1957177 - Assertion failure: !aCmp(*(aBegin + a), *(aBegin + b)) (Your comparator is not a valid strict-weak ordering) [@ mozilla::AnimationEventDispatcher::DispatchEvents]

Status: NEW

(Core :: DOM: Animation, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20250328-6ae189025cfa (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !aCmp(*(aBegin + a), *(aBegin + b)) (Your comparator is not a valid strict-weak ordering), at /builds/worker/workspace/obj-build/dist/include/nsTArray.h:310

#0 0x79c6c8ba5cef in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:267:3
#1 0x79c6c8ba5cef in void detail::AssertStrictWeakOrder<mozilla::AnimationEventInfo*, void nsTArray_Impl<mozilla::AnimationEventInfo, nsTArrayInfallibleAllocator>::StableSort<mozilla::AnimationEventDispatcher::SortEvents()::AnimationEventInfoComparator>(mozilla::AnimationEventDispatcher::SortEvents()::AnimationEventInfoComparator const&)::'lambda'(mozilla::AnimationEventDispatcher::SortEvents()::AnimationEventInfoComparator const&, auto const&)>(mozilla::AnimationEventDispatcher::SortEvents()::AnimationEventInfoComparator, mozilla::AnimationEventDispatcher::SortEvents()::AnimationEventInfoComparator, auto const&) /builds/worker/workspace/obj-build/dist/include/nsTArray.h:309:9
#2 0x79c6c8b9d690 in StableSort<AnimationEventInfoComparator> /builds/worker/workspace/obj-build/dist/include/nsTArray.h:2415:5
#3 0x79c6c8b9d690 in SortEvents /builds/worker/workspace/obj-build/dist/include/mozilla/AnimationEventDispatcher.h:318:20
#4 0x79c6c8b9d690 in mozilla::AnimationEventDispatcher::DispatchEvents() /builds/worker/workspace/obj-build/dist/include/mozilla/AnimationEventDispatcher.h:257:5
#5 0x79c6c8b9d274 in nsRefreshDriver::UpdateAnimationsAndSendEvents() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2368:17
#6 0x79c6c8b9b0ee in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2756:3
#7 0x79c6c8ba3dd1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:13
#8 0x79c6c8ba3dd1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:346:7
#9 0x79c6c8ba3cd0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:362:5
#10 0x79c6c8ba3b7d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:948:5
#11 0x79c6c8ba30ea in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:858:5
#12 0x79c6c8ba25e6 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:593:14
#13 0x79c6c7f8affb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#14 0x79c6c82148ed in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:235:78
#15 0x79c6c81407a0 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8822:32
#16 0x79c6c3acf3b9 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1789:25
#17 0x79c6c3acc5b2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1716:9
#18 0x79c6c3acd190 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1507:3
#19 0x79c6c3ace299 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1607:14
#20 0x79c6c2f4c5f7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#21 0x79c6c2f4597e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1252:20
#22 0x79c6c2f446b7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1075:15
#23 0x79c6c2f44b35 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#24 0x79c6c2f53729 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:336:37
#25 0x79c6c2f53729 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#26 0x79c6c2f65723 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#27 0x79c6c2f6bd4f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#28 0x79c6c4e5123c in SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, (lambda at /builds/worker/checkouts/gecko/dom/base/FuzzingFunctions.cpp:408:22)> /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
#29 0x79c6c4e5123c in mozilla::dom::FuzzingFunctions::SpinEventLoopFor(mozilla::dom::GlobalObject const&, unsigned int) /builds/worker/checkouts/gecko/dom/base/FuzzingFunctions.cpp:407:3
#30 0x79c6c60052ab in mozilla::dom::FuzzingFunctions_Binding::spinEventLoopFor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./FuzzingFunctionsBinding.cpp:280:3
#31 0x79c6c99414e4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:493:13
#32 0x79c6c9940d3f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:589:12
#33 0x79c6c995491a in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:661:10
#34 0x79c6c995491a in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3265:16
#35 0x79c6c9940381 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:463:13
#36 0x79c6c9940d65 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:621:13
#37 0x79c6c994218b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:688:8
#38 0x79c6c9a19a7b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#39 0x79c6c5b9698b in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./WindowBinding.cpp:456:8
#40 0x79c6c4cdd9e4 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:390:12
#41 0x79c6c4cdd7a6 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, char const*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:403:12
#42 0x79c6c4ea3e31 in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) /builds/worker/checkouts/gecko/dom/base/IdleRequest.cpp:57:13
#43 0x79c6c4bc38b1 in nsGlobalWindowInner::RunIdleRequest(mozilla::dom::IdleRequest*, double, bool) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:740:12
#44 0x79c6c4bc28ac in nsGlobalWindowInner::ExecuteIdleRequest(mozilla::TimeStamp) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:768:3
#45 0x79c6c4bc26b0 in IdleRequestExecutor::Run() /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:609:13
#46 0x79c6c2f4c5f7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#47 0x79c6c2f4597e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1252:20
#48 0x79c6c2f4481e in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1117:15
#49 0x79c6c2f44b35 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#50 0x79c6c2f536c6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
#51 0x79c6c2f536c6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#52 0x79c6c2f65723 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#53 0x79c6c2f6bd4f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#54 0x79c6c3ad46e7 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#55 0x79c6c3a2f651 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#56 0x79c6c3a2f651 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#57 0x79c6c87c5958 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#58 0x79c6c888b754 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:539:33
#59 0x79c6c97a5b7b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:646:20
#60 0x79c6c3ad5594 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#61 0x79c6c3a2f651 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#62 0x79c6c3a2f651 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#63 0x79c6c97a4fb9 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:584:34
#64 0x560dd57830ae in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

Comment 1

[Boris Chiou [:boris]]

Perhaps related to Bug 1947516.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

This one is a bit weird, what animation is involved there? The scrollbars or something?

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250330093237-95ab320730a7.
The bug appears to have been introduced in the following build range:

Start: 931a44705ab388cc72fd492e051ceda0a2827743 (20250327164403)
End: 9a82ba2065505026e26c67a7bf58bfdce0a16b89 (20250327134432)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=931a44705ab388cc72fd492e051ceda0a2827743&tochange=9a82ba2065505026e26c67a7bf58bfdce0a16b89

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 4

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

:tsmith, since this bug is a regression, could you fill (if possible) the regressed_by field?
For more information, please visit BugBot documentation.

Comment 6

[Tyson Smith [:tsmith]]

Strict weak ordering checks where added by Bug 1956780 but that is not where the bug was introduced.

Comment 7

[Greg Hess]

:tsmith This bug does not have priority or severity set, could you triage to help assess impact on Fx138 please.

Comment 8

[Tyson Smith [:tsmith]]

That would be a question for someone working on DOM Animation.

Comment 9

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20250328092613-6ae189025cfa) but not with tip (mozilla-central 20250418215014-b9e57c5e3173.)

The bug appears to have been fixed in the following build range:

Start: a2d5f86829b4f79f079b4840dfa9bf78ebb0e5bc (20250410010957)
End: 1ac598af5141a8f20f0ac734607565a44ad5ae0e (20250410092904)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a2d5f86829b4f79f079b4840dfa9bf78ebb0e5bc&tochange=1ac598af5141a8f20f0ac734607565a44ad5ae0e

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.