1983706 - Assertion failure: inverted (Attempted to get the inverse of a non-invertible matrix), at /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Matrix.h:1369

Status: NEW

(Core :: Panning and Zooming, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing 20250628-fb8a961955b6 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: inverted (Attempted to get the inverse of a non-invertible matrix), at /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Matrix.h:1369

#0 0x723b5afe47de in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
#1 0x723b5afe47de in Inverse /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Matrix.h:1368:5
#2 0x723b5afe47de in mozilla::layers::APZCTreeManager::GetScreenToApzcTransform(mozilla::layers::AsyncPanZoomController const*) const /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:3345:65
#3 0x723b5b06c8f2 in mozilla::layers::WRHitTester::GetAPZCAtPoint(mozilla::gfx::PointTyped<mozilla::ScreenPixel, float> const&, mozilla::RecursiveMutexAutoLock const&) /builds/worker/checkouts/gecko/gfx/layers/apz/src/WRHitTester.cpp:159:27
#4 0x723b5afe9660 in GetTargetAPZC /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:3034:22
#5 0x723b5afe9660 in mozilla::layers::APZCTreeManager::ProcessUnhandledEvent(mozilla::gfx::IntPointTyped<mozilla::LayoutDevicePixel>*, mozilla::layers::ScrollableLayerGuid*, unsigned long*, mozilla::layers::LayersId*) /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZCTreeManager.cpp:2502:23
#6 0x723b5aff6de0 in mozilla::layers::APZInputBridge::ReceiveInputEvent(mozilla::WidgetInputEvent&, std::function<void (unsigned long, mozilla::layers::APZHandledResult const&)>&&) /builds/worker/checkouts/gecko/gfx/layers/apz/src/APZInputBridge.cpp:306:7
#7 0x723b5f691230 in nsBaseWidget::DispatchInputEvent(mozilla::WidgetInputEvent*) /builds/worker/checkouts/gecko/widget/nsBaseWidget.cpp:1310:53
#8 0x723b5f743bf9 in nsWindow::OnEnterNotifyEvent(_GdkEventCrossing*) /builds/worker/checkouts/gecko/widget/gtk/nsWindow.cpp:4233:3
#9 0x723b5f74e164 in enter_notify_event_cb(_GtkWidget*, _GdkEventCrossing*) /builds/worker/checkouts/gecko/widget/gtk/nsWindow.cpp:8116:11
#10 0x723b6de982f6 in ?? ??:0
#11 0x723b6e6646bc in g_signal_handlers_destroy ??:?
#12 0x723b6e6647c0 in g_signal_emit_valist ??:0:0
#13 0x723b6e664882 in g_signal_emit ??:0:0
#14 0x723b6e166bf3 in gtk_widget_get_modifier_mask ??:?
#15 0x723b6e004328 in gtk_main_do_event ??:0:0
#16 0x723b6e6cc406 in gdk_drag_drop_done ??:?
#17 0x723b6e725e2d in gdk_x11_drag_context_get_type ??:?
#18 0x723b6dd145c4 in g_source_query_unix_fd ??:?
#19 0x723b6dd73736 in g_io_channel_new_file ??:?
#20 0x723b6dd13a62 in g_main_context_iteration ??:0:0
#21 0x723b5f7b0a67 in nsAppShell::ProcessNextNativeEvent(bool) /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:493:26
#22 0x723b5f6e46bc in DoProcessNextNativeEvent /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:131:17
#23 0x723b5f6e46bc in nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:250:19
#24 0x723b5f6e48dc in non-virtual thunk to nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal*, bool) /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:0:0
#25 0x723b59cae16e in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1098:10
#26 0x723b59cb4bdf in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#27 0x723b5a8709d7 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#28 0x723b5a7cafc1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:367:3
#29 0x723b5a7cafc1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:349:3
#30 0x723b5f6e4428 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#31 0x723b5f7b08f4 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:471:33
#32 0x723b605b5524 in nsAppStartup::Run() /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:291:30
#33 0x723b606d39be in XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5893:22
#34 0x723b606d4e47 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:6138:8
#35 0x723b606d5968 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:6211:21
#36 0x591603085f66 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:232:22
#37 0x591603085f66 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:464:16

Comment 1

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1983706 using build mozilla-central 20250628205111-fb8a961955b6. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.