Closed Bug 1755790 Opened 3 years ago Closed 3 years ago

Assertion failure: GetApzc()->GetParent() == aParent, at /gfx/layers/apz/src/HitTestingTreeNode.cpp:374

Categories

(Core :: Panning and Zooming, defect, P3)

x86_64
Linux
defect

Tracking

()

VERIFIED FIXED
100 Branch
Tracking Status
firefox-esr91 --- unaffected
firefox97 --- wontfix
firefox98 --- wontfix
firefox99 --- wontfix
firefox100 --- verified

People

(Reporter: jkratzer, Assigned: botond)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(3 files)

Testcase found while fuzzing mozilla-central rev 1f245c0744d0 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 1f245c0744d0 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip
Assertion failure: GetApzc()->GetParent() == aParent, at /gfx/layers/apz/src/HitTestingTreeNode.cpp:374

    ==505941==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f180b1a76e7 bp 0x7f16e5ff7c20 sp 0x7f16e5ff7c00 T506919)
    ==505941==The signal is caused by a WRITE memory access.
    ==505941==Hint: address points to the zero page.
        #0 0x7f180b1a76e7 in SetApzcParent /gfx/layers/apz/src/HitTestingTreeNode.cpp:374:5
        #1 0x7f180b1a76e7 in mozilla::layers::HitTestingTreeNode::SetPrevSibling(mozilla::layers::HitTestingTreeNode*) /gfx/layers/apz/src/HitTestingTreeNode.cpp:167:17
        #2 0x7f180b131edf in mozilla::layers::APZCTreeManager::PrepareNodeForLayer(mozilla::RecursiveMutexAutoLock const&, mozilla::layers::WebRenderScrollDataWrapper const&, mozilla::layers::FrameMetrics const&, mozilla::layers::LayersId, mozilla::Maybe<mozilla::layers::ZoomConstraints> const&, mozilla::layers::AncestorTransform const&, mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*, mozilla::layers::APZCTreeManager::TreeBuildingState&) /gfx/layers/apz/src/APZCTreeManager.cpp:1317:5
        #3 0x7f180b125dcc in operator() /gfx/layers/apz/src/APZCTreeManager.cpp:490:38
        #4 0x7f180b125dcc in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:139:3
        #5 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #6 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #7 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #8 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #9 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #10 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #11 0x7f180b126cd1 in std::enable_if<(std::is_same_v<decltype(fp0(fp)), void>) && (std::is_same_v<decltype(fp1(fp)), void>), void>::type mozilla::layers::ForEachNode<mozilla::layers::ReverseIterator, mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4>(mozilla::layers::WebRenderScrollDataWrapper, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_3 const&, mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::$_4 const&) /gfx/layers/TreeTraversal.h:143:5
        #12 0x7f180b123e2f in mozilla::layers::APZCTreeManager::UpdateHitTestingTree(mozilla::layers::WebRenderScrollDataWrapper const&, bool, mozilla::layers::LayersId, unsigned int) /gfx/layers/apz/src/APZCTreeManager.cpp:449:5
        #13 0x7f180b1977b2 in operator() /gfx/layers/apz/src/APZUpdater.cpp:196:25
        #14 0x7f180b1977b2 in mozilla::detail::RunnableFunction<mozilla::layers::APZUpdater::UpdateScrollDataAndTreeState(mozilla::layers::LayersId, mozilla::layers::LayersId, mozilla::wr::Epoch const&, mozilla::layers::WebRenderScrollData&&)::$_28>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #15 0x7f180b156aff in mozilla::layers::APZUpdater::ProcessQueue() /gfx/layers/apz/src/APZUpdater.cpp:459:23
        #16 0x7f180b15635a in mozilla::layers::APZUpdater::CompleteSceneSwap(mozilla::wr::WrWindowId const&, mozilla::wr::WrPipelineInfo const&) /gfx/layers/apz/src/APZUpdater.cpp:121:12
        #17 0x7f180b159689 in apz_post_scene_swap /gfx/layers/apz/src/APZUpdater.cpp:527:3
        #18 0x7f1812413ae6 in _$LT$webrender_bindings..bindings..APZCallbacks$u20$as$u20$webrender..renderer..SceneBuilderHooks$GT$::post_scene_swap::h99b4a35edfd47fac /gfx/webrender_bindings/src/bindings.rs:1007:13
