Closed Bug 1919415 Opened 1 year ago Closed 7 months ago

Assertion failure: range > 0 (We don't expect to get a zero or negative range on the compositor), at /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:51

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
148 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- wontfix
firefox-esr140 --- wontfix
firefox132 --- wontfix
firefox146 --- wontfix
firefox147 --- wontfix
firefox148 --- fixed

People

(Reporter: tsmith, Assigned: boris)

References

(Blocks 2 open bugs,
URL
)

Details

(Keywords: assertion, pernosco)

Crash Data

Attachments

(1 file)

Bug 1919415 - Handle zero range for scroll-driven animations on the compositor thread.
48 bytes, text/x-phabricator-request
Details | Review

Found with m-c 20240917-920dd9bc5aeb (--enable-debug --enable-fuzzing)

This was found by visiting a live website with a debug build.

STR:

  • Launch browser and visit site

This issue was triggered by visiting http://eloverblik.dk/.

Assertion failure: range > 0 (We don't expect to get a zero or negative range on the compositor), at /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:51

#0 0x74c9c8974674 in CalculateElapsedTimeForScrollTimeline /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:49:3
#1 0x74c9c8974674 in CalculateElapsedTime /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:78:12
#2 0x74c9c8974674 in SampleAnimationForProperty /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:175:51
#3 0x74c9c8974674 in mozilla::layers::AnimationHelper::SampleAnimationForEachNode(mozilla::layers::APZSampler const*, mozilla::layers::LayersId const&, mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&, mozilla::TimeStamp, mozilla::TimeStamp, mozilla::layers::AnimatedValue const*, nsTArray<mozilla::layers::PropertyAnimationGroup>&, AutoTArray<RefPtr<mozilla::StyleAnimationValue>, 1ul>&) /builds/worker/checkouts/gecko/gfx/layers/AnimationHelper.cpp:355:27
#4 0x74c9c898fbd1 in mozilla::layers::CompositorAnimationStorage::SampleAnimations(mozilla::layers::OMTAController const*, mozilla::TimeStamp, mozilla::TimeStamp)::$_1::operator()(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) const /builds/worker/checkouts/gecko/gfx/layers/CompositorAnimationStorage.cpp:345:11
#5 0x74c9c898f5c0 in CallWithMapLock<(lambda at /builds/worker/checkouts/gecko/gfx/layers/CompositorAnimationStorage.cpp:332:19)> /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.h:633:5
#6 0x74c9c898f5c0 in CallWithMapLock<(lambda at /builds/worker/checkouts/gecko/gfx/layers/CompositorAnimationStorage.cpp:332:19)> /builds/worker/workspace/obj-build/dist/include/mozilla/layers/APZSampler.h:115:11
#7 0x74c9c898f5c0 in mozilla::layers::CompositorAnimationStorage::SampleAnimations(mozilla::layers::OMTAController const*, mozilla::TimeStamp, mozilla::TimeStamp) /builds/worker/checkouts/gecko/gfx/layers/CompositorAnimationStorage.cpp:414:17
#8 0x74c9c8bd7894 in mozilla::layers::OMTASampler::SampleAnimations(mozilla::TimeStamp const&, mozilla::TimeStamp const&) /builds/worker/checkouts/gecko/gfx/layers/wr/OMTASampler.cpp:128:17
#9 0x74c9c8bd745a in mozilla::layers::OMTASampler::Sample(mozilla::wr::TransactionWrapper&) /builds/worker/checkouts/gecko/gfx/layers/wr/OMTASampler.cpp:115:29
#10 0x74c9c8bd84bb in Sample /builds/worker/checkouts/gecko/gfx/layers/wr/OMTASampler.cpp:68:14
#11 0x74c9c8bd84bb in omta_sample /builds/worker/checkouts/gecko/gfx/layers/wr/OMTASampler.cpp:245:3
#12 0x74c9d00ff102 in _$LT$webrender_bindings..bindings..SamplerCallback$u20$as$u20$webrender..renderer..init..AsyncPropertySampler$GT$::sample::h8225c4497e5c48ae /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/bindings.rs:1104:13
#13 0x74c9d0473179 in webrender::render_backend::RenderBackend::update_document::h37b2f961bfd4cb09 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1380:39
#14 0x74c9d046dee3 in webrender::render_backend::RenderBackend::prepare_transactions::h60d29fa921c5e663 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1292:28
#15 0x74c9d046dee3 in webrender::render_backend::RenderBackend::process_api_msg::h74c78d50e618dd60 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1145:17
#16 0x74c9d01714b9 in webrender::render_backend::RenderBackend::run::hd01f9720a4e9dbea /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:796:21
#17 0x74c9d01714b9 in webrender::renderer::init::create_webrender_instance::_$u7b$$u7b$closure$u7d$$u7d$::he14636afd5f2cb3c /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/init.rs:704:9
#18 0x74c9d01714b9 in std::sys::backtrace::__rust_begin_short_backtrace::h635579650e531c56 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/sys/backtrace.rs:152:18
#19 0x74c9d017ba5c in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h8135a69a44b4f7f7 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/thread/mod.rs:538:17
#20 0x74c9d017ba5c in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h56d8f41058e7420e /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/core/src/panic/unwind_safe.rs:272:9
#21 0x74c9d017ba5c in std::panicking::try::do_call::h0a2bc7db47406062 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panicking.rs:557:40
#22 0x74c9d017ba5c in std::panicking::try::h9d483e0ad106310b /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panicking.rs:521:19
#23 0x74c9d017ba5c in std::panic::catch_unwind::h905f4d7c629dd01a /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panic.rs:350:14
#24 0x74c9d017ba5c in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::hcbf3346d8e32b004 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/thread/mod.rs:537:30
#25 0x74c9d017ba5c in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h2517669538223b5c /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/core/src/ops/function.rs:250:5
#26 0x74c9d1a9a94a in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::ha1963004222e7822 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/alloc/src/boxed.rs:2070:9
#27 0x74c9d1a9a94a in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h1086ced1f7c494c2 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/alloc/src/boxed.rs:2070:9
#28 0x74c9d1a9a94a in std::sys::pal::unix::thread::Thread::new::thread_start::ha8af9c992ef0b208 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/sys/pal/unix/thread.rs:108:17
#29 0x74c9dba57ac2 in start_thread nptl/pthread_create.c:442:8
#30 0x74c9dbae984f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

A Pernosco session is available here: https://pernos.co/debug/cka_ZyeE0X8x4hiHx1tx6Q/index.html

Keywords: pernosco

The assertion is here:
https://searchfox.org/mozilla-central/rev/a6f4fbcd9b1ce352b7d6d1b87204d3e015266b57/gfx/layers/AnimationHelper.cpp#49-51

MOZ_ASSERT(
    range > 0,
    "We don't expect to get a zero or negative range on the compositor");

Boris, looks like you added this assertion in https://hg.mozilla.org/mozilla-central/rev/93cb779a267c02213d625eb2e2db736f69424b76#l1.47 (for bug 1737180) -- could you take a look?

Flags: needinfo?(boris.chiou)

(In the pernosco trace, range is in fact 0, which comes from aScrollMeta->mRange.height in the assignent up above.)

(Tentatively triaging as S3, given that the site in question (http://eloverblik.dk/) seems to work just fine in an opt build, and the assertion doesn't look security-critical. boris or others, please adjust severity if you disagree.)

(also adding dependency to tie this to the bug that added the line of code with the assertion that's failing here. Note that I don't know for sure whether this actually is reproducible that far back [hence depends-on rather than regressed-by])

Depends on: 1737180
Severity: -- → S3
See Also: → 1929723

I noticed it is pretty easy to reproduce this with this https://codepen.io/t_afif/pen/ZYzOaZp. Just keep resizing the box, and I saw the assertion there.

Flags: needinfo?(boris.chiou)

It is possible to get a zero range from APZ sampler (e.g. see the test
in this patch), so we have to early return it.

Assignee: nobody → boris.chiou
Attachment #9531954 - Attachment description: Bug 1919415 - Handle zero range for compositor animations. → Bug 1919415 - Handle zero range for scroll-driven animations.
Status: NEW → ASSIGNED
Attachment #9531954 - Attachment description: Bug 1919415 - Handle zero range for scroll-driven animations. → Bug 1919415 - Handle zero range for scroll-driven animations on the compositor thread.
Pushed by bchiou@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/8d0f56f4c055 https://hg.mozilla.org/integration/autoland/rev/08f98baa10e6 Handle zero range for scroll-driven animations on the compositor thread. r=hiro,layout-reviewers
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/56628 for changes under testing/web-platform/tests

https://hg.mozilla.org/mozilla-central/rev/08f98baa10e6

Status: ASSIGNED → RESOLVED
Closed: 7 months ago
status-firefox148: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 148 Branch
Upstream PR merged by moz-wptsync-bot
Blocks: 2005347

The patch landed in nightly and beta is affected.
:boris, is this bug important enough to require an uplift?

For more information, please visit BugBot documentation.

Flags: needinfo?(boris.chiou)

(In reply to BugBot [:suhaib / :marco/ :calixte] from comment #23)

The patch landed in nightly and beta is affected.
:boris, is this bug important enough to require an uplift?

For more information, please visit BugBot documentation.

Just an assertion fix. Should be fine without up-lift (and this only affects nightly).

status-firefox147: affected → wontfix
Flags: needinfo?(boris.chiou)
Duplicate of this bug: 1794708
Duplicate of this bug: 1997436
Duplicate of this bug: 1958289
Duplicate of this bug: 1929723
Duplicate of this bug: 1946570

Copying crash signatures from duplicate bugs.

Crash Signature: [@ Servo_AnimationValue_GetColor]

Copying crash signatures from duplicate bugs.

Crash Signature: [@ Servo_AnimationValue_GetColor] → [@ Servo_AnimationValue_GetColor] [@ geckoservo::glue::Servo_AnimationValue_GetColor]

Copying crash signatures from duplicate bugs.

Crash Signature: [@ Servo_AnimationValue_GetColor] [@ geckoservo::glue::Servo_AnimationValue_GetColor] → [@ Servo_AnimationValue_GetColor] [@ geckoservo::glue::Servo_AnimationValue_GetColor] [@ geckoservo::glue::Servo_AnimationValue_GetOpacity]

Copying crash signatures from duplicate bugs.

Crash Signature: [@ Servo_AnimationValue_GetColor] [@ geckoservo::glue::Servo_AnimationValue_GetColor] [@ geckoservo::glue::Servo_AnimationValue_GetOpacity] → [@ Servo_AnimationValue_GetColor] [@ geckoservo::glue::Servo_AnimationValue_GetColor] [@ geckoservo::glue::Servo_AnimationValue_GetOpacity] [@ Servo_AnimationValue_GetOpacity] [@ mozilla::layers::CompositorAnimationStorage::SetAnimatedValue]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: