2047032 - Assertion failure: !mHoldTime.IsNull() || !mStartTime.IsNull() (An animation in the play-pending state should have either a resolved hold time or resolved start time), at checkouts/gecko/dom/animation/Animation.cpp:1836

Status: VERIFIED FIXED

(Core :: DOM: Animation, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260516-d3d8f9236529 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !mHoldTime.IsNull() || !mStartTime.IsNull() (An animation in the play-pending state should have either a resolved hold time or resolved start time), at checkouts/gecko/dom/animation/Animation.cpp:1836

#0 0x730850331dc5 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x730850331dc5 in mozilla::dom::Animation::ResumeAt(mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator> const&) /builds/worker/workspace/obj-build/dom/animation/./../../../../checkouts/gecko/dom/animation/Animation.cpp:1834:3
#2 0x73085032f174 in FinishPendingAt /builds/worker/workspace/obj-build/dom/animation/./../../../../checkouts/gecko/dom/animation/Animation.h:486:7
#3 0x73085032f174 in mozilla::dom::Animation::TryTriggerNow() /builds/worker/workspace/obj-build/dom/animation/./../../../../checkouts/gecko/dom/animation/Animation.cpp:1190:3
#4 0x73085032eb20 in mozilla::dom::Animation::Tick(mozilla::dom::AnimationTimeline::TickState&) /builds/worker/workspace/obj-build/dom/animation/./../../../../checkouts/gecko/dom/animation/Animation.cpp:1135:7
#5 0x730850339030 in mozilla::dom::AnimationTimeline::Tick(mozilla::dom::AnimationTimeline::TickState&) /builds/worker/workspace/obj-build/dom/animation/./../../../../checkouts/gecko/dom/animation/AnimationTimeline.cpp:76:16
#6 0x73085033a00e in mozilla::dom::DocumentTimeline::WillRefresh() /builds/worker/workspace/obj-build/dom/animation/./../../../../checkouts/gecko/dom/animation/DocumentTimeline.cpp:197:17
#7 0x730850339b2b in mozilla::dom::AnimationTimelinesController::WillRefresh() /builds/worker/workspace/obj-build/dom/animation/./../../../../checkouts/gecko/dom/animation/AnimationTimelinesController.cpp:25:9
#8 0x730854894587 in UpdateAndReduceAnimations /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2073:35
#9 0x730854894587 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2490:25
#10 0x730854894587 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1309:7
#11 0x730854894587 in RunRenderingPhaseLegacy<(lambda at /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1288:35)> /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1281:3
#12 0x730854894587 in void nsRefreshDriver::RunRenderingPhase<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_8>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_8&&, bool (*)(mozilla::dom::Document const&)) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1288:3
#13 0x730854890c2c in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2471:3
#14 0x73085489a971 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:365:13
#15 0x73085489a971 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:343:7
#16 0x73085489a870 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:359:5
#17 0x73085489a71d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:946:5
#18 0x730854899d5a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:856:5
#19 0x730854899236 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:587:14
#20 0x730853b9b82b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:64:15
#21 0x730853e23ee0 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/dom/ipc/./../../ipc/ipdl/PVsyncChild.cpp:241:78
#22 0x73084f12979c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../ipdl/PBackgroundChild.cpp:4955:32
#23 0x73084f0c7b9e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1797:25
#24 0x73084f0c5114 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1723:9
#25 0x73084f0c5b27 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1512:3
#26 0x73084f0c6b09 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1614:14
#27 0x73084ef956b7 in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:719:16
#28 0x73084ef8abb4 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1358:20
#29 0x73084ef896e7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1181:15
#30 0x73084ef89b65 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:655:36
#31 0x73084ef94e39 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:350:37
#32 0x73084ef94e39 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:536:5
#33 0x73084efa9973 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1179:16
#34 0x73084efaf6cf in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:472:10
#35 0x73084f0cda53 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:105:5
#36 0x73084f025591 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#37 0x73084f025591 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#38 0x7308544600c8 in nsBaseAppShell::Run() /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/nsBaseAppShell.cpp:151:27
#39 0x7308545394d4 in nsAppShell::Run() /builds/worker/workspace/obj-build/widget/gtk/./../../../../checkouts/gecko/widget/gtk/nsAppShell.cpp:575:33
#40 0x73085557324b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:20
#41 0x73084f0ce944 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:233:9
#42 0x73084f025591 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#43 0x73084f025591 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#44 0x7308555729a2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:594:34
#45 0x56b14d3a0b1c in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:466:22

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260611214344-e4e8579f6274.
The bug appears to have been introduced in the following build range:

Start: 3ca1ee6df7e612ba670f3215f0f7d167b66b93ac (20260503201528)
End: a71b64af97c7143976df1f1d2094c42bef57abbe (20260503223403)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3ca1ee6df7e612ba670f3215f0f7d167b66b93ac&tochange=a71b64af97c7143976df1f1d2094c42bef57abbe

Comment 2

[Boris Chiou [:boris]]

(In reply to Bugmon [:jkratzer for issues] from comment #1)

Verified bug as reproducible on mozilla-central 20260611214344-e4e8579f6274.
The bug appears to have been introduced in the following build range:

Start: 3ca1ee6df7e612ba670f3215f0f7d167b66b93ac (20260503201528)
End: a71b64af97c7143976df1f1d2094c42bef57abbe (20260503223403)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3ca1ee6df7e612ba670f3215f0f7d167b66b93ac&tochange=a71b64af97c7143976df1f1d2094c42bef57abbe

This is related to Bug 1676795. We have to investigate this before shipping.

Comment 3

[BugBot [:suhaib / :marco]]

Based on comment #1, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:dshin, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Comment 4

[David Shin[:dshin]]

Attachment: Bug 2047032: Handle no time being set when switching into document timeline from scroll timeline. r=#scroll-animation

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/252e2c3d83f5
https://hg.mozilla.org/integration/autoland/rev/6ad3d9d2f2bb
Handle no time being set when switching into document timeline from scroll timeline. r=layout-scroll-driven-animation-reviewers,boris

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/e26cbf34e72f
https://hg.mozilla.org/integration/autoland/rev/eb9cc18dcfc5
Revert "Bug 2047032: Handle no time being set when switching into document timeline from scroll timeline. r=layout-scroll-driven-animation-reviewers,boris" for causing wpt failures at StickyTimeDuration.h

Comment 7

[rperta]

Backed out for causing wpt failures at StickyTimeDuration.h
Backout link
Push with failures
Failure log(s)

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62095 for changes under testing/web-platform/tests

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c1f1dbc44ecf
https://hg.mozilla.org/integration/autoland/rev/791210cabea0
Handle no time being set when switching into document timeline from scroll timeline. r=layout-scroll-driven-animation-reviewers,boris

Comment 10

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/791210cabea0

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 12

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR was closed without merging

Comment 13

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260821094724-8e966e6c894a.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.