1681955 - Assertion failure: mIsRootContent, in FrameMetrics::GetCompositionSizeWithoutDynamicToolbar()

Status: RESOLVED FIXED

(Core :: Panning and Zooming, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Testcase found while fuzzing mozilla-central rev 91a89ecd1d3a (built with --enable-debug).

Assertion failure: mIsRootContent, at /builds/worker/checkouts/gecko/gfx/layers/FrameMetrics.h:445

    #0 0x7f7f5ad7e7f5 in mozilla::layers::AsyncPanZoomController::NotifyLayersUpdated(mozilla::layers::ScrollMetadata const&, bool, bool) /builds/worker/checkouts/gecko/gfx/layers/apz/src/AsyncPanZoomController.cpp
    #1 0x7f7f5ad8ae69 in mozilla::layers::HitTestingTreeNode* mozilla::layers::APZCTreeManager::PrepareNodeForLayer<mozilla::layers::LayerMetricsWrapper>(mozilla::RecursiveMutexAutoLock const&, mozilla::layers::LayerMetricsWrapper const&, mozilla::layers::FrameMetrics const&, mozilla::layers::LayersId, mozilla::layers::AncestorTransform const&, mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*, mozilla::layers::APZCTreeManager::TreeBuildingState&) /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:1287:11
    #2 0x7f7f5ad8828e in void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper)::operator()(mozilla::layers::LayerMetricsWrapper) const /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:465:38
    #3 0x7f7f5ad86415 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:139:3
    #4 0x7f7f5ad86449 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
    #5 0x7f7f5ad86449 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
    #6 0x7f7f5ad86449 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
    #7 0x7f7f5ad86449 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
    #8 0x7f7f5ad864f4 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
    #9 0x7f7f5ad3a33e in void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int) /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:433:5
    #10 0x7f7f5ad6150c in UpdateHitTestingTree /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:695:3
    #11 0x7f7f5ad6150c in mozilla::layers::APZUpdater::UpdateHitTestingTree(mozilla::layers::Layer*, bool, mozilla::layers::LayersId, unsigned int) /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZUpdater.cpp:169:9
    #12 0x7f7f5aeb55ed in mozilla::layers::CompositorBridgeParent::NotifyShadowTreeTransaction(mozilla::layers::LayersId, bool, mozilla::layers::FocusTarget const&, bool, unsigned int, bool, bool) /builds/worker/checkouts/gecko/gfx/layers/ipc/CompositorBridgeParent.cpp:833:22
    #13 0x7f7f5aed266c in mozilla::layers::ContentCompositorBridgeParent::ShadowLayersUpdated(mozilla::layers::LayerTransactionParent*, mozilla::layers::TransactionInfo const&, bool) /builds/worker/checkouts/gecko/gfx/layers/ipc/ContentCompositorBridgeParent.cpp:354:19
    #14 0x7f7f5aee7193 in mozilla::layers::LayerTransactionParent::RecvUpdate(mozilla::layers::TransactionInfo const&) /builds/worker/checkouts/gecko/gfx/layers/ipc/LayerTransactionParent.cpp:444:22
    #15 0x7f7f5a3a06ca in mozilla::layers::PLayerTransactionParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PLayerTransactionParent.cpp:132:66
    #16 0x7f7f5a18610b in mozilla::layers::PCompositorManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCompositorManagerParent.cpp:205:32
    #17 0x7f7f5a041d4e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2153:25
    #18 0x7f7f5a03e34d in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2077:9
    #19 0x7f7f5a03f7f6 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1925:3
    #20 0x7f7f5a04053b in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1956:13
    #21 0x7f7f5973f25f in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1200:14
    #22 0x7f7f5974527a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #23 0x7f7f5a0487fd in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:302:20
    #24 0x7f7f59fb3b43 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #25 0x7f7f59fb3a5d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #26 0x7f7f59fb3a5d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #27 0x7f7f5973b95e in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:441:10
    #28 0x7f7f6dc9eabb in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #29 0x7f7f6e210608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477:8
    #30 0x7f7f6ddd9292 in clone /build/glibc-ZN95T4/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Hiroyuki Ikezoe (:hiro)]

Will look into this.

Comment 2

[Botond Ballo [:botond]]

It looks to me like the page is doing something (replacing document.documentElement and such) that is causing mIsRootContent to change from true to false. I think this is a case that APZ does not expect outside of the first-paint branch.

One option here would be to take the first-paint branch if mIsRootContent has changed. Another option would be to just update mIsRootContent in the other branch (where we update the other fields), though I wonder if there may be other state tied to mIsRootContent that APZ does not expect to change.

Comment 3

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20201215092954-f805f27183c3
mozilla-central 20201211044732-0e369db666c2
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 4

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201215092954-f805f27183c3.
The bug appears to have been introduced in the following build range:

Start: aabd0cfc1ac7c0e52d948abac103f4b52e439806 (20201104031814)
End: dfc2063b5c583ad2795b20c879642200def828cb (20201104042202)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=aabd0cfc1ac7c0e52d948abac103f4b52e439806&tochange=dfc2063b5c583ad2795b20c879642200def828cb

Comment 5

[Pascal Chevrel:pascalc]

Hiro, what is the status of this bug wrt our upcoming releases? thanks

Comment 6

[Botond Ballo [:botond]]

(In reply to Botond Ballo [:botond] from comment #2)

One option here would be to take the first-paint branch if mIsRootContent has changed. Another option would be to just update mIsRootContent in the other branch (where we update the other fields), though I wonder if there may be other state tied to mIsRootContent that APZ does not expect to change.

I think, of these two options, the first one is slightly safer. The second one makes me worried that we could be in the middle of something that's only expected to happen for mIsRootContent=true (like a pinch-zoom gesture), and changing to mIsRootContent=false could result in unexpected behaviour.

Comment 7

[Razvan Cojocaru]

Had some time to try your suggestion today and wrote this very simple patch:

diff --git a/gfx/layers/apz/src/AsyncPanZoomController.cpp b/gfx/layers/apz/src/AsyncPanZoomController.cpp
--- a/gfx/layers/apz/src/AsyncPanZoomController.cpp
+++ b/gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ -748,6 +748,7 @@ AsyncPanZoomController::AsyncPanZoomCont
       mPinchPaintTimerSet(false),
       mTestAttributeAppliers(0),
       mTestHasAsyncKeyScrolled(false),
+      mCurrentIsRootContent(false),
       mCheckerboardEventLock("APZCBELock") {
   if (aGestures == USE_GESTURE_DETECTOR) {
     mGestureEventListener = new GestureEventListener(this);
@@ -5159,7 +5160,12 @@ void AsyncPanZoomController::NotifyLayer
   bool viewportSizeUpdated = false;
   bool needToReclampScroll = false;
 
-  if ((aIsFirstPaint && aThisLayerTreeUpdated) || isDefault) {
+  bool isRootContent = Metrics().IsRootContent();
+  bool hasIsRootContentChanged = isRootContent != mCurrentIsRootContent;
+  mCurrentIsRootContent = isRootContent;
+
+  if ((aIsFirstPaint && aThisLayerTreeUpdated) || isDefault ||
+      hasIsRootContentChanged) {
     // Initialize our internal state to something sane when the content
     // that was just painted is something we knew nothing about previously
     CancelAnimation();
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.h b/gfx/layers/apz/src/AsyncPanZoomController.h
--- a/gfx/layers/apz/src/AsyncPanZoomController.h
+++ b/gfx/layers/apz/src/AsyncPanZoomController.h
@@ -1771,6 +1771,8 @@ class AsyncPanZoomController {
   uint8_t mTestAttributeAppliers;
   // Flag to track whether or not this APZC has ever async key scrolled.
   bool mTestHasAsyncKeyScrolled;
+  // Cache the last value of IsRootContent() seen by NotifyLayersUpdate().
+  bool mCurrentIsRootContent;
 
   /* ===================================================================
    * The functions and members in this section are used for checkerboard

Unfortunately, this trips another assert with the test HTML file provided:

Assertion failure: apzc->IsRootContent(), at /mnt/usb/work/debug/mozilla-unified/gfx/layers/apz/src/APZCTreeManager.cpp:758

Which is this code:

 756     if (Maybe<uint64_t> zoomAnimationId = apzc->GetZoomAnimationId()) {
 757       // for now we only support zooming on root content APZCs
 758       MOZ_ASSERT(apzc->IsRootContent());
 759 
 760       LayoutDeviceToParentLayerScale zoom = apzc->GetCurrentPinchZoomScale(
 761           AsyncPanZoomController::eForCompositing);

So either I've misunderstood your suggestion, or we appear to need a different strategy.

