Closed Bug 1714421 Opened 3 years ago Closed 3 years ago

Assertion failure: mTimeline (Should have a timeline if we are replacing transition start values), at src/dom/animation/CSSTransition.cpp:286

Categories

(Core :: DOM: Animation, defect)

defect

Tracking

()

RESOLVED FIXED
92 Branch
Tracking Status
firefox-esr78 --- wontfix
firefox-esr91 --- wontfix
firefox90 --- wontfix
firefox91 --- wontfix
firefox92 --- verified

People

(Reporter: tsmith, Assigned: boris)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

Attached file testcase.html

Found while fuzzing m-c 20210602-2d291a99004d (--enable-debug --enable-fuzzing)

Assertion failure: mTimeline (Should have a timeline if we are replacing transition start values), at src/dom/animation/CSSTransition.cpp:286

#0 0x7f2e25b2d143 in mozilla::dom::CSSTransition::UpdateStartValueFromReplacedTransition() src/dom/animation/CSSTransition.cpp:284:3
#1 0x7f2e255690cf in mozilla::layers::AnimationInfo::AddAnimationForProperty(nsIFrame*, mozilla::AnimationProperty const&, mozilla::dom::Animation*, mozilla::Maybe<mozilla::layers::TransformData> const&, mozilla::layers::AnimationInfo::Send) src/gfx/layers/AnimationInfo.cpp:468:20
#2 0x7f2e2556a00e in mozilla::layers::AnimationInfo::AddAnimationsForProperty(nsIFrame*, mozilla::EffectSet const*, nsTArray<RefPtr<mozilla::dom::Animation> > const&, mozilla::Maybe<mozilla::layers::TransformData> const&, nsCSSPropertyID, mozilla::layers::AnimationInfo::Send, mozilla::layers::LayerManager*) src/gfx/layers/AnimationInfo.cpp:646:5
#3 0x7f2e2556e496 in mozilla::layers::AnimationInfo::AddAnimationsForDisplayItem(nsIFrame*, nsDisplayListBuilder*, nsDisplayItem*, DisplayItemType, mozilla::layers::LayerManager*, mozilla::Maybe<mozilla::gfx::PointTyped<mozilla::LayoutDevicePixel, float> > const&) src/gfx/layers/AnimationInfo.cpp:988:18
#4 0x7f2e28e584af in AddAnimationsForWebRender(nsDisplayItem*, mozilla::layers::RenderRootStateManager*, nsDisplayListBuilder*, mozilla::Maybe<mozilla::gfx::PointTyped<mozilla::LayoutDevicePixel, float> > const&) src/layout/painting/nsDisplayList.cpp:275:17
#5 0x7f2e28e6a88f in nsDisplayTransform::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, nsDisplayListBuilder*) src/layout/painting/nsDisplayList.cpp:8148:13
#6 0x7f2e2567fadb in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, nsDisplayListBuilder*) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1668:41
#7 0x7f2e2567e1ee in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(nsDisplayList*, nsDisplayItem*, nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1791:7
#8 0x7f2e28e6212c in CreateWebRenderCommands src/layout/painting/nsDisplayList.cpp:5703:30
#9 0x7f2e28e6212c in nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, nsDisplayListBuilder*) src/layout/painting/nsDisplayList.cpp:6505:22
#10 0x7f2e2567fadb in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, nsDisplayListBuilder*) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1668:41
#11 0x7f2e2567e1ee in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(nsDisplayList*, nsDisplayItem*, nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1791:7
#12 0x7f2e2567cf52 in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, nsDisplayList*, nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) src/gfx/layers/wr/WebRenderCommandBuilder.cpp:1588:5
#13 0x7f2e256a7554 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(nsDisplayList*, nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) src/gfx/layers/wr/WebRenderLayerManager.cpp:368:30
#14 0x7f2e28e4cba8 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) src/layout/painting/nsDisplayList.cpp:2540:18
#15 0x7f2e28aad342 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3492:45
#16 0x7f2e28a26497 in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) src/layout/base/PresShell.cpp:6389:5
#17 0x7f2e286d3561 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:459:18
#18 0x7f2e286d307b in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:394:22
#19 0x7f2e286d45ef in nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:972:5
#20 0x7f2e289e52e8 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) src/layout/base/nsRefreshDriver.cpp:2476:11
#21 0x7f2e289ec5ea in TickDriver src/layout/base/nsRefreshDriver.cpp:348:13
#22 0x7f2e289ec5ea in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:326:7
#23 0x7f2e289ec503 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:342:5
#24 0x7f2e289ec3d0 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:775:5
#25 0x7f2e289eba38 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:704:16
#26 0x7f2e289eb320 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() src/layout/base/nsRefreshDriver.cpp:617:7
#27 0x7f2e289ead99 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:538:9
#28 0x7f2e28200406 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) src/dom/ipc/VsyncChild.cpp:68:15
#29 0x7f2e24f29710 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
#30 0x7f2e24cf526c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6061:32
#31 0x7f2e24979da1 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2155:25
#32 0x7f2e24976151 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2079:9
#33 0x7f2e2497768d in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1924:3
#34 0x7f2e2497840b in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1955:13
#35 0x7f2e240a2d4e in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:482:16
#36 0x7f2e24080859 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:785:26
#37 0x7f2e2407f6c8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:621:15
#38 0x7f2e2407f943 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:405:36
#39 0x7f2e240a6546 in operator() src/xpcom/threads/TaskController.cpp:138:37
#40 0x7f2e240a6546 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
#41 0x7f2e2409246f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1159:16
#42 0x7f2e240990fa in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:548:10
#43 0x7f2e2497f6b6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
#44 0x7f2e248e79d7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:335:10
#45 0x7f2e248e78f2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:328:3
#46 0x7f2e248e78f2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:310:3
#47 0x7f2e2871cac8 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#48 0x7f2e2a0ea943 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:911:20
#49 0x7f2e249805aa in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
#50 0x7f2e248e79d7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:335:10
#51 0x7f2e248e78f2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:328:3
#52 0x7f2e248e78f2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:310:3
#53 0x7f2e2a0ea55e in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:743:34
#54 0x560a95989c56 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#55 0x560a95989c56 in main src/browser/app/nsBrowserApp.cpp:313:18
#56 0x7f2e38f840b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#57 0x560a95966a5c in _start (/home/worker/builds/m-c-20210602214447-fuzzing-debug/firefox-bin+0x15a5c)
Flags: in-testsuite?
Flags: needinfo?(boris.chiou)
Severity: -- → S3
Flags: needinfo?(boris.chiou)

