1670327 - Assertion failure: IsAncestorFrameCrossDoc(aAncestor.mFrame, aFrame) (Fix the caller), at src/layout/base/nsLayoutUtils.cpp:2486

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Assertion failure: IsAncestorFrameCrossDoc(aAncestor.mFrame, aFrame) (Fix the caller), at src/layout/base/nsLayoutUtils.cpp:2486

#0 0x7f95128ec39e in nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame const*, nsRect const&, mozilla::RelativeTo, bool*, mozilla::Maybe<mozilla::gfx::Matrix4x4TypedFlagged<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> >*, bool, nsIFrame**) src/layout/base/nsLayoutUtils.cpp:2485:3
#1 0x7f950fa8039a in TransformFrameRectToAncestor src/layout/base/nsLayoutUtils.h:804:12
#2 0x7f950fa8039a in ComputeTheIntersection src/dom/base/DOMIntersectionObserver.cpp:379:7
#3 0x7f950fa8039a in mozilla::dom::DOMIntersectionObserver::Update(mozilla::dom::Document*, double) src/dom/base/DOMIntersectionObserver.cpp:604:26
#4 0x7f950fc2b231 in mozilla::dom::Document::UpdateIntersectionObservations(mozilla::TimeStamp) src/dom/base/Document.cpp:15151:17
#5 0x7f951282e627 in nsRefreshDriver::UpdateIntersectionObservations(mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:1811:10
#6 0x7f951282cf32 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2267:3
#7 0x7f9512834931 in TickDriver src/layout/base/nsRefreshDriver.cpp:374:13
#8 0x7f9512834931 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:353:7
#9 0x7f951283481c in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:368:5
#10 0x7f9512833dc8 in RunRefreshDrivers src/layout/base/nsRefreshDriver.cpp:829:5
#11 0x7f9512833dc8 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:747:16
#12 0x7f95128336d0 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() src/layout/base/nsRefreshDriver.cpp:649:7
#13 0x7f9512833149 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:570:9
#14 0x7f9512bf08b7 in mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:55:16
#15 0x7f950eed4d65 in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:187:54
#16 0x7f950ec8b3ed in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6080:32
#17 0x7f950e95393e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2150:25
#18 0x7f950e9500ff in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2074:9
#19 0x7f950e951506 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1922:3
#20 0x7f950e95212b in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1953:13
#21 0x7f950e04f75f in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:245:16
#22 0x7f950e04cbba in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:515:26
#23 0x7f950e04ba94 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:374:15
#24 0x7f950e04bc47 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:171:36
#25 0x7f950e052ea9 in operator() src/xpcom/threads/TaskController.cpp:88:37
#26 0x7f950e052ea9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
#27 0x7f950e064e9f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1234:14
#28 0x7f950e06a95a in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:513:10
#29 0x7f950e959144 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:109:5
#30 0x7f950e8cb913 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#31 0x7f950e8cb82d in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
#32 0x7f950e8cb82d in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#33 0x7f9512587de8 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#34 0x7f9513d7a1e3 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:913:20
#35 0x7f950e959f59 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:237:9
#36 0x7f950e8cb913 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#37 0x7f950e8cb82d in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
#38 0x7f950e8cb82d in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#39 0x7f9513d79dc8 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:744:34
#40 0x5592aed87917 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#41 0x5592aed87917 in main src/browser/app/nsBrowserApp.cpp:304:18
#42 0x7f952292b0b2 in __libc_start_main /build/glibc-ZN95T4/glibc-2.31/csu/../csu/libc-start.c:308:16
#43 0x5592aed656c9 in _start (/home/worker/builds/m-c-20201008094950-fuzzing-debug/firefox-bin+0x176c9)

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/z3Kroc8XLOfoK7q5XJ-gUw/index.html

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201009214545-cad2c1678593.
The bug appears to have been introduced in the following build range:

Start: a3e34680e841fb4e55a5cf17622daf62eb1c673f (20201002012040)
End: c54385f18d19901f0846dea0c4cee45676c8cf97 (20201002021059)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a3e34680e841fb4e55a5cf17622daf62eb1c673f&tochange=c54385f18d19901f0846dea0c4cee45676c8cf97

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Attachment: A bit more straight-forward test-case

(That doesn't rely on the PiP intersection observer).

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1670327 - Fix more IntersectionObserver issues. r=hiro

Two spec issues here.

https://github.com/w3c/IntersectionObserver/issues/457: I think this is
just a spec bug and I've made us match other browsers, but since the
tests don't match the spec for now I've added them as .tentative.html

https://github.com/w3c/IntersectionObserver/issues/456: I've aligned
with WebKit here. There was a (disabled) test for this which tests
chrome behavior and which after this patch shouldn't be flaky. This is
what was causing the assertion.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a083e04138aa
Fix more IntersectionObserver issues. r=hiro

Comment 6

[Razvan Maries]

Backed out for perma failures.

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=pending%2Crunning%2Csuccess%2Ctestfailed%2Cbusted%2Cexception&searchStr=linux%2C18.04%2Cx64%2Casan%2Copt%2Cweb%2Cplatform%2Ctests%2Ctest-linux1804-64-asan%2Fopt-web-platform-tests-e10s%2Cwpt15&revision=a083e04138aa3daf8fbfbd231ab02aab4f234ba4&selectedTaskRun=CdXA701tSGiSVHCpwiJ4MQ.0

Log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=318341102&repo=autoland&lineNumber=1841

Backout: https://hg.mozilla.org/integration/autoland/rev/71b733d6d4eeac253ee4fed5b44591400d20ecec

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2906a77771b3
Fix more IntersectionObserver issues. r=hiro

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1668156

Comment 9

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/2906a77771b3

Comment 10

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20201012152719-61618dc9e8bf.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/26215 for changes under testing/web-platform/tests

Comment 12

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot