1722577 - Assertion failure: aTiming.Duration().ref() >= zeroDuration (Iteration duration should be positive), at /builds/worker/checkouts/gecko/dom/animation/AnimationEffect.cpp:109

Status: RESOLVED FIXED

(Core :: DOM: Animation, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 0896ae409c2c (built with --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 0896ae409c2c --debug --fuzzing -n mc-debug
$ python -m grizzly.replay ./mc-debug/firefox ./testcase.html

Assertion failure: aTiming.Duration().ref() >= zeroDuration (Iteration duration should be positive), at /builds/worker/checkouts/gecko/dom/animation/AnimationEffect.cpp:109

    #0 0x7f9bb5b051ae in mozilla::dom::AnimationEffect::GetComputedTimingAt(mozilla::dom::Nullable<mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator> > const&, mozilla::TimingParams const&, double) /builds/worker/checkouts/gecko/dom/animation/AnimationEffect.cpp:108:5
    #1 0x7f9bb5b03f7c in GetComputedTiming /builds/worker/checkouts/gecko/dom/animation/AnimationEffect.cpp:268:10
    #2 0x7f9bb5b03f7c in mozilla::dom::AnimationEffect::IsCurrent() const /builds/worker/checkouts/gecko/dom/animation/AnimationEffect.cpp:54:35
    #3 0x7f9bb5afb45a in HasCurrentEffect /builds/worker/checkouts/gecko/dom/animation/Animation.cpp:1867:38
    #4 0x7f9bb5afb45a in mozilla::dom::Animation::UpdateRelevance() /builds/worker/checkouts/gecko/dom/animation/Animation.cpp:1053:18
    #5 0x7f9bb5b1cfc3 in mozilla::dom::KeyframeEffect::SetAnimation(mozilla::dom::Animation*) /builds/worker/checkouts/gecko/dom/animation/KeyframeEffect.cpp:1873:17
    #6 0x7f9bb5afb168 in mozilla::dom::Animation::SetEffectNoUpdate(mozilla::dom::AnimationEffect*) /builds/worker/checkouts/gecko/dom/animation/Animation.cpp:221:14
    #7 0x7f9bb5b0aae6 in mozilla::dom::CSSTransition::SetEffectFromStyle(mozilla::dom::KeyframeEffect*) /builds/worker/checkouts/gecko/dom/animation/CSSTransition.cpp:321:14
    #8 0x7f9bb89db8f5 in nsTransitionManager::ConsiderInitiatingTransition(nsCSSPropertyID, nsStyleDisplay const&, unsigned int, mozilla::dom::Element*, mozilla::PseudoStyleType, mozilla::AnimationCollection<mozilla::dom::CSSTransition>*&, mozilla::ComputedStyle const&, mozilla::ComputedStyle const&, nsCSSPropertyIDSet&) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:469:14
    #9 0x7f9bb89daa68 in nsTransitionManager::DoUpdateTransitions(nsStyleDisplay const&, mozilla::dom::Element*, mozilla::PseudoStyleType, mozilla::AnimationCollection<mozilla::dom::CSSTransition>*&, mozilla::ComputedStyle const&, mozilla::ComputedStyle const&) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:109:23
    #10 0x7f9bb89da82c in nsTransitionManager::UpdateTransitions(mozilla::dom::Element*, mozilla::PseudoStyleType, mozilla::ComputedStyle const&, mozilla::ComputedStyle const&) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:66:10
    #11 0x7f9bb896aaa3 in Gecko_UpdateAnimations /builds/worker/checkouts/gecko/layout/style/GeckoBindings.cpp:552:39
    #12 0x7f9bbd12cddc in _$LT$style..gecko..wrapper..GeckoElement$u20$as$u20$style..dom..TElement$GT$::update_animations::h3a867caede88621a /builds/worker/checkouts/gecko/servo/components/style/gecko/wrapper.rs:1570:13
    #13 0x7f9bbcc947e1 in style::context::SequentialTask$LT$E$GT$::execute::h096abfa34aaeb016 /builds/worker/checkouts/gecko/servo/components/style/context.rs:484:17
    #14 0x7f9bbcc947e1 in _$LT$style..context..SequentialTaskList$LT$E$GT$$u20$as$u20$core..ops..drop..Drop$GT$::drop::he03580c0f21a6769 /builds/worker/checkouts/gecko/servo/components/style/context.rs:612:13
    #15 0x7f9bbcc947e1 in core::ptr::drop_in_place$LT$style..context..SequentialTaskList$LT$style..gecko..wrapper..GeckoElement$GT$$GT$::h8b41270f782a1168 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:192:1
    #16 0x7f9bbcc947e1 in core::ptr::drop_in_place$LT$style..context..ThreadLocalStyleContext$LT$style..gecko..wrapper..GeckoElement$GT$$GT$::hc046580057dd0341 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:192:1
    #17 0x7f9bbcd8246f in style::driver::traverse_dom::hed1c2abdb775b5e3 /builds/worker/checkouts/gecko/servo/components/style/driver.rs:193:1
    #18 0x7f9bbce74da1 in geckoservo::glue::traverse_subtree::h768236d62b22d5ca /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:266:5
    #19 0x7f9bbce7520e in Servo_TraverseSubtree /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:326:5
    #20 0x7f9bb8999bd0 in mozilla::ServoStyleSet::StyleDocument(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/style/ServoStyleSet.cpp:745:9
    #21 0x7f9bb8a4a191 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3000:20
    #22 0x7f9bb8a24245 in ProcessPendingRestyles /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3130:3
    #23 0x7f9bb8a24245 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4192:39
    #24 0x7f9bb89ecac9 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2292:22
    #25 0x7f9bb89f4caa in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:348:13
    #26 0x7f9bb89f4caa in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:326:7
    #27 0x7f9bb89f4bc3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:342:5
    #28 0x7f9bb89f4a90 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:771:5
    #29 0x7f9bb89f412a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:700:16
    #30 0x7f9bb89f3a45 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:617:7
    #31 0x7f9bb89f34c9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:538:9
    #32 0x7f9bb8207b36 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncChild.cpp:68:15
    #33 0x7f9bb4ef2944 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
    #34 0x7f9bb4cba37c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6091:32
    #35 0x7f9bb4929681 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2051:25
    #36 0x7f9bb49261c1 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1978:9
    #37 0x7f9bb4927645 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1826:3
    #38 0x7f9bb49281db in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1857:13
    #39 0x7f9bb401fcde in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:502:16
    #40 0x7f9bb3ffda29 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:805:26
    #41 0x7f9bb3ffc8a8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:641:15
    #42 0x7f9bb3ffcb23 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:425:36
    #43 0x7f9bb40234d6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:135:37
    #44 0x7f9bb40234d6 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:532:5
    #45 0x7f9bb400f64f in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1148:16
    #46 0x7f9bb40160ba in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:466:10
    #47 0x7f9bb492f4f6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #48 0x7f9bb4889dc7 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #49 0x7f9bb4889ce2 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #50 0x7f9bb4889ce2 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #51 0x7f9bb871ad48 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #52 0x7f9bba0d51c3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:910:20
    #53 0x7f9bb49303ea in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
    #54 0x7f9bb4889dc7 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #55 0x7f9bb4889ce2 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #56 0x7f9bb4889ce2 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #57 0x7f9bba0d4dde in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:742:34
    #58 0x55f10d7b99b6 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #59 0x55f10d7b99b6 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:327:18
    #60 0x7f9bc8e3a0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210727152622-edce65311704.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: eba7e3ce93822075543bcc764cef7dbc8e9fc5f1 (20200728094725)
End: 0896ae409c2c1518c2b7b9b02aba0603746b9a49 (20210727094543)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

Comment 2

[Boris Chiou [:boris]]

Looks like this needs InspectorUtils for debugging but this DOM api is only supported for chrome caller or fuzzy. Perhaps we have to simplify the test case first for debugging locally.

Comment 3

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20220514040948-28b2e8958185) but not with tip (mozilla-central 20230512180301-33f0079fba2d.)

The bug appears to have been fixed in the following build range:

Start: ab99817274ace05a6aa9e80656fea30093d13e36 (20230508090117)
End: ad1f49f09ac0d295a7ed8b43f7ce288c72b89aa4 (20230508131323)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=ab99817274ace05a6aa9e80656fea30093d13e36&tochange=ad1f49f09ac0d295a7ed8b43f7ce288c72b89aa4

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Jason Kratzer [:jkratzer]]

This appears to have been fixed via bug 1831410.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Does the testcase landed in bug 1831410 satisfactorily cover this one as well?

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Yeah, should be the same cause effectively.