A Pernosco session is available here: https://pernos.co/debug/HUZ5LhVZ7ClVh6NfC2JWPQ/index.html

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210603094827-3350b68026ed.
The bug appears to have been introduced in the following build range:

Start: 725180017480c46f17faddc71ee35dcca39db109 (20201011093320)
End: f6615f173552511e63b87cd8db1ab1434e187630 (20201014095212)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=725180017480c46f17faddc71ee35dcca39db109&tochange=f6615f173552511e63b87cd8db1ab1434e187630

Whiteboard: [bugmon:bisected,confirmed]
Flags: needinfo?(boris.chiou)

Got a js error when running this testcase.html

TypeError: can't access property "timeline", document.getAnimations()[0] is undefined

Perhaps need to reverify this testcase.html

However, it seems like it's possible to have an undefined timeline object in
https://searchfox.org/mozilla-central/rev/064a1e6a2a6f6aa30be8bf4edea2f8408f779d4d/dom/animation/CSSTransition.cpp#284-286
So perhaps we can simply fix this by early return if mTimeline is null.

Flags: needinfo?(boris.chiou)

Hi, tsmith,

Could you please recheck this testcase.html? I got the js error and didn't see the assertion on the Nightly debug build today.

Flags: needinfo?(twsmith)
Assignee: nobody → boris.chiou

(In reply to Boris Chiou [:boris] from comment #4)

Hi, tsmith,

Could you please recheck this testcase.html? I got the js error and didn't see the assertion on the Nightly debug build today.

OK. I think this js error happened because my nightly doesn't support zoom property. When I change it to scale, I got the assertion via ./mach run.

Flags: needinfo?(twsmith)

Here is an updated Pernosco session: https://pernos.co/debug/Qbcrn7nkz15VxCmckMZSGw/index.html

We support the setter of Animation.timeline, so it's possible to have a
null |mTimeline| when calculating the start value for off-main-thread
animations. Therefore, we drop the assertion and use a if-check to early
return if it's null.

Attachment #9234575 - Attachment description: Bug 1714421 - Early return if we don't have Animation.timeline. → Bug 1714421 - Early return if we don't have Animation.timeline when computing start values for replaced transitions.

:boris, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Flags: needinfo?(boris.chiou)
Attachment #9234575 - Attachment description: Bug 1714421 - Early return if we don't have Animation.timeline when computing start values for replaced transitions. → Bug 1714421 - Move the assertion of timeline after checking mReplacedTransition.

This is not really regressed by Bug 1670778 because I think this is an existing issue. Bug 1670778 just let all CSS properties (including zoom) be acceptable for fuzzy.

Flags: needinfo?(boris.chiou)
Regressed by: 1670778
Has Regression Range: --- → yes
Keywords: regression
Pushed by bchiou@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/e82e7b3b761a
Move the assertion of timeline after checking mReplacedTransition. r=hiro
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 92 Branch
Flags: in-testsuite? → in-testsuite+

Bugmon Analysis
Bug appears to be fixed on mozilla-central 20210805092724-d66e0aca4012 but BugMon was unable to reproduce using None.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: