1685009 - Assertion failure: IsRootContent() || relativeOffset == CSSPoint(), at src/gfx/layers/FrameMetrics.cpp:132

Status: RESOLVED FIXED

(Core :: Panning and Zooming, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Assertion failure: IsRootContent() || relativeOffset == CSSPoint(), at src/gfx/layers/FrameMetrics.cpp:132

#0 0x7fa8571482da in mozilla::layers::FrameMetrics::ApplyScrollUpdateFrom(mozilla::ScrollPositionUpdate const&) src/gfx/layers/FrameMetrics.cpp:132:3
#1 0x7fa8572c3626 in mozilla::layers::AsyncPanZoomController::NotifyLayersUpdated(mozilla::layers::ScrollMetadata const&, bool, bool) src/gfx/layers/apz/src/AsyncPanZoomController.cpp:4949:17
#2 0x7fa8572d0d09 in mozilla::layers::HitTestingTreeNode* mozilla::layers::APZCTreeManager::PrepareNodeForLayer<mozilla::layers::LayerMetricsWrapper>(mozilla::RecursiveMutexAutoLock const&, mozilla::layers::LayerMetricsWrapper const&, mozilla::layers::FrameMetrics const&, mozilla::layers::LayersId, mozilla::layers::AncestorTransform const&, mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*, mozilla::layers::APZCTreeManager::TreeBuildingState&) src/gfx/layers/apz/src/APZCTreeManager.cpp:1304:11
#3 0x7fa8572ce12e in void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper)::operator()(mozilla::layers::LayerMetricsWrapper) const src/gfx/layers/apz/src/APZCTreeManager.cpp:464:38
#4 0x7fa8572cc2b5 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper), void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper)>(mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper) const&, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper) const&) src/gfx/layers/TreeTraversal.h:139:3
#5 0x7fa8572cc2e9 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper), void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper)>(mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper) const&, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper) const&) src/gfx/layers/TreeTraversal.h:143:5
#6 0x7fa8572cc394 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper), void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper)>(mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper) const&, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper) const&) src/gfx/layers/TreeTraversal.h:143:5
#7 0x7fa8572cc2e9 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper), void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper)>(mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper) const&, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper) const&) src/gfx/layers/TreeTraversal.h:143:5
#8 0x7fa8572cc2e9 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper), void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper)>(mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper) const&, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper) const&) src/gfx/layers/TreeTraversal.h:143:5
#9 0x7fa8572cc2e9 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper), void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper)>(mozilla::layers::LayerMetricsWrapper, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper) const&, void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda0'(mozilla::layers::LayerMetricsWrapper) const&) src/gfx/layers/TreeTraversal.h:143:5
#10 0x7fa85728029e in void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int) src/gfx/layers/apz/src/APZCTreeManager.cpp:432:5
#11 0x7fa8572a76fc in UpdateHitTestingTree src/gfx/layers/apz/src/APZCTreeManager.cpp:698:3
#12 0x7fa8572a76fc in mozilla::layers::APZUpdater::UpdateHitTestingTree(mozilla::layers::Layer*, bool, mozilla::layers::LayersId, unsigned int) src/gfx/layers/apz/src/APZUpdater.cpp:169:9
#13 0x7fa8573f0dc3 in mozilla::layers::CompositorBridgeParent::ShadowLayersUpdated(mozilla::layers::LayerTransactionParent*, mozilla::layers::TransactionInfo const&, bool) src/gfx/layers/ipc/CompositorBridgeParent.cpp:1286:20
#14 0x7fa857430040 in mozilla::layers::LayerTransactionParent::RecvUpdate(mozilla::layers::TransactionInfo const&) src/gfx/layers/ipc/LayerTransactionParent.cpp:444:22
#15 0x7fa8568f3b7a in mozilla::layers::PLayerTransactionParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PLayerTransactionParent.cpp:124:66
#16 0x7fa8566daa2e in mozilla::layers::PCompositorManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCompositorManagerParent.cpp:197:32
#17 0x7fa85659629e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2150:25
#18 0x7fa856592a5f in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2074:9
#19 0x7fa856593e66 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1922:3
#20 0x7fa856594a8b in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1953:13
#21 0x7fa855ca8611 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1197:14
#22 0x7fa855cae2ba in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:513:10
#23 0x7fa85659cc46 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:332:5
#24 0x7fa85650dbd3 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#25 0x7fa85650daed in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
#26 0x7fa85650daed in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#27 0x7fa855ca4d1e in nsThread::ThreadFunc(void*) src/xpcom/threads/nsThread.cpp:442:10
#28 0x7fa872949abb in _pt_root src/nsprpub/pr/src/pthreads/ptthread.c:201:5
#29 0x7fa8725426da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#30 0x7fa871520a3e in clone /build/glibc-2ORdQG/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20210105043131-1d89f3cb5bb3
mozilla-central 20210105043131-1d89f3cb5bb3
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/4YF1ZopHT4jEg-Xb7KswqA/index.html

Comment 3

[Timothy Nikkel (:tnikkel)]

fuzzing prefs from https://bug1675404.bmoattachments.org/attachment.cgi?id=9187033 make this reproducible locally for me.

Comment 4

[Botond Ballo [:botond]]

Based on the Pernosco session, what seems to be happening is, a paint-skip transaction is taking the is-first-paint branch of NotifyLayersUpdated().

In the is-first-paint branch, APZ accepts the layer's FrameMetrics wholesale, including both the visual and layout scroll offsets. However, when applying a paint-skipped scroll to the layer's FrameMetrics on the content side, we only update the layout scroll offset, resulting in the two scroll offsets being out of sync in the layer's FrameMetrics copy. When APZ then accepts the layer's FrameMetrics wholesale, it is stuck with the out-of-sync offsets.

Comment 5

[Botond Ballo [:botond]]

The assertion was added as part of the changes in bug 1543485, but the underlying issue is a regression from bug 1519285.

Comment 6

[Timothy Nikkel (:tnikkel)]

Oops, I debugged this yesterday and had a potential patch that I was going to post shortly

https://treeherder.mozilla.org/jobs?repo=try&revision=ad5b9834a20666cafeaf580f4b23763403a7d135

Comment 7

[Botond Ballo [:botond]]

Heh, that's along the lines of the fix I was thinking about as well. At least we can be pretty confident in our diagnosis as we both arrived at it independently!

Comment 8

[Botond Ballo [:botond]]

(Triaging as S2 because visual and layout scroll offsets being out of sync for a subframe, as in this testcase, can lead to weird bugs.)

Comment 9

[Timothy Nikkel (:tnikkel)]

Attachment: Bug 1685009. Update the visual offset too when doing a paint skip transaction to keep it in sync with layout offset. r=botond

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/24da67c3c956
Update the visual offset too when doing a paint skip transaction to keep it in sync with layout offset. r=botond

Comment 11

[Alexandru Michis [:malexandru]]

Backed out changeset 24da67c3c956 (Bug 1685009) for causing crashtest timeouts.

Backout link: https://hg.mozilla.org/integration/autoland/rev/b6e31a312f50ef27b07961a35941203e5ab2180f

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&fromchange=256a8293104e1f8feeb8bf30387125ac0437d6de&searchStr=android%2Ccrashtest&tochange=b6e31a312f50ef27b07961a35941203e5ab2180f&selectedTaskRun=FAiDfuALQMmwLo3wKLHjlQ.0

Failure log: https://treeherder.mozilla.org/logviewer?job_id=326245404&repo=autoland&lineNumber=9659

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/764f05659f89
Update the visual offset too when doing a paint skip transaction to keep it in sync with layout offset. r=botond

Comment 13

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/764f05659f89