Comment 8

[Razvan Cojocaru]

The alternative strategy (i.e. ""Another option would be to just update mIsRootContent in the other branch (where we update the other fields)"):

diff --git a/gfx/layers/apz/src/AsyncPanZoomController.cpp b/gfx/layers/apz/src/AsyncPanZoomController.cpp
--- a/gfx/layers/apz/src/AsyncPanZoomController.cpp
+++ b/gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ -5277,6 +5277,7 @@ void AsyncPanZoomController::NotifyLayer
           aLayerMetrics.GetCompositionSizeWithoutDynamicToolbar());
       needToReclampScroll = true;
     }
+    Metrics().SetIsRootContent(aLayerMetrics.IsRootContent());
     Metrics().SetBoundingCompositionSize(
         aLayerMetrics.GetBoundingCompositionSize());
     Metrics().SetPresShellResolution(aLayerMetrics.GetPresShellResolution());

appears to trip another assert:

Assertion failure: mIsRootContent, at /mnt/usb/work/debug/mozilla-unified/gfx/layers/FrameMetrics.h:465

that is:

 464   const ParentLayerSize& GetCompositionSizeWithoutDynamicToolbar() const {
 465     MOZ_ASSERT(mIsRootContent);
 466     return mCompositionSizeWithoutDynamicToolbar;
 467   }

Comment 9

[Razvan Cojocaru]

Full backtrace for the last case, in case it's relevant:

#0  mozilla::layers::FrameMetrics::GetCompositionSizeWithoutDynamicToolbar() const (this=this@entry=0x7fffcdf07230)
    at /mnt/usb/work/debug/mozilla-unified/obj-x86_64-pc-linux-gnu/dist/include/FrameMetrics.h:465
#1  0x00007fffeb511557 in mozilla::layers::AsyncPanZoomController::NotifyLayersUpdated(mozilla::layers::ScrollMetadata const&, bool, bool)
    (this=this@entry=0x7fffce0a4c00, aScrollMetadata=..., aIsFirstPaint=<optimized out>, aThisLayerTreeUpdated=<optimized out>)
    at /mnt/usb/work/debug/mozilla-unified/gfx/layers/apz/src/AsyncPanZoomController.cpp:5275
#2  0x00007fffeb5100c3 in mozilla::layers::APZCTreeManager::PrepareNodeForLayer(mozilla::RecursiveMutexAutoLock const&, mozilla::layers::WebRenderScrollDataWrapper const&, mozilla::layers::FrameMetrics const&, mozilla::layers::LayersId, mozilla::Maybe<mozilla::layers::ZoomConstraints> const&, mozilla::layers::AncestorTransform const&, mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*, mozilla::layers::APZCTreeManager::TreeBuildingState&)
     (this=this@entry=0x7fffd651cb00, aProofOfTreeLock=..., aLayer=..., aMetrics=..., aLayersId=..., aZoomConstraints=..., aAncestorTransform=..., aParent=0x7fffc5856fc0, aNextSibling=0x0, aState=...) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/apz/src/APZCTreeManager.cpp:1224
#3  0x00007fffeb50c6a9 in mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3::operator()(mozilla::layers::WebRenderScrollDataWrapper) const
    (this=0x7fffd58fb0b0, aLayerMetrics=...) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/apz/src/APZCTreeManager.cpp:488
#4  mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&)
    (aRoot=..., aPreAction=..., aPostAction=...) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/TreeTraversal.h:139
#5  0x00007fffeb50cafc in mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&)
    (aRoot=..., aPreAction=..., aPostAction=...) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/TreeTraversal.h:143
#6  0x00007fffeb50cafc in mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&)
    (aRoot=..., aPreAction=..., aPostAction=...) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/TreeTraversal.h:143
#7  0x00007fffeb50cafc in mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned--Type <RET> for more, q to quit, c to continue without paging--
 int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&)
    (aRoot=..., aPreAction=..., aPostAction=...) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/TreeTraversal.h:143
#8  0x00007fffeb50cafc in mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&)
    (aRoot=..., aPreAction=..., aPostAction=...) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/TreeTraversal.h:143
#9  0x00007fffeb50cafc in mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&)
    (aRoot=..., aPreAction=..., aPostAction=...) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/TreeTraversal.h:143
#10 0x00007fffeb50bd27 in mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)
    (this=this@entry=0x7fffd651cb00, aRoot=..., aIsFirstPaint=false, aOriginatingLayersId=..., aPaintSequenceNumber=aPaintSequenceNumber@entry=3) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/apz/src/APZCTreeManager.cpp:449
#11 0x00007fffeb533253 in mozilla::layers::APZUpdater::UpdateScrollDataAndTreeState(mozilla::layers::LayersId, mozilla::layers::LayersId, mozilla::wr::Epoch const&, mozilla::layers::WebRenderScrollData&&)::$_28::operator()() (this=0x7fffcf68d0e8)
    at /mnt/usb/work/debug/mozilla-unified/gfx/layers/apz/src/APZUpdater.cpp:199
#12 mozilla::detail::RunnableFunction<mozilla::layers::APZUpdater::UpdateScrollDataAndTreeState(mozilla::layers::LayersId, mozilla::layers::LayersId, mozilla::wr::Epoch const&, mozilla::layers::WebRenderScrollData&&)::$_28>::Run() (this=0x7fffcf68d0c0)
    at /mnt/usb/work/debug/mozilla-unified/obj-x86_64-pc-linux-gnu/dist/include/nsThreadUtils.h:531
#13 0x00007fffeb51fa15 in mozilla::layers::APZUpdater::ProcessQueue() (this=0x7fffe51634a0)
    at /mnt/usb/work/debug/mozilla-unified/gfx/layers/apz/src/APZUpdater.cpp:468
#14 0x00007fffeb51f845 in mozilla::layers::APZUpdater::CompleteSceneSwap(mozilla::wr::WrWindowId const&, mozilla::wr::WrPipelineInfo const&)
    (aWindowId=..., aInfo=<optimized out>) at /mnt/usb/work/debug/mozilla-unified/gfx/layers/apz/src/APZUpdater.cpp:124
#15 0x00007fffeb520c0b in apz_post_scene_swap(mozilla::wr::WrWindowId, mozilla::wr::WrPipelineInfo const*) (aWindowId=..., aInfo=0x1)
    at /mnt/usb/work/debug/mozilla-unified/gfx/layers/apz/src/APZUpdater.cpp:536