        #19 0x7f18125e8936 in webrender::scene_builder_thread::SceneBuilderThread::forward_built_transactions::hced81e3e9d38f922 /gfx/wr/webrender/src/scene_builder_thread.rs:719:13
        #20 0x7f18125e8936 in webrender::scene_builder_thread::SceneBuilderThread::run::h45b090d72f48c5aa /gfx/wr/webrender/src/scene_builder_thread.rs:319:21
        #21 0x7f181244fb5c in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h469494766b3f2339 /gfx/wr/webrender/src/renderer/mod.rs:1240:13
        #22 0x7f181244fb5c in std::sys_common::backtrace::__rust_begin_short_backtrace::h63344c73c15b1fb6 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/sys_common/backtrace.rs:123:18
        #23 0x7f181246699f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hf19578ef60059335 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/thread/mod.rs:484:17
        #24 0x7f181246699f in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hdb0819c851d490fe /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/core/src/panic/unwind_safe.rs:271:9
        #25 0x7f181246699f in std::panicking::try::do_call::h63584cd89793bc1f /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/panicking.rs:406:40
        #26 0x7f181246699f in std::panicking::try::hff613628669c8e52 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/panicking.rs:370:19
        #27 0x7f181246699f in std::panic::catch_unwind::h6e8d64f13444060b /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/panic.rs:133:14
        #28 0x7f181246699f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hc25c5a7224576747 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/thread/mod.rs:483:30
        #29 0x7f181246699f in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h9c8fe4302e41b559 /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/core/src/ops/function.rs:227:5
        #30 0x7f1813316702 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h3604301cdaaa9dbf /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/alloc/src/boxed.rs:1694:9
        #31 0x7f1813316702 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h4cf736d2de892eff /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/alloc/src/boxed.rs:1694:9
        #32 0x7f1813316702 in std::sys::unix::thread::Thread::new::thread_start::h71a82d4ee5b02c9b /rustc/02072b482a8b5357f7fb5e5637444ae30e423c40/library/std/src/sys/unix/thread.rs:106:17
        #33 0x7f1820acf608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
        #34 0x7f1820697292 in __clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /gfx/layers/apz/src/HitTestingTreeNode.cpp:374:5 in SetApzcParent
    ==505941==ABORTING
Attached file Testcase

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220216214005-d0676cb0864b.
The bug appears to have been introduced in the following build range:

Start: 846edaaa86a91c3bd761a5557bfc729cd89a4c25 (20210917212414)
End: 0cf96895f20cc52cfc3dca89f7b3f023028e7796 (20210917223817)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=846edaaa86a91c3bd761a5557bfc729cd89a4c25&tochange=0cf96895f20cc52cfc3dca89f7b3f023028e7796

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Probably bug 1729581.

Regressed by: 1729581

Set release status flags based on info from the regressing bug 1729581

Has Regression Range: --- → yes

The severity field is not set for this bug.
:botond, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(botond)
Attached file Testcase (html file)

Attaching just the html file for convenience. The assertion reproduces with layout.css.backdrop-filter.enabled=true.

This looks to be fixed by bug 1749190.

Depends on: 1749190
Flags: needinfo?(botond)
Severity: -- → S3
Priority: -- → P3
Assignee: nobody → botond
Status: NEW → ASSIGNED
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 100 Branch

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220316041325-a2742e46efb5.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon

The patch landed in nightly and beta is affected.
:botond, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Flags: needinfo?(botond)

We'll let the fix for this ride the trains.

Flags: needinfo?(botond)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: