    #24 0x7fb25e34d063 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:522:10
    #25 0x7fb2600a9f9f in mozilla::dom::Document::DoUnblockOnload() /builds/worker/checkouts/gecko/dom/base/Document.cpp:10789:18
    #26 0x7fb2600895f0 in mozilla::dom::Document::UnblockOnload(bool) /builds/worker/checkouts/gecko/dom/base/Document.cpp:10719:9
    #27 0x7fb262b4c345 in UnblockOnload /builds/worker/checkouts/gecko/layout/style/Loader.cpp:2244:16
    #28 0x7fb262b4c345 in mozilla::css::SheetLoadData::FireLoadEvent(nsIThreadInternal*) /builds/worker/checkouts/gecko/layout/style/Loader.cpp:450:12
    #29 0x7fb262b4c4ec in AfterProcessNextEvent /builds/worker/checkouts/gecko/layout/style/Loader.cpp:423:3
    #30 0x7fb262b4c4ec in non-virtual thunk to mozilla::css::SheetLoadData::AfterProcessNextEvent(nsIThreadInternal*, bool) /builds/worker/checkouts/gecko/layout/style/Loader.cpp
    #31 0x7fb25e1d5728 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1258:3
    #32 0x7fb25e1dadda in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #33 0x7fb25eae2e3f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #34 0x7fb25ea54293 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #35 0x7fb25ea541ad in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #36 0x7fb25ea541ad in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #37 0x7fb262930e38 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #38 0x7fb264145ab3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #39 0x7fb25eae3c07 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #40 0x7fb25ea54293 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #41 0x7fb25ea541ad in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #42 0x7fb25ea541ad in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #43 0x7fb264145652 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #44 0x563e2833358f in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #45 0x563e2833358f in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
    #46 0x7fb279718b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310

Comment 1

[Mayank Bansal]

https://crash-stats.mozilla.org/report/index/cca82906-4054-4ad3-9c8f-913ab0200801#tab-bugzilla

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200804091327-7cb90fa4f485.
The bug appears to have been introduced in the following build range:
> Start: 3c3e1e10767c47f5cd94fa938afd21ecb5037cb2 (20200722110937)
> End: 64ec8fabcc2d21a1d3a95a4881134873633f1b50 (20200722115525)
> Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3c3e1e10767c47f5cd94fa938afd21ecb5037cb2&tochange=64ec8fabcc2d21a1d3a95a4881134873633f1b50

Comment 3

[Brian Birtles (:birtles)]

Probably a dupe of bug 1655814 (and that regression range seems unlikely).

Comment 4

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20201212092303-8491ac4866e8) but not with tip (mozilla-central 20211211094335-08aba69fa7b0.)
The bug appears to have been fixed in the following build range:

Start: 6bc03c706ffa81514efb39d12640ba6b673f569a (20210224163826)
End: da6d2c6a91fe688b888582bfd3ceb7e30159eaca (20210224163915)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=6bc03c706ffa81514efb39d12640ba6b673f569a&tochange=da6d2c6a91fe688b888582bfd3ceb7e30159eaca
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Setting regressed_by field after analyzing regression range found by bugmon.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1653556

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1653556