1958991 - Assertion failure: aCmp(*(aBegin + a), *(aBegin + b)) (Your comparator is not a valid strict-weak ordering), at /builds/worker/workspace/obj-build/dist/include/nsTArray.h:319

Status: NEW

(Core :: Web Painting, defect)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20250403-e06e468f2d56 (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting https://www.avdbs.com/. A Pernosco session is available here: https://pernos.co/debug/1IqVlmclmejzOIf0zm6hvw/index.html

Assertion failure: aCmp(*(aBegin + a), *(aBegin + b)) (Your comparator is not a valid strict-weak ordering), at /builds/worker/workspace/obj-build/dist/include/nsTArray.h:319

#0 0x7fffed48cf89 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
#1 0x7fffed48cf89 in void detail::AssertStrictWeakOrder<mozilla::FramesWithDepth*, void nsTArray_Impl<mozilla::FramesWithDepth, nsTArrayInfallibleAllocator>::StableSort<nsDefaultComparator<mozilla::FramesWithDepth, mozilla::FramesWithDepth>>(nsDefaultComparator<mozilla::FramesWithDepth, mozilla::FramesWithDepth> const&)::'lambda'(nsDefaultComparator<mozilla::FramesWithDepth, mozilla::FramesWithDepth> const&, auto const&)>(nsDefaultComparator<mozilla::FramesWithDepth, mozilla::FramesWithDepth>, nsDefaultComparator<mozilla::FramesWithDepth, mozilla::FramesWithDepth>, auto const&) /builds/worker/workspace/obj-build/dist/include/nsTArray.h:318:9
#2 0x7fffed45efb4 in StableSort<nsDefaultComparator<mozilla::FramesWithDepth, mozilla::FramesWithDepth> > /builds/worker/workspace/obj-build/dist/include/nsTArray.h:2415:5
#3 0x7fffed45efb4 in StableSort /builds/worker/workspace/obj-build/dist/include/nsTArray.h:2421:5
#4 0x7fffed45efb4 in mozilla::FlushFramesArray(nsTArray<mozilla::FramesWithDepth>&, nsTArray<nsIFrame*>*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2368:11
#5 0x7fffed45e4f5 in mozilla::nsDisplayList::HitTest(mozilla::nsDisplayListBuilder*, nsRect const&, mozilla::nsDisplayItem::HitTestState*, nsTArray<nsIFrame*>*) const /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2459:9
#6 0x7fffed45e3a0 in mozilla::nsDisplayList::HitTest(mozilla::nsDisplayListBuilder*, nsRect const&, mozilla::nsDisplayItem::HitTestState*, nsTArray<nsIFrame*>*) const /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2435:13
#7 0x7fffed0f9164 in nsLayoutUtils::GetFramesForArea(mozilla::RelativeTo, nsRect const&, nsTArray<nsIFrame*>&, nsLayoutUtils::FrameForPointOptions const&) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:2587:8
#8 0x7fffed676209 in mozilla::a11y::LocalAccessible::BundleFieldsForCache(unsigned long, mozilla::a11y::CacheUpdateType, unsigned long) /builds/worker/checkouts/gecko/accessible/generic/LocalAccessible.cpp:3534:7
#9 0x7fffed675397 in mozilla::a11y::DocAccessible::ProcessQueuedCacheUpdates(unsigned long) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:1643:9
#10 0x7fffed63c6e5 in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:1021:16
#11 0x7fffed02b135 in nsRefreshDriver::TickObserverArray(unsigned int, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2569:10
#12 0x7fffed02773d in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2836:8
#13 0x7fffed0302f1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:13
#14 0x7fffed0302f1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:346:7
#15 0x7fffed0301f0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:362:5
#16 0x7fffed03009d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:948:5
#17 0x7fffed02f60a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:858:5
#18 0x7fffed02f499 in mozilla::VsyncRefreshDriverTimer::IdlePriorityNotify() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:801:7
#19 0x7fffe7157326 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
#20 0x7fffe7157326 in __invoke_impl<nsresult, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#21 0x7fffe7157326 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#22 0x7fffe7157326 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#23 0x7fffe7157326 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#24 0x7fffe7157326 in apply<nsIThread, nsresult (nsIThread::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
#25 0x7fffe7157326 in mozilla::detail::RunnableMethodImpl<nsUpdateProcessor*, void (nsUpdateProcessor::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
#26 0x7fffe73fb555 in IdleRunnableWrapper::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:327:22
#27 0x7fffe73fdac4 in IdleRunnableWrapper::TimedOut(nsITimer*, void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:344:15
#28 0x7fffe73de173 in operator() /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:681:36
#29 0x7fffe73de173 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
#30 0x7fffe73de173 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:678:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
#31 0x7fffe73de173 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:677:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:678:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
#32 0x7fffe73de173 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:677:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:678:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
#33 0x7fffe73de173 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:677:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:678:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:902:12
#34 0x7fffe73de173 in match<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:677:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:678:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:857:12
#35 0x7fffe73de173 in nsTimerImpl::Fire(int) /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:675:22
#36 0x7fffe73dd460 in nsTimerEvent::Run() /builds/worker/checkouts/gecko/xpcom/threads/TimerThread.cpp:515:11
#37 0x7fffe73d0ea7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#38 0x7fffe73ca22e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1252:20
#39 0x7fffe73c8f67 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1075:15
#40 0x7fffe73c93e5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#41 0x7fffe73d7f76 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
#42 0x7fffe73d7f76 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#43 0x7fffe73e9fd3 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#44 0x7fffe73f05ff in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#45 0x7fffe7f81757 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#46 0x7fffe7edbd71 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#47 0x7fffe7edbd71 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#48 0x7fffecc51708 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#49 0x7fffecd17504 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:539:33
#50 0x7fffedc37c4b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:646:20
#51 0x7fffe7f82604 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#52 0x7fffe7edbd71 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#53 0x7fffe7edbd71 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#54 0x7fffedc37089 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:584:34
#55 0x5555555de19e in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

Comment 1

[Jens Stutte [:jstutte]]

Thanks for the pernosco session!

Based on this I see as input data:

[0].mDepth=0
[1].mDepth=0
[2].mDepth=-590.34716796875
[3].mDepth=NaN
[4].mDepth=-830.9254760742188
[5].mDepth=-1199.9998779296876
[6].mDepth=NaN

and I can believe there is no valid order for NaN values. The values seem to come from nsDisplayTransform::GetHitDepthAtPoint.

IIUC the function uses float precision for all the math, also for temporary values. That might cause some problems?

Not sure if we can make the comparator safe for NaN easily (well, maybe I am just a bit slow on float arithmetic caveats and how to deal with them this morning).

Comment 2

[Jens Stutte [:jstutte]]

Fun note: Looking at the pernosco session from bug 1957172 reveals that there was also a NaN in the input data. So the "fix" there might not have been necessary (but is probably still nicer).

Comment 3

[Timothy Nikkel (:tnikkel)]

How does the nan come about in that function? What does the matrix and it's inverse look like?

Comment 4

[Jens Stutte [:jstutte]]

The moment the first NaN value is calculated.

And the moment the second NaN value comes to life.

Comment 5

[Timothy Nikkel (:tnikkel)]

The matrices look reasonable. I ran through the math by hand in the function to compute the values that are optimized out. The first nan comes from the As2DPoint call because

point = (-72.399996567 , -1199.9999419, 2.29488251e-9, 6.96894709e-9)

so we divide by 6.96894709e-9 to get the nan I guess. If you work out the math by hand for the rest of the function you end up with 1199.99995419. Which is just the negative of the z calculated in the Project Point function above that.

The function as a whole roughly calculates the z coord of

matrix * inverse * (aPoint.x, aPoint.y, z, 1)

where z is the z calculated in ProjectPoint. So perhaps all the math of this function can be symbolically drastically simplified to make it quicker and simpler and would avoid having to go to floating point extremes.

Comment 6

[Timothy Nikkel (:tnikkel)]

Indeed, after working this in more detail, the function GetHitDepthAtPoint seems to be equivalent to

-(aPoint.x * inverse._13 + aPoint.y * inverse._23 + inverse._43) / inverse._33

which is the calculation from ProjectPoint. Which makes sense since it is the z value that transforms to the z=0 plane.

We can just replace it with that and we will avoid floating point issues and be faster too.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:tnikkel, could you have a look please?

For more information, please visit BugBot documentation.