1980313 - Assertion failure: aCmp(*(aBegin + a), *(aBegin + b)) (Your comparator is not a valid strict-weak ordering), at /builds/worker/workspace/obj-build/dist/include/nsTArray.h:319

Status: NEW

(Core :: SVG, defect)

Description

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: testcase.html

Found while fuzzing 20250703-cfe2a63df8a1 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: aCmp(*(aBegin + a), *(aBegin + b)) (Your comparator is not a valid strict-weak ordering), at /builds/worker/workspace/obj-build/dist/include/nsTArray.h:319

0|0|xul.dll|detail::AssertStrictWeakOrder<mozilla::SMILAnimationFunction **,`lambda at /builds/worker/workspace/obj-build/dist/include/nsTArray.h:2385:19'>(mozilla::SMILAnimationFunction**, mozilla::SMILAnimationFunction**, nsTArray_Impl<mozilla::SMILAnimationFunction *,nsTArrayInfallibleAllocator>::Sort<mozilla::SMILAnimationFunction::Comparator>::<lambda_1> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/ds/nsTArray.h:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|318|0x5cd
0|1|xul.dll|mozilla::SMILCompositor::ComposeAttribute(bool&)|hg:hg.mozilla.org/mozilla-central:dom/smil/SMILCompositor.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|87|0x195
0|2|xul.dll|mozilla::SMILAnimationController::DoSample(bool)|hg:hg.mozilla.org/mozilla-central:dom/smil/SMILAnimationController.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|347|0x97a
0|3|xul.dll|mozilla::dom::SVGAnimationElement_Binding::beginElement(JSContext*, JS::Handle<JSObject *>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:8bd2bf707067c3e02bcaebc47a45902eae494be41763fc4b01c3f91f8d7b159df5c5b44aaaa75913e15c0cb8d6b793457fad9a8345a1b7ebf5ce560dfc7ea8d3/dom/bindings/SVGAnimationElementBinding.cpp:|432|0x85
0|4|xul.dll|mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|3306|0x1bd
0|5|xul.dll|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|501|0xf2
0|6|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|597|0x1e3
0|7|xul.dll|js::Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|3287|0xd86d
0|8|xul.dll|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|471|0x23b
0|9|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|629|0x2e6
0|10|xul.dll|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|696|0x12c
0|11|xul.dll|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/CallAndConstruct.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|119|0x202
0|12|xul.dll|mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:6bb50a9febd07b2ad041cb59a1fa6678b97d5dfa7934c45cdfb310e02ee1d5fd2d0aff84c3cbda807717ae7247884aa5f52594385c678b698b0d951ba796aa45/dom/bindings/EventHandlerBinding.cpp:|65|0x2cd
0|13|xul.dll|mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:2c0600fb668133ec78b4dbdd71621eeefcafca4a527e24f8dcefe291fb1ae7c5c4647bce637883fe669db31805b6a9d1251a807433b4f2db5c3b207f28308026/dist/include/mozilla/dom/EventHandlerBinding.h:|82|0x13a
0|14|xul.dll|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|hg:hg.mozilla.org/mozilla-central:dom/events/JSEventHandler.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|200|0x635
0|15|xul.dll|mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1367|0x2bf
0|16|xul.dll|mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1674|0x3f6
0|17|xul.dll|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1579|0x178
0|18|xul.dll|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|365|0x1f4
0|19|xul.dll|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|606|0x6f5
0|20|xul.dll|mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget *>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1268|0x1b09
0|21|xul.dll|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1031|0x55b
0|22|xul.dll|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|6445|0x578
0|23|xul.dll|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|5765|0x7d2
0|24|xul.dll|nsDocLoader::DoFireOnStateChange(nsIWebProgress* const, nsIRequest* const, int&, const nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1477|0x202
0|25|xul.dll|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1010|0x1ff
0|26|xul.dll|nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|831|0x814
0|27|xul.dll|nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|712|0x67e
0|28|xul.dll|nsDocShell::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|14353|0x65
0|29|xul.dll|mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|657|0x1d2
0|30|xul.dll|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|541|0xa9
0|31|xul.dll|mozilla::dom::Document::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|12303|0xf9
0|32|xul.dll|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|8589|0x3f2
0|33|xul.dll|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document *,void (mozilla::dom::Document::*)(),1,0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1134|0x20
0|34|xul.dll|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|703|0x1d
0|35|xul.dll|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1310|0x737
0|36|xul.dll|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1133|0x57
0|37|xul.dll|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|639|0x69
0|38|xul.dll|mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:7'>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|548|0x16
0|39|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|1159|0x66b
0|40|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|480|0x70
0|41|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|85|0xb7
0|42|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|362|0x3e
0|43|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|344|0x6e
0|44|xul.dll|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|148|0x27
0|45|xul.dll|nsAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/windows/nsAppShell.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|673|0x17d
0|46|xul.dll|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|652|0x78
0|47|xul.dll|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|235|0x39
0|48|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|362|0x3e
0|49|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|344|0x6e
0|50|xul.dll|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|590|0x9f9
0|51|firefox.exe|NS_internal_main(int, char**, char**)|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|397|0x1fd
0|52|firefox.exe|wmain(int, wchar_t**)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsWindowsWMain.cpp:cfe2a63df8a1694ae8d04e43c1a1e0c67a1ef548|151|0x246
0|53|firefox.exe|__scrt_common_main_seh()|/builds/worker/workspace/obj-build/browser/app/D:/a/_work/1/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl|288|0x10b

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250731153714-d34398f38898.
The bug appears to have been introduced in the following build range:

Start: 931a44705ab388cc72fd492e051ceda0a2827743 (20250327164403)
End: 9a82ba2065505026e26c67a7bf58bfdce0a16b89 (20250327134432)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=931a44705ab388cc72fd492e051ceda0a2827743&tochange=9a82ba2065505026e26c67a7bf58bfdce0a16b89

Comment 2

[Robert Longson [:longsonr]]

The regression range is just bug 1956780 which is when the assert was created. This issue has been around much longer than that.

Comment 3

[Daniel Holbert [:dholbert]]

[I'll take a look in pernosco once a trace is ready. Or I can look locally too if pernosco ends up not working out for some reason.]

Comment 4

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 5

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 6

[Robert Longson [:longsonr]]

I think it may be something along these lines...

1. <animate attributeName="color-interpolation-filters" begin="a.begin"></animate>
2. <animate attributeName="color-interpolation-filters"></animate>
3. <set id="a" attributeName="color-interpolation-filters" begin="x.begin">

1 has a syncbase dependency on 3. If you compare 1 and 3, 1 sorts after 3 when 3 is active per https://searchfox.org/mozilla-central/source/dom/smil/SMILAnimationFunction.cpp#268

you'd think it would sort as 2, 3, 1 because of that but..

1 and 2 have no syncbase dependency so 1 comes before 2 and 2 and 3 have no syncbase dependency so 2 comes before 3 so if you do those comparisons you'd get 1, 2, 3.

Comment 7

[Boris Chiou [:boris]]

Hi, Daniel,
Just a reminder that the pernosco session is ready. (Also, I can reproduce this locally with the testcase.html).

Mark this as S3.

Comment 8

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1980313 using build mozilla-central 20250703155456-cfe2a63df8a1. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.