1871890 - Crash in [@ mozilla::Variant<T>::as]

Status: NEW

(Core :: Graphics, defect, P3)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/bda9b00b-21f2-4e9a-ac88-300f20231225

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(is<T>())

Top 10 frames of crashing thread:

0  xul.dll  mozilla::Variant<mozilla::layers::AnimationTransform, float, unsigned int>::as  mfbt/Variant.h:755
0  xul.dll  mozilla::layers::AnimatedValue::SetColor  gfx/layers/CompositorAnimationStorage.h:82
0  xul.dll  mozilla::layers::CompositorAnimationStorage::SetAnimatedValue  gfx/layers/CompositorAnimationStorage.cpp:146
1  xul.dll  mozilla::layers::CompositorAnimationStorage::SampleAnimations::<lambda_0>::operator const  gfx/layers/CompositorAnimationStorage.cpp:330
2  xul.dll  mozilla::layers::APZCTreeManager::CallWithMapLock  gfx/layers/apz/src/APZCTreeManager.h:638
2  xul.dll  mozilla::layers::APZSampler::CallWithMapLock  gfx/layers/apz/public/APZSampler.h:115
2  xul.dll  mozilla::layers::CompositorAnimationStorage::SampleAnimations  gfx/layers/CompositorAnimationStorage.cpp:386
3  xul.dll  mozilla::layers::OMTASampler::SampleAnimations  gfx/layers/wr/OMTASampler.cpp:128
3  xul.dll  mozilla::layers::OMTASampler::Sample  gfx/layers/wr/OMTASampler.cpp:115
3  xul.dll  mozilla::layers::OMTASampler::Sample  gfx/layers/wr/OMTASampler.cpp:68

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-10-26
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: No
• Is null crash: No

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Graphics: WebRender' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Kelsey Gilbert [:jgilbert]]

Occasional crash, but MOZ_RELEASE_ASSERT isn't dangerous.
I forget who APZ is these days, but Boris shows up in recent commits for this file so let's start with Boris!
S3 so waiting until Boris's Jan15 return should be fine.

Comment 3

[Boris Chiou [:boris]]

I suspect this might be an issue for IPC and serialization/de-serialization? It's unlikely to get a wrong type on the compositor. Not good idea for now.