1748331 - Assertion failure: IsFinite(progress) (Progress value should be finite), at /dom/animation/AnimationEffect.cpp:260

Status: NEW

(Core :: DOM: Animation, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 1cb2015e6fbc (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 1cb2015e6fbc --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: IsFinite(progress) (Progress value should be finite), at /dom/animation/AnimationEffect.cpp:260

    ==1166574==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f507f7ccb50 bp 0x7f4eceff89f0 sp 0x7f4eceff89b0 T1166757)
    ==1166574==The signal is caused by a WRITE memory access.
    ==1166574==Hint: address points to the zero page.
        #0 0x7f507f7ccb50 in mozilla::dom::AnimationEffect::GetComputedTimingAt(mozilla::dom::Nullable<mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator> > const&, mozilla::TimingParams const&, double) /dom/animation/AnimationEffect.cpp:260:3
        #1 0x7f507f30dcc2 in SampleAnimationForProperty /gfx/layers/AnimationHelper.cpp:109:37
        #2 0x7f507f30dcc2 in mozilla::layers::AnimationHelper::SampleAnimationForEachNode(mozilla::TimeStamp, mozilla::TimeStamp, mozilla::layers::AnimatedValue const*, nsTArray<mozilla::layers::PropertyAnimationGroup>&, nsTArray<RefPtr<RawServoAnimationValue> >&) /gfx/layers/AnimationHelper.cpp:245:27
        #3 0x7f507f3289e7 in mozilla::layers::CompositorAnimationStorage::SampleAnimations(mozilla::layers::OMTAController const*, mozilla::TimeStamp, mozilla::TimeStamp) /gfx/layers/CompositorAnimationStorage.cpp:220:9
        #4 0x7f507f4d3e07 in mozilla::layers::OMTASampler::SampleAnimations(mozilla::TimeStamp const&, mozilla::TimeStamp const&) /gfx/layers/wr/OMTASampler.cpp:128:17
        #5 0x7f507f4d3761 in mozilla::layers::OMTASampler::Sample(mozilla::wr::TransactionWrapper&) /gfx/layers/wr/OMTASampler.cpp:115:29
        #6 0x7f507f4d4bbd in Sample /gfx/layers/wr/OMTASampler.cpp:68:14
        #7 0x7f507f4d4bbd in omta_sample /gfx/layers/wr/OMTASampler.cpp:245:3
        #8 0x7f508652e292 in _$LT$webrender_bindings..bindings..SamplerCallback$u20$as$u20$webrender..renderer..AsyncPropertySampler$GT$::sample::h21444448cfcee1bb /gfx/webrender_bindings/src/bindings.rs:1065:13
        #9 0x7f5086697346 in webrender::render_backend::RenderBackend::update_document::h77ead49aa6668580 /gfx/wr/webrender/src/render_backend.rs:1277:39
        #10 0x7f508669329e in webrender::render_backend::RenderBackend::prepare_transactions::h496f85b6992e810e /gfx/wr/webrender/src/render_backend.rs:1194:28
        #11 0x7f508669329e in webrender::render_backend::RenderBackend::process_api_msg::h4a093f5153a644ad /gfx/wr/webrender/src/render_backend.rs:1046:17
        #12 0x7f5086569d0b in webrender::render_backend::RenderBackend::run::hc281f4071ae32264 /gfx/wr/webrender/src/render_backend.rs:716:21
        #13 0x7f5086569d0b in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h5267d521289eefe0 /gfx/wr/webrender/src/renderer/mod.rs:1325:13
        #14 0x7f5086569d0b in std::sys_common::backtrace::__rust_begin_short_backtrace::hbdbf0148d397f721 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/sys_common/backtrace.rs:123:18
        #15 0x7f508658077f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h4762cd1fd358f306 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/thread/mod.rs:483:17
        #16 0x7f508658077f in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h489af0dc995876fd /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/core/src/panic/unwind_safe.rs:271:9
        #17 0x7f508658077f in std::panicking::try::do_call::hcce296c92e75a7cc /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/panicking.rs:403:40
        #18 0x7f508658077f in std::panicking::try::hef31ac73df8188d3 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/panicking.rs:367:19
        #19 0x7f508658077f in std::panic::catch_unwind::h7ca768c241b12321 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/panic.rs:133:14
        #20 0x7f508658077f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hcac967473824ff61 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/thread/mod.rs:482:30
        #21 0x7f508658077f in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h0231c78dc28601e1 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/core/src/ops/function.rs:227:5
        #22 0x7f50873c5422 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h7bd677a5dc988be6 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/alloc/src/boxed.rs:1691:9
        #23 0x7f50873c5422 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h7b1c1ba11c4db785 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/alloc/src/boxed.rs:1691:9
        #24 0x7f50873c5422 in std::sys::unix::thread::Thread::new::thread_start::h9c58c0d12d84e854 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/sys/unix/thread.rs:106:17
        #25 0x7f5094acc608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
        #26 0x7f5094694292 in __clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/animation/AnimationEffect.cpp:260:3 in mozilla::dom::AnimationEffect::GetComputedTimingAt(mozilla::dom::Nullable<mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator> > const&, mozilla::TimingParams const&, double)
    ==1166574==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220103215519-a6af5cff5adf.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 1d89f3cb5bb3e5a37b0249977838c4a98c162c80 (20210105043131)
End: 1cb2015e6fbc11f3a03137692fe60b111b94693a (20220103092929)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:boris, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

:boris, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 5

[Marco Castelluccio [:marco]]

Sorry, bug in the bot.

Comment 6

[Bugmon [:jkratzer for issues]]

Bugmon was unable reproduce this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 7

[Jason Kratzer [:jkratzer]]

A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.