1749190 - Assertion failure: aChild->GetApzc() != parent, at /builds/worker/checkouts/gecko/gfx/layers/apz/src/HitTestingTreeNode.cpp:89

2366719611

Reporter

Description

•

1 year ago

Attached file 1084.html — Details

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Steps to reproduce:

open the attached html file

Actual results:

the browser crashed, the original html file and the runtime log are in the attached files.
the main stacktrace:
Assertion failure: aChild->GetApzc() != parent, at /builds/worker/checkouts/gecko/gfx/layers/apz/src/HitTestingTreeNode.cpp:89
#01:AnnotateMozCrashReason(char const*) /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:39:19 mozilla::layers::HitTestingTreeNode::SetLastChild(mozilla::layers::HitTestingTreeNode*) /builds/worker/checkouts/gecko/gfx/layers/apz/src/HitTestingTreeNode.cpp:89:7
#02:mozilla::layers::APZCTreeManager::AttachNodeToTree(mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*) /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:0:14
#03:mozilla::layers::APZCTreeManager::PrepareNodeForLayer(mozilla::RecursiveMutexAutoLock const&, mozilla::layers::WebRenderScrollDataWrapper const&, mozilla::layers::FrameMetrics const&, mozilla::layers::LayersId, mozilla::Maybe<mozilla::layers::ZoomConstraints> const&, mozilla::layers::AncestorTransform const&, mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*, mozilla::layers::APZCTreeManager::TreeBuildingState&) /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:1338:10
#04:mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3::operator()(mozilla::layers::WebRenderScrollDataWrapper) const /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:479:38 std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:139:3
#05:std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
#06:std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
#07:std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
#08:std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
#09:std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
#10:std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
#11:std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$4 const&) /builds/worker/checkouts/gecko/gfx/layers/TreeTraversal.h:143:5
#12:mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int) /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:438:5
#13:mozilla::layers::APZUpdater::UpdateScrollDataAndTreeState(mozilla::layers::LayersId, mozilla::layers::LayersId, mozilla::wr::Epoch const&, mozilla::layers::WebRenderScrollData&&)::$28::operator()() /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZUpdater.cpp:195:13 mozilla::detail::RunnableFunction<mozilla::layers::APZUpdater::UpdateScrollDataAndTreeState(mozilla::layers::LayersId, mozilla::layers::LayersId, mozilla::wr::Epoch const&, mozilla::layers::WebRenderScrollData&&)::$28>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#14:mozilla::layers::APZUpdater::ProcessQueue() /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZUpdater.cpp:0:23
#15:RefPtr<mozilla::layers::APZCTreeManager>::operator->() const /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:314:5 mozilla::layers::APZUpdater::CompleteSceneSwap(mozilla::wr::WrWindowId const&, mozilla::wr::WrPipelineInfo const&) /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZUpdater.cpp:122:3
#16:apz_post_scene_swap /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZUpdater.cpp:526:1
[Child 26086, Main Thread] WARNING: 'mType != FormControlType::InputFile', file /builds/worker/checkouts/gecko/dom/html/HTMLInputElement.cpp:7033
#17:$LT$webrender_bindings..bindings..APZCallbacks$u20$as$u20$webrender..renderer..SceneBuilderHooks$GT$::post_scene_swap::h7777169ad488bcc3 /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/bindings.rs:1010:18
#18:webrender::scene_builder_thread::SceneBuilderThread::forward_built_transactions::h8356e73be3fbc4a4 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:719:13 webrender::scene_builder_thread::SceneBuilderThread::run::hf787ef417a02e9cb /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:319:21
#19:webrender::profiler::unregister_thread::hfac35749a8804d15 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/profiler.rs:1283:16 webrender::renderer::Renderer::new::$u7b$$u7b$closure$u7d$$u7d$::h80983d7f624b9bf1 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:1238:13 std::sys_common::backtrace::__rust_begin_short_backtrace::hc762d79b5580d4d7 /builds/worker/fetches/rust/library/std/src/sys_common/backtrace.rs:125:18
#20:std::thread::Builder::spawn_unchecked::$u7b$$u7b$closure$u7d$$u7d$::$u7b$$u7b$closure$u7d$$u7d$::ha0fbe30bd29c21c8 /builds/worker/fetches/rust/library/std/src/thread/mod.rs:481:17 $LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hf85fc054e5f9d5df /builds/worker/fetches/rust/library/core/src/panic/unwind_safe.rs:271:9 std::panicking::try::do_call::h4ba00be699192dfc /builds/worker/fetches/rust/library/std/src/panicking.rs:403:40 std::panicking::try::h1b47dbfff09118c5 /builds/worker/fetches/rust/library/std/src/panicking.rs:367:19 std::panic::catch_unwind::had326e24a5020e6d /builds/worker/fetches/rust/library/std/src/panic.rs:129:14 std::thread::Builder::spawn_unchecked::$u7b$$u7b$closure$u7d$$u7d$::h27151c0409496559 /builds/worker/fetches/rust/library/std/src/thread/mod.rs:480:30 core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::hfa13e94d9f2d90ec /builds/worker/fetches/rust/library/core/src/ops/function.rs:227:5
#21:std::sys::unix::thread::Thread::new::thread_start::h3b1213720f18b702 ??:0:0
#22:start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:478:7
#23:clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:97:0
#24: ??? (???:???)

Expected results:

the browser won't crash

2366719611

Reporter

Comment 1

•

1 year ago

Attached file runtime log — Details

BugBot [:suhaib / :marco/ :calixte]

Comment 2

•

1 year ago

The Bugbug bot thinks this bug should belong to the 'Core::Graphics: WebRender' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Component: Untriaged → Graphics: WebRender

Product: Firefox → Core

Darkspirit

Updated

•

1 year ago

Component: Graphics: WebRender → Panning and Zooming

Comment 3

•

1 year ago

The severity field is not set for this bug.
:botond, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(botond)

Botond Ballo [:botond]

Assignee

Comment 4

•

1 year ago

I can reproduce this and have an idea for a fix as an extension of the approach taken in bug 1751789.

Assignee: nobody → botond

Blocks: 1751788

Severity: -- → S3

Depends on: 1751789

Flags: needinfo?(botond)

Priority: -- → P3

Botond Ballo [:botond]

Assignee

Comment 5

•

1 year ago

Attached file Bug 1749190 - Rename a variable to be more precise. r=tnikkel — Details

Botond Ballo [:botond]

Assignee

Comment 6

•

1 year ago

Attached file Bug 1749190 - Try harder to avoid cyclic scroll metadata annotations when building WRScrollData. r=tnikkel — Details

Depends on D137943

Botond Ballo [:botond]

Assignee

Comment 7

•

1 year ago

Attached file Bug 1749190 - Add a crashtest. r=tnikkel — Details

Depends on D137944

BugBot [:suhaib / :marco/ :calixte]

Comment 8

•

1 year ago

There are some r+ patches which didn't land and no activity in this bug for 2 weeks.
:botond, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit auto_nag documentation.

Flags: needinfo?(tnikkel)

Flags: needinfo?(botond)

Timothy Nikkel (:tnikkel)

Comment 9

•

1 year ago

I expect Botond will land this when he gets to it.

Flags: needinfo?(tnikkel)

Botond Ballo [:botond]

Assignee

Comment 10

•

1 year ago

Yeah, the reason I've been sitting on this patch is that I wanted to double-check that the more recently filed bug 1753779 and bug 1755790 don't give us any new information that would warrant a different approach.

Flags: needinfo?(botond)

Botond Ballo [:botond]

Assignee

Updated

•

1 year ago

Blocks: 1755790

Botond Ballo [:botond]

Assignee

Comment 11

•

1 year ago

•

Edited

(In reply to Botond Ballo [:botond] from comment #10)

Yeah, the reason I've been sitting on this patch is that I wanted to double-check that the more recently filed bug 1753779 and bug 1755790 don't give us any new information that would warrant a different approach.

Updates:

Bug 1755790 is fixed by these patches
Bug 1753779 requires a different fix but which is compatible with this approach
I also looked at bug 1743731; that concerns an edge case completely unrelated to these

So, I think we should be good to land this.

Pulsebot

Comment 12

•

1 year ago

Pushed by bballo@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/998bd0244343
Rename a variable to be more precise. r=tnikkel
https://hg.mozilla.org/integration/autoland/rev/3d623418ee05
Try harder to avoid cyclic scroll metadata annotations when building WRScrollData. r=tnikkel
https://hg.mozilla.org/integration/autoland/rev/21460b29ead8
Add a crashtest. r=tnikkel

Treeherder Bug Filer

Updated

•

1 year ago

Regressions: 1759631

Treeherder Bug Filer

Updated

•

1 year ago

Regressions: 1759632

Iulian Moraru

Comment 13

•

1 year ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/998bd0244343
https://hg.mozilla.org/mozilla-central/rev/3d623418ee05
https://hg.mozilla.org/mozilla-central/rev/21460b29ead8

Status: UNCONFIRMED → RESOLVED

Closed: 1 year ago

status-firefox100: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 100 Branch

Catalin Sasca, Desktop QA [:csasca]

Updated

•

1 year ago

Flags: qe-verify+

Ardelean Oana, Desktop QA

Comment 14

•

1 year ago

I was unable to reproduce the crash on Win10 64-bits using the attached html file. Could you please confirm the fix on the latest beta and latest nightly builds?
Thank you.

Flags: needinfo?(botond)

Botond Ballo [:botond]

Assignee

Comment 15

•

1 year ago

The crash is only reproducible in debug builds. I've confirmed it's fixed in both nightly and beta.

Flags: needinfo?(botond)

Ardelean Oana, Desktop QA

Comment 16

•

1 year ago

Thank you kindly! Based on your comment I shall update acordingly.

Status: RESOLVED → VERIFIED

status-firefox100: fixed → verified

Flags: qe-verify+

1084.html 1 year ago 2366719611 605.24 KB, text/html		Details
runtime log 1 year ago 2366719611 48.46 KB, text/plain		Details
Bug 1749190 - Rename a variable to be more precise. r=tnikkel 1 year ago Botond Ballo [:botond] 48 bytes, text/x-phabricator-request		Details \| Review
Bug 1749190 - Try harder to avoid cyclic scroll metadata annotations when building WRScrollData. r=tnikkel 1 year ago Botond Ballo [:botond] 48 bytes, text/x-phabricator-request		Details \| Review
Bug 1749190 - Add a crashtest. r=tnikkel 1 year ago Botond Ballo [:botond] 48 bytes, text/x-phabricator-request		Details \| Review

Bugzilla

Quick Search

Assertion failure: aChild->GetApzc() != parent, at /builds/worker/checkouts/gecko/gfx/layers/apz/src/HitTestingTreeNode.cpp:89

Categories

(Core :: Panning and Zooming, defect, P3)

Tracking

()

People

(Reporter: 2366719611, Assigned: botond)

References

(Blocks 1 open bug)

Details

Crash Data

Security

(public)

User Story

Attachments

(5 files)

Description

Comment 1

Comment 2

Updated

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Comment 8

Comment 9

Comment 10

Updated

Comment 11

Comment 12

Updated

Updated

Comment 13

Updated

Comment 14

Comment 15

Comment 16