1976998 - Assertion failure: !mPresContext->RestyleManager()->IsInStyleRefresh(), at /builds/worker/checkouts/gecko/dom/animation/EffectCompositor.cpp:279

Status: RESOLVED FIXED

(Core :: DOM: Animation, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20250522-68577999ef6b (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !mPresContext->RestyleManager()->IsInStyleRefresh(), at /builds/worker/checkouts/gecko/dom/animation/EffectCompositor.cpp:279

#0 0x7fffe8a62007 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
#1 0x7fffe8a62007 in mozilla::EffectCompositor::PostRestyleForAnimation(mozilla::dom::Element*, mozilla::PseudoStyleRequest const&, mozilla::EffectCompositor::CascadeLevel) /builds/worker/checkouts/gecko/dom/animation/EffectCompositor.cpp:279:3
#2 0x7fffe8a61a93 in mozilla::EffectCompositor::RequestRestyle(mozilla::dom::Element*, mozilla::PseudoStyleRequest const&, mozilla::EffectCompositor::RestyleType, mozilla::EffectCompositor::CascadeLevel) /builds/worker/checkouts/gecko/dom/animation/EffectCompositor.cpp:227:7
#3 0x7fffe8a54921 in RequestRestyle /builds/worker/checkouts/gecko/dom/animation/KeyframeEffect.cpp:1013:38
#4 0x7fffe8a54921 in mozilla::dom::KeyframeEffect::NotifyAnimationTimingUpdated(mozilla::PostRestyleMode) /builds/worker/checkouts/gecko/dom/animation/KeyframeEffect.cpp:196:5
#5 0x7fffe8a54100 in UpdateEffect /builds/worker/checkouts/gecko/dom/animation/Animation.cpp:1724:23
#6 0x7fffe8a54100 in mozilla::dom::Animation::UpdateTiming(mozilla::dom::Animation::SeekFlag, mozilla::dom::Animation::SyncNotifyFlag) /builds/worker/checkouts/gecko/dom/animation/Animation.cpp:1660:3
#7 0x7fffe8a4f091 in mozilla::dom::Animation::PlayNoUpdate(mozilla::ErrorResult&, mozilla::dom::Animation::LimitBehavior) /builds/worker/checkouts/gecko/dom/animation/Animation.cpp:1522:3
#8 0x7fffecc0e798 in mozilla::dom::CSSTransition::PlayFromStyle() /builds/worker/workspace/obj-build/dist/include/mozilla/dom/CSSTransition.h:48:5
#9 0x7fffecc0e2fa in nsTransitionManager::DoCreateTransition(mozilla::AnimatedPropertyID const&, mozilla::dom::Element*, mozilla::PseudoStyleRequest const&, mozilla::ComputedStyle const&, mozilla::AnimationCollection<mozilla::dom::CSSTransition>*&, mozilla::TimingParams&&, mozilla::AnimationValue&&, mozilla::AnimationValue&&, mozilla::AnimationValue&&, double) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:510:14
#10 0x7fffecc0d972 in nsTransitionManager::ConsiderInitiatingTransition(mozilla::AnimatedPropertyID const&, nsStyleUIReset const&, unsigned int, float, float, mozilla::StyleTransitionBehavior, mozilla::dom::Element*, mozilla::PseudoStyleRequest const&, mozilla::AnimationCollection<mozilla::dom::CSSTransition>*&, mozilla::ComputedStyle const&, mozilla::ComputedStyle const&, mozilla::AnimatedPropertyIDSet&) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:441:38
#11 0x7fffecc0c20e in operator() /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:124:46
#12 0x7fffecc0c20e in ExpandTransitionProperty<(lambda at /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:120:30)> /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:79:11
#13 0x7fffecc0c20e in nsTransitionManager::DoUpdateTransitions(nsStyleUIReset const&, mozilla::dom::Element*, mozilla::PseudoStyleRequest const&, mozilla::AnimationCollection<mozilla::dom::CSSTransition>*&, mozilla::ComputedStyle const&, mozilla::ComputedStyle const&) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:119:5
#14 0x7fffecc0bbb4 in nsTransitionManager::UpdateTransitions(mozilla::dom::Element*, mozilla::PseudoStyleRequest const&, mozilla::ComputedStyle const&, mozilla::ComputedStyle const&) /builds/worker/checkouts/gecko/layout/style/nsTransitionManager.cpp:55:10
#15 0x7fffecb91e00 in Gecko_UpdateAnimations /builds/worker/checkouts/gecko/layout/style/GeckoBindings.cpp:593:39
#16 0x7ffff206d198 in _$LT$style..gecko..wrapper..GeckoElement$u20$as$u20$style..dom..TElement$GT$::update_animations::h34fb50ab0637aa20 /builds/worker/checkouts/gecko/servo/components/style/gecko/wrapper.rs:1544:13
#17 0x7ffff1b11a0c in style::context::SequentialTask$LT$E$GT$::execute::h8f6743ebf0ea9ebf /builds/worker/checkouts/gecko/servo/components/style/context.rs:462:17
#18 0x7ffff1b11a0c in _$LT$style..context..SequentialTaskList$LT$E$GT$$u20$as$u20$core..ops..drop..Drop$GT$::drop::h84ee62ac510166c5 /builds/worker/checkouts/gecko/servo/components/style/context.rs:516:13
#19 0x7ffff1b11a0c in core::ptr::drop_in_place$LT$style..context..SequentialTaskList$LT$style..gecko..wrapper..GeckoElement$GT$$GT$::h869bc3a10d401223 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:523:1
#20 0x7ffff1b11a0c in core::ptr::drop_in_place$LT$style..context..ThreadLocalStyleContext$LT$style..gecko..wrapper..GeckoElement$GT$$GT$::h5d2307a0eccdd6e3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:523:1
#21 0x7ffff1baf6c5 in core::ptr::drop_in_place$LT$core..option..Option$LT$style..context..ThreadLocalStyleContext$LT$style..gecko..wrapper..GeckoElement$GT$$GT$$GT$::h2256e7bc20f237c9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:523:1
#22 0x7ffff1baf6c5 in core::ptr::drop_in_place$LT$core..cell..UnsafeCell$LT$core..option..Option$LT$style..context..ThreadLocalStyleContext$LT$style..gecko..wrapper..GeckoElement$GT$$GT$$GT$$GT$::hc8ee31b5c9371f63 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:523:1
#23 0x7ffff1baf6c5 in core::ptr::drop_in_place$LT$core..cell..RefCell$LT$core..option..Option$LT$style..context..ThreadLocalStyleContext$LT$style..gecko..wrapper..GeckoElement$GT$$GT$$GT$$GT$::hec89d4940ec7ec0f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:523:1
#24 0x7ffff1baf6c5 in core::ptr::drop_in_place$LT$$u5b$core..cell..RefCell$LT$core..option..Option$LT$style..context..ThreadLocalStyleContext$LT$style..gecko..wrapper..GeckoElement$GT$$GT$$GT$$u3b$$u20$6$u5d$$GT$::h717a2d01c9946765 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:523:1
#25 0x7ffff1baf6c5 in core::ptr::drop_in_place$LT$style..scoped_tls..ScopedTLS$LT$style..context..ThreadLocalStyleContext$LT$style..gecko..wrapper..GeckoElement$GT$$GT$$GT$::hcdb8a05efe5f0d99 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ptr/mod.rs:523:1
#26 0x7ffff1baf6c5 in style::driver::traverse_dom::h87d6744837bdefec /builds/worker/checkouts/gecko/servo/components/style/driver.rs:174:1
#27 0x7ffff1c88e86 in geckoservo::glue::traverse_subtree::hbf38493ebe5d7b9e /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:317:5
#28 0x7ffff1c893c6 in Servo_TraverseSubtree /builds/worker/checkouts/gecko/servo/ports/geckolib/glue.rs:377:5
#29 0x7fffecbc7e9b in mozilla::ServoStyleSet::StyleDocument(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/style/ServoStyleSet.cpp:868:11
#30 0x7fffecc9202a in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3258:20
#31 0x7fffecc92ef5 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3393:3
#32 0x7fffecc576cb in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4647:37
#33 0x7fffe8d91294 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1475:5
#34 0x7fffe8d91294 in mozilla::dom::Document::DetermineProximityToViewportAndNotifyResizeObservers() /builds/worker/checkouts/gecko/dom/base/Document.cpp:18456:11
#35 0x7fffecc1ed44 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2510:14
#36 0x7fffecc1ed44 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1316:7
#37 0x7fffecc1ed44 in RunRenderingPhaseLegacy<(lambda at /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1295:35)> /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1288:3
#38 0x7fffecc1ed44 in void nsRefreshDriver::RunRenderingPhase<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_10>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_10&&, bool (*)(mozilla::dom::Document const&)) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1295:3
#39 0x7fffecc1ad6f in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2506:3
#40 0x7fffecc24681 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:370:13
#41 0x7fffecc24681 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:348:7
#42 0x7fffecc24580 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:364:5
#43 0x7fffecc2442d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:954:5
#44 0x7fffecc239ca in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:864:5
#45 0x7fffecc23f28 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&)::'lambda'()::operator()() const /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:709:31
#46 0x7fffecc23dec in mozilla::detail::RunnableFunction<mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&)::'lambda'()>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:548:5
#47 0x7fffe6e59ad7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#48 0x7fffe6e52b4e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1310:20
#49 0x7fffe6e51887 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1133:15
#50 0x7fffe6e51d05 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#51 0x7fffe6e60c76 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
#52 0x7fffe6e60c76 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#53 0x7fffe6e727b3 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#54 0x7fffe6e78f1f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#55 0x7fffe7a3f177 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#56 0x7fffe7997921 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#57 0x7fffe7997921 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#58 0x7fffec856c58 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#59 0x7fffec91b1d4 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:471:33
#60 0x7fffed85683b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:647:20
#61 0x7fffe7a40024 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#62 0x7fffe7997921 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#63 0x7fffe7997921 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#64 0x7fffed855c79 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:585:34
#65 0x5555555d782e in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22
#66 0x7ffff7a19d8f in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#67 0x7ffff7a19e3f in __libc_start_main ./csu/../csu/libc-start.c:392:3
#68 0x5555555ab098 in _start ??:0:0

Comment 1

[Tyson Smith [:tsmith]]

This has also been detected by live site testing.

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250713214100-57c30f1adca5.
Unable to bisect testcase (Unable to launch the end build!):

Start: 325ffb165783ef8497ea76f226ffad81a6d07f81 (20240715095103)
End: 68577999ef6bc5ec666ffbe15837c39291557312 (20250522213939)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 3

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20250522213939-68577999ef6b) but not with tip (mozilla-central 20250726091124-37783a3d0d3f.)

The bug appears to have been fixed in the following build range:

Start: 18b7a940ba03e23ff5e213809c83af62bba9984a (20250725225459)
End: 189a247f88caec378309c8b58a8171714c0adf6f (20250725180805)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=18b7a940ba03e23ff5e213809c83af62bba9984a&tochange=189a247f88caec378309c8b58a8171714c0adf6f

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Tyson Smith [:tsmith]]

This appears to be fixed. It was last reported by fuzzing and live site testing running m-c 20250725-18b7a940ba03.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Is this testcase worth landing still?

Comment 6

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1976998 - Add crashtest for this bug. r=#style,#layout

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/38e9af503431
https://hg.mozilla.org/integration/autoland/rev/c72147093b08
Add crashtest for this bug. r=layout-reviewers,dholbert

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/54244 for changes under testing/web-platform/tests

Comment 9

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/c72147093b08

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)