1919415 - Assertion failure: range > 0 (We don't expect to get a zero or negative range on the compositor), at /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:51

Status: NEW

(Core :: CSS Parsing and Computation, defect)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20240917-920dd9bc5aeb (--enable-debug --enable-fuzzing)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting http://eloverblik.dk/.

Assertion failure: range > 0 (We don't expect to get a zero or negative range on the compositor), at /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:51

#0 0x74c9c8974674 in CalculateElapsedTimeForScrollTimeline /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:49:3
#1 0x74c9c8974674 in CalculateElapsedTime /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:78:12
#2 0x74c9c8974674 in SampleAnimationForProperty /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:175:51
#3 0x74c9c8974674 in mozilla::layers::AnimationHelper::SampleAnimationForEachNode(mozilla::layers::APZSampler const*, mozilla::layers::LayersId const&, mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&, mozilla::TimeStamp, mozilla::TimeStamp, mozilla::layers::AnimatedValue const*, nsTArray<mozilla::layers::PropertyAnimationGroup>&, AutoTArray<RefPtr<mozilla::StyleAnimationValue>, 1ul>&) /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:355:27
#4 0x74c9c898fbd1 in mozilla::layers::CompositorAnimationStorage::SampleAnimations(mozilla::layers::OMTAController const*, mozilla::TimeStamp, mozilla::TimeStamp)::$_1::operator()(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) const /builds/worker/checkouts/gecko/gfx/layers/CompositorAnimationStorage.cpp:345:11
#5 0x74c9c898f5c0 in CallWithMapLock<(lambda at /builds/worker/checkouts/gecko/gfx/layers/CompositorAnimationStorage.cpp:332:19)> /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.h:633:5
#6 0x74c9c898f5c0 in CallWithMapLock<(lambda at /builds/worker/checkouts/gecko/gfx/layers/CompositorAnimationStorage.cpp:332:19)> /builds/worker/workspace/obj-build/dist/include/mozilla/layers/APZSampler.h:115:11
#7 0x74c9c898f5c0 in mozilla::layers::CompositorAnimationStorage::SampleAnimations(mozilla::layers::OMTAController const*, mozilla::TimeStamp, mozilla::TimeStamp) /builds/worker/checkouts/gecko/gfx/layers/CompositorAnimationStorage.cpp:414:17
#8 0x74c9c8bd7894 in mozilla::layers::OMTASampler::SampleAnimations(mozilla::TimeStamp const&, mozilla::TimeStamp const&) /builds/worker/checkouts/gecko/gfx/layers/wr/OMTASampler.cpp:128:17
#9 0x74c9c8bd745a in mozilla::layers::OMTASampler::Sample(mozilla::wr::TransactionWrapper&) /builds/worker/checkouts/gecko/gfx/layers/wr/OMTASampler.cpp:115:29
#10 0x74c9c8bd84bb in Sample /builds/worker/checkouts/gecko/gfx/layers/wr/OMTASampler.cpp:68:14
#11 0x74c9c8bd84bb in omta_sample /builds/worker/checkouts/gecko/gfx/layers/wr/OMTASampler.cpp:245:3
#12 0x74c9d00ff102 in _$LT$webrender_bindings..bindings..SamplerCallback$u20$as$u20$webrender..renderer..init..AsyncPropertySampler$GT$::sample::h8225c4497e5c48ae /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/bindings.rs:1104:13
#13 0x74c9d0473179 in webrender::render_backend::RenderBackend::update_document::h37b2f961bfd4cb09 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1380:39
#14 0x74c9d046dee3 in webrender::render_backend::RenderBackend::prepare_transactions::h60d29fa921c5e663 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1292:28
#15 0x74c9d046dee3 in webrender::render_backend::RenderBackend::process_api_msg::h74c78d50e618dd60 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1145:17
#16 0x74c9d01714b9 in webrender::render_backend::RenderBackend::run::hd01f9720a4e9dbea /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:796:21
#17 0x74c9d01714b9 in webrender::renderer::init::create_webrender_instance::_$u7b$$u7b$closure$u7d$$u7d$::he14636afd5f2cb3c /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/init.rs:704:9
#18 0x74c9d01714b9 in std::sys::backtrace::__rust_begin_short_backtrace::h635579650e531c56 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/sys/backtrace.rs:152:18
#19 0x74c9d017ba5c in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h8135a69a44b4f7f7 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/thread/mod.rs:538:17
#20 0x74c9d017ba5c in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h56d8f41058e7420e /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/core/src/panic/unwind_safe.rs:272:9
#21 0x74c9d017ba5c in std::panicking::try::do_call::h0a2bc7db47406062 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panicking.rs:557:40
#22 0x74c9d017ba5c in std::panicking::try::h9d483e0ad106310b /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panicking.rs:521:19
#23 0x74c9d017ba5c in std::panic::catch_unwind::h905f4d7c629dd01a /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panic.rs:350:14
#24 0x74c9d017ba5c in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::hcbf3346d8e32b004 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/thread/mod.rs:537:30
#25 0x74c9d017ba5c in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h2517669538223b5c /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/core/src/ops/function.rs:250:5
#26 0x74c9d1a9a94a in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::ha1963004222e7822 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/alloc/src/boxed.rs:2070:9
#27 0x74c9d1a9a94a in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h1086ced1f7c494c2 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/alloc/src/boxed.rs:2070:9
#28 0x74c9d1a9a94a in std::sys::pal::unix::thread::Thread::new::thread_start::ha8af9c992ef0b208 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/sys/pal/unix/thread.rs:108:17
#29 0x74c9dba57ac2 in start_thread nptl/pthread_create.c:442:8
#30 0x74c9dbae984f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/cka_ZyeE0X8x4hiHx1tx6Q/index.html

Comment 2

[Daniel Holbert [:dholbert]]

The assertion is here:
https://searchfox.org/mozilla-central/rev/a6f4fbcd9b1ce352b7d6d1b87204d3e015266b57/gfx/layers/AnimationHelper.cpp#49-51

MOZ_ASSERT(
    range > 0,
    "We don't expect to get a zero or negative range on the compositor");

Boris, looks like you added this assertion in https://hg.mozilla.org/mozilla-central/rev/93cb779a267c02213d625eb2e2db736f69424b76#l1.47 (for bug 1737180) -- could you take a look?

Comment 3

[Daniel Holbert [:dholbert]]

(In the pernosco trace, range is in fact 0, which comes from aScrollMeta->mRange.height in the assignent up above.)

Comment 4

[Daniel Holbert [:dholbert]]

(Tentatively triaging as S3, given that the site in question (http://eloverblik.dk/) seems to work just fine in an opt build, and the assertion doesn't look security-critical. boris or others, please adjust severity if you disagree.)

Comment 5

[Daniel Holbert [:dholbert]]

(also adding dependency to tie this to the bug that added the line of code with the assertion that's failing here. Note that I don't know for sure whether this actually is reproducible that far back [hence depends-on rather than regressed-by])