#16 0x00007ffff0e611f5 in webrender_bindings::bindings::{impl#18}::post_scene_swap
    (self=<optimized out>, _document_ids=<optimized out>, info=...) at gfx/webrender_bindings/src/bindings.rs:1000
--Type <RET> for more, q to quit, c to continue without paging--
#17 0x00007ffff11915f3 in webrender::scene_builder_thread::SceneBuilderThread::forward_built_transactions (self=0x7fffd58fd5c8, txns=...)
    at gfx/wr/webrender/src/scene_builder_thread.rs:722
#18 webrender::scene_builder_thread::SceneBuilderThread::run (self=0x7fffd58fd5c8) at gfx/wr/webrender/src/scene_builder_thread.rs:320
#19 0x00007ffff1040fc3 in webrender::renderer::{impl#13}::new::{closure#2} () at gfx/wr/webrender/src/renderer/mod.rs:1249
#20 std::sys_common::backtrace::__rust_begin_short_backtrace<webrender::renderer::{impl#13}::new::{closure_env#2}, ()> (f=...)
    at /rustc/1.62.1/library/std/src/sys_common/backtrace.rs:122
#21 0x00007ffff0fdd2fc in std::thread::{impl#0}::spawn_unchecked_::{closure#1}::{closure#0}<webrender::renderer::{impl#13}::new::{closure_env#2}, ()> () at /rustc/1.62.1/library/std/src/thread/mod.rs:501
#22 core::panic::unwind_safe::{impl#23}::call_once<(), std::thread::{impl#0}::spawn_unchecked_::{closure#1}::{closure_env#0}<webrender::renderer::{impl#13}::new::{closure_env#2}, ()>> (self=..., _args=()) at /rustc/1.62.1/library/core/src/panic/unwind_safe.rs:271
#23 0x00007ffff0ec300c in std::panicking::try::do_call<core::panic::unwind_safe::AssertUnwindSafe<std::thread::{impl#0}::spawn_unchecked_::{closure#1}::{closure_env#0}<webrender::renderer::{impl#13}::new::{closure_env#2}, ()>>, ()> (data=<optimized out>)
    at /rustc/1.62.1/library/std/src/panicking.rs:492
#24 std::panicking::try<(), core::panic::unwind_safe::AssertUnwindSafe<std::thread::{impl#0}::spawn_unchecked_::{closure#1}::{closure_env#0}<webrender::renderer::{impl#13}::new::{closure_env#2}, ()>>> (f=...) at /rustc/1.62.1/library/std/src/panicking.rs:456
#25 0x00007ffff109c7dc in std::panic::catch_unwind<core::panic::unwind_safe::AssertUnwindSafe<std::thread::{impl#0}::spawn_unchecked_::{closure#1}::{closure_env#0}<webrender::renderer::{impl#13}::new::{closure_env#2}, ()>>, ()> (f=...) at /rustc/1.62.1/library/std/src/panic.rs:137
#26 0x00007ffff101eef5 in std::thread::{impl#0}::spawn_unchecked_::{closure#1}<webrender::renderer::{impl#13}::new::{closure_env#2}, ()> ()
    at /rustc/1.62.1/library/std/src/thread/mod.rs:500
#27 core::ops::function::FnOnce::call_once<std::thread::{impl#0}::spawn_unchecked_::{closure_env#1}<webrender::renderer::{impl#13}::new::{closure_env#2}, ()>, ()> () at /rustc/1.62.1/library/core/src/ops/function.rs:248
#28 0x00007ffff20354e3 in alloc::boxed::{impl#44}::call_once<(), dyn core::ops::function::FnOnce<(), Output=()>, alloc::alloc::Global>
    (self=..., args=()) at /rustc/1.62.1/library/alloc/src/boxed.rs:1872
#29 alloc::boxed::{impl#44}::call_once<(), alloc::boxed::Box<dyn core::ops::function::FnOnce<(), Output=()>, alloc::alloc::Global>, alloc::alloc::Global> (self=0x7fffda3d5d60, args=()) at /rustc/1.62.1/library/alloc/src/boxed.rs:1872
#30 std::sys::unix::thread::{impl#2}::new::thread_start (main=main@entry=0x7fffda3d5d60) at library/std/src/sys/unix/thread.rs:108
#31 0x0000555555639717 in set_alt_signal_stack_and_start(PthreadCreateParams*) (params=<optimized out>)
    at /mnt/usb/work/debug/mozilla-unified/toolkit/crashreporter/pthread_create_interposer/pthread_create_interposer.cpp:80
#32 0x00007ffff788c54d in  () at /usr/lib/libc.so.6
#33 0x00007ffff7911874 in clone () at /usr/lib/libc.so.6

Comment 10

[Razvan Cojocaru]

Attachment: Bug 1681955 - Assertion failure: mIsRootContent, in FrameMetrics::GetCompositionSizeWithoutDynamicToolbar(). r?dlrobertson

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/13a3877ee587
Assertion failure: mIsRootContent, in FrameMetrics::GetCompositionSizeWithoutDynamicToolbar(). r=dlrobertson

Comment 12

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/13a3877ee587

Comment 13

[Timothy Nikkel (:tnikkel)]

Does AsyncPanZoomController::mZoomConstraints also need to get updated in the situation that isrootcontent changes?

Comment 14

[Dan Robertson (:dlrobertson)]

(In reply to Timothy Nikkel (:tnikkel) from comment #13)

Does AsyncPanZoomController::mZoomConstraints also need to get updated in the situation that isrootcontent changes?

That's a good point. I do wonder if we could hit this assert in UpdateZoomConstraints currently https://searchfox.org/mozilla-central/source/gfx/layers/apz/src/APZCTreeManager.cpp#1280