1662802 - Assertion failure: HasEffectiveAnimationOfProperty(property.mProperty, *effectSet) (There should be an effective animation of the property while it is marked as being run on the compositor), at /builds/worker/checkouts/gecko/dom/animation/KeyframeEffect.c

Status: NEW

(Core :: DOM: Animation, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev b74ab1682dea (built with --enable-debug).

Assertion failure: HasEffectiveAnimationOfProperty(property.mProperty, *effectSet) (There should be an effective animation of the property while it is marked as being run on the compositor), at /builds/worker/checkouts/gecko/dom/animation/KeyframeEffect.cpp:1495

    #0 0x7f610400f7cb in mozilla::dom::KeyframeEffect::CanThrottle() const /builds/worker/checkouts/gecko/dom/animation/KeyframeEffect.cpp:1493:5
    #1 0x7f6103ffe54c in mozilla::dom::KeyframeEffect::NotifyAnimationTimingUpdated(mozilla::PostRestyleMode) /builds/worker/checkouts/gecko/dom/animation/KeyframeEffect.cpp:192:9
    #2 0x7f6103ffdc30 in UpdateEffect /builds/worker/checkouts/gecko/dom/animation/Animation.cpp:1606:23
    #3 0x7f6103ffdc30 in mozilla::dom::Animation::UpdateTiming(mozilla::dom::Animation::SeekFlag, mozilla::dom::Animation::SyncNotifyFlag) /builds/worker/checkouts/gecko/dom/animation/Animation.cpp:1545:3
    #4 0x7f6103ffb145 in mozilla::dom::Animation::Tick() /builds/worker/checkouts/gecko/dom/animation/Animation.cpp:842:3
    #5 0x7f6104006e12 in mozilla::dom::DocumentTimeline::MostRecentRefreshTimeUpdated() /builds/worker/checkouts/gecko/dom/animation/DocumentTimeline.cpp:172:16
    #6 0x7f6106c11c2a in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2051:12
    #7 0x7f6106c19621 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:372:13
    #8 0x7f6106c19621 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:351:7
    #9 0x7f6106c1950c in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:366:5
    #10 0x7f6106c1ed18 in RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:818:5
    #11 0x7f6106c1ed18 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:736:16
    #12 0x7f6106c1e611 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:638:7
    #13 0x7f6106c1788d in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:537:20
    #14 0x7f610246bf5f in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:242:16
    #15 0x7f6102469fda in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:512:26
    #16 0x7f6102469134 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:371:15
    #17 0x7f61024692e7 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:168:36
    #18 0x7f6102470c96 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:83:37
    #19 0x7f6102470c96 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #20 0x7f610248409f in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1234:14
    #21 0x7f6102489a4a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #22 0x7f6102d819f6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #23 0x7f6102cf4613 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #24 0x7f6102cf452d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #25 0x7f6102cf452d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #26 0x7f610697da08 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #27 0x7f6108153693 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #28 0x7f6102d827b9 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #29 0x7f6102cf4613 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #30 0x7f6102cf452d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #31 0x7f6102cf452d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #32 0x7f6108153278 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #33 0x5601c92f5957 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #34 0x5601c92f5957 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
    #35 0x7f611dc54b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200902215721-85e7a3055098.
Failed to bisect testcase (Start build crashes!):
> Start: e8b7c48d4e7ed1b63aeedff379b51e566ea499d9 (20191107015224)
> End: 00a15ff99b87cc88718646c76b48a5ea54943c52 (20200902033114)
> BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1662802 using build mozilla-central 20200902095359-b74ab1682dea. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Update test case.

Comment 4

[Tyson Smith [:tsmith]]

This issue has been reported by live site testing.

Comment 5

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20230805091901-e8c6dc4a318c) but not with tip (mozilla-central 20240802153712-c38029641964.)

The bug appears to have been fixed in the following build range:

Start: 54882b6de6ac255482abf21e352f2337a1317d3f (20240417060010)
End: acabdf625d68e5d96c49e0eebb5c71f4286e5ffd (20240417082406)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=54882b6de6ac255482abf21e352f2337a1317d3f&tochange=acabdf625d68e5d96c49e0eebb5c71f4286e5ffd

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 6

[Jason Kratzer [:jkratzer]]

This issue still reproduces on mozilla-central revision ee094976d8e3 (20240814), though not as consistently as before. I'll re-enable bugmon for now.

Comment 7

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20230819093323-981402028450) but not with tip (mozilla-central 20240817092931-6be560f613e3.)

Unable to bisect testcase (End build crashes!):

Start: 9814020284505cbc4a6075b3b7aba216be0632f8 (20230819093323)
End: 6be560f613e3c174f81bf8ddd2359567d954afdb (20240817092931)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[Jason Kratzer [:jkratzer]]

This still reproduces on tip. I'm going to leave bugmon disabled to prevent spamming this bug.