1807966 - Assertion failure: IsFinite(progress) (Progress value should be finite), at /dom/animation/AnimationEffect.cpp:263

Status: VERIFIED FIXED

(Core :: DOM: Animation, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev c5ddc463e9f8 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build c5ddc463e9f8 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: IsFinite(progress) (Progress value should be finite), at /dom/animation/AnimationEffect.cpp:263

    ==141077==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fd780ac7840 bp 0x7ffd9696d2f0 sp 0x7ffd9696d2a0 T141077)
    ==141077==The signal is caused by a WRITE memory access.
    ==141077==Hint: address points to the zero page.
        #0 0x7fd780ac7840 in mozilla::dom::AnimationEffect::GetComputedTimingAt(mozilla::dom::Nullable<mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>> const&, mozilla::TimingParams const&, double, mozilla::dom::Animation::ProgressTimelinePosition) /dom/animation/AnimationEffect.cpp:263:3
        #1 0x7fd780abd387 in mozilla::dom::AnimationEffect::GetComputedTiming(mozilla::TimingParams const*) const /dom/animation/AnimationEffect.cpp:274:10
        #2 0x7fd780ac61db in mozilla::dom::AnimationEffect::IsCurrent() const /dom/animation/AnimationEffect.cpp:54:35
        #3 0x7fd780abcf90 in HasCurrentEffect /dom/animation/Animation.cpp:2142:38
        #4 0x7fd780abcf90 in mozilla::dom::Animation::UpdateRelevance() /dom/animation/Animation.cpp:1184:18
        #5 0x7fd780ac5232 in UpdateEffect /dom/animation/Animation.cpp:1797:5
        #6 0x7fd780ac5232 in mozilla::dom::Animation::UpdateTiming(mozilla::dom::Animation::SeekFlag, mozilla::dom::Animation::SyncNotifyFlag) /dom/animation/Animation.cpp:1737:3
        #7 0x7fd780ac229a in mozilla::dom::Animation::Tick() /dom/animation/Animation.cpp:954:3
        #8 0x7fd780acd01d in mozilla::dom::CSSTransition::Tick() /dom/animation/CSSTransition.cpp:193:14
        #9 0x7fd780ac9513 in mozilla::dom::AnimationTimeline::Tick() /dom/animation/AnimationTimeline.cpp:58:16
        #10 0x7fd780aceda0 in mozilla::dom::DocumentTimeline::MostRecentRefreshTimeUpdated() /dom/animation/DocumentTimeline.cpp:178:17
        #11 0x7fd7846b6492 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2550:12
        #12 0x7fd7846c018d in TickDriver /layout/base/nsRefreshDriver.cpp:374:13
        #13 0x7fd7846c018d in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /layout/base/nsRefreshDriver.cpp:352:7
        #14 0x7fd7846c0093 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:368:5
        #15 0x7fd7846bff70 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:912:5
        #16 0x7fd7846bf2da in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:826:5
        #17 0x7fd7846beaa6 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:747:5
        #18 0x7fd7846be5b9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /layout/base/nsRefreshDriver.cpp:593:14
        #19 0x7fd7846be1cd in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:550:9
        #20 0x7fd783b6670b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncMainChild.cpp:68:15
        #21 0x7fd783df0328 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:78
        #22 0x7fd77ff6fefa in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6371:32
        #23 0x7fd77feff54a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1800:25
        #24 0x7fd77fefc1c7 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1725:9
        #25 0x7fd77fefccf5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1525:3
        #26 0x7fd77fefe02f in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1623:14
        #27 0x7fd77f2f77b5 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:539:16
        #28 0x7fd77f2f2d8c in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:852:26
        #29 0x7fd77f2f195a in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:684:15
        #30 0x7fd77f2f1cb5 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:462:36
        #31 0x7fd77f2fb129 in operator() /xpcom/threads/TaskController.cpp:191:37
        #32 0x7fd77f2fb129 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
        #33 0x7fd77f310955 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1197:16
        #34 0x7fd77f316e9d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #35 0x7fd77ff05443 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #36 0x7fd77fe28f58 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #37 0x7fd77fe28e61 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #38 0x7fd77fe28e61 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #39 0x7fd78435e568 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #40 0x7fd786592b6b in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:743:20
        #41 0x7fd77ff06359 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #42 0x7fd77fe28f58 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #43 0x7fd77fe28e61 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #44 0x7fd77fe28e61 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #45 0x7fd7865926c8 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:676:34
        #46 0x5649be83eca0 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #47 0x5649be83eca0 in main /browser/app/nsBrowserApp.cpp:359:18
        #48 0x7fd79439dd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #49 0x7fd79439de3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #50 0x5649be815308 in _start (/home/jkratzer/builds/m-c-20221229092636-fuzzing-debug/firefox-bin+0x5b308) (BuildId: 57d0e68973c298505724f6ed9f82c1dea3cdb0d1)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/animation/AnimationEffect.cpp:263:3 in mozilla::dom::AnimationEffect::GetComputedTimingAt(mozilla::dom::Nullable<mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>> const&, mozilla::TimingParams const&, double, mozilla::dom::Animation::ProgressTimelinePosition)
    ==141077==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20221229092636-c5ddc463e9f8.
The bug appears to have been introduced in the following build range:

Start: 8fb31906e84c42f2e2694e4ad599f326ebefd7a0 (20220818080047)
End: 1facaa986f25ac4bf2dad6fa7d9e15c5e36e11f1 (20220818095450)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=8fb31906e84c42f2e2694e4ad599f326ebefd7a0&tochange=1facaa986f25ac4bf2dad6fa7d9e15c5e36e11f1

Comment 3

[Boris Chiou [:boris]]

Oh, this may be caused by calc(15 / 0) because calc() allows NaN since Bug 1682444.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #2, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:boris, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit auto_nag documentation.

Comment 5

[Boris Chiou [:boris]]

Note: we have to set the pref, layout.css.linear-easing-function.enabled, to reproduce this assertion.

Comment 6

[Boris Chiou [:boris]]

Attachment: Simplifed testcase

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1682444

Comment 8

[Boris Chiou [:boris]]

Attachment: Bug 1807966 - Avoid infinite output progress after applying the easing function.

The output progress of easing functions could be inf or -inf, per spec,
https://drafts.csswg.org/css-easing-2/#output-progress-value.

And we expect to use finite progress to do interpolation, per spec,
https://drafts.csswg.org/css-values-4/#interpolation.

Note:
One of the spec may be wrong because they are mismatched. So for now
we avoid using infinite output progress.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6d4bfd1a3b4e
Avoid infinite output progress after applying the easing function. r=emilio

Comment 10

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/6d4bfd1a3b4e

Comment 11

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230124093000-35f8b8a01747.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.