Assertion failure: aChild->GetApzc() != parent, at /builds/worker/checkouts/gecko/gfx/layers/apz/src/HitTestingTreeNode.cpp:93

#0 0x7fe98f47423a in mozilla::layers::HitTestingTreeNode::SetLastChild(mozilla::layers::HitTestingTreeNode*) src/gfx/layers/apz/src/HitTestingTreeNode.cpp:93:7
#1 0x7fe98f4486f8 in mozilla::layers::HitTestingTreeNode* mozilla::layers::APZCTreeManager::PrepareNodeForLayer<mozilla::layers::LayerMetricsWrapper>(mozilla::RecursiveMutexAutoLock const&, mozilla::layers::LayerMetricsWrapper const&, mozilla::layers::FrameMetrics const&, mozilla::layers::LayersId, mozilla::layers::AncestorTransform const&, mozilla::layers::HitTestingTreeNode*, mozilla::layers::HitTestingTreeNode*, mozilla::layers::APZCTreeManager::TreeBuildingState&) src/gfx/layers/apz/src/APZCTreeManager.cpp:1359:5
#2 0x7fe98f44687e in void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int)::'lambda'(mozilla::layers::LayerMetricsWrapper)::operator()(mozilla::layers::LayerMetricsWrapper) const src/gfx/layers/apz/src/APZCTreeManager.cpp:465:38
#3 0x7fe98f444a05 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:139:3
#4 0x7fe98f444a39 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#5 0x7fe98f444a39 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#6 0x7fe98f444a39 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#7 0x7fe98f444a39 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#8 0x7fe98f444a39 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#9 0x7fe98f444a39 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#10 0x7fe98f444a39 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#11 0x7fe98f444a39 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#12 0x7fe98f444a39 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#13 0x7fe98f444ae4 in _ZN7mozilla6layersL11ForEachNodeINS0_15ReverseIteratorENS0_19LayerMetricsWrapperEZNS0_15APZCTreeManager24UpdateHitTestingTreeImplIS3_EEvRKT_bNS0_8LayersIdEjEUlS3_E_ZNS5_IS3_EEvS8_bS9_jEUlS3_E0_EENSt9enable_ifIXaasr3stdE9is_same_vIDTclfp0_fp_EEvEsr3stdE9is_same_vIDTclfp1_fp_EEvEEvE4typeET0_RKT1_RKT2_ src/gfx/layers/TreeTraversal.h:143:5
#14 0x7fe98f3f892e in void mozilla::layers::APZCTreeManager::UpdateHitTestingTreeImpl<mozilla::layers::LayerMetricsWrapper>(mozilla::layers::LayerMetricsWrapper const&, bool, mozilla::layers::LayersId, unsigned int) src/gfx/layers/apz/src/APZCTreeManager.cpp:433:5
#15 0x7fe98f41fafc in UpdateHitTestingTree src/gfx/layers/apz/src/APZCTreeManager.cpp:695:3
#16 0x7fe98f41fafc in mozilla::layers::APZUpdater::UpdateHitTestingTree(mozilla::layers::Layer*, bool, mozilla::layers::LayersId, unsigned int) src/gfx/layers/apz/src/APZUpdater.cpp:169:9
#17 0x7fe98f573b3d in mozilla::layers::CompositorBridgeParent::NotifyShadowTreeTransaction(mozilla::layers::LayersId, bool, mozilla::layers::FocusTarget const&, bool, unsigned int, bool, bool) src/gfx/layers/ipc/CompositorBridgeParent.cpp:833:22
#18 0x7fe98f5907cc in mozilla::layers::ContentCompositorBridgeParent::ShadowLayersUpdated(mozilla::layers::LayerTransactionParent*, mozilla::layers::TransactionInfo const&, bool) src/gfx/layers/ipc/ContentCompositorBridgeParent.cpp:355:19
#19 0x7fe98f5a5323 in mozilla::layers::LayerTransactionParent::RecvUpdate(mozilla::layers::TransactionInfo const&) src/gfx/layers/ipc/LayerTransactionParent.cpp:444:22
#20 0x7fe98ea5ff2a in mozilla::layers::PLayerTransactionParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PLayerTransactionParent.cpp:132:66
#21 0x7fe98e84644b in mozilla::layers::PCompositorManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCompositorManagerParent.cpp:205:32
#22 0x7fe98e6fb5ae in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2153:25
#23 0x7fe98e6f7bad in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2077:9
#24 0x7fe98e6f9056 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1925:3
#25 0x7fe98e6f9d9b in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1956:13
#26 0x7fe98ddf3a2f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1200:14
#27 0x7fe98ddf9a4a in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:548:10
#28 0x7fe98e7020f6 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:332:5
#29 0x7fe98e66d043 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:334:10
#30 0x7fe98e66cf5d in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
#31 0x7fe98e66cf5d in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
#32 0x7fe98ddf012e in nsThread::ThreadFunc(void*) src/xpcom/threads/nsThread.cpp:441:10
#33 0x7fe9a2ad8abb in _pt_root src/nsprpub/pr/src/pthreads/ptthread.c:201:5
#34 0x7fe9a3052608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477:8
#35 0x7fe9a2c1b292 in clone /build/glibc-ZN95T4/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

A Pernosco session is available here: https://pernos.co/debug/lGtRfOPbj25GcEzBOQvseg/index.html

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210105215658-bcfbf7c9d108.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 12fb5e522dd32b5ff50c8196c05b3ba9d244417e (20200108094158)
End: 1d89f3cb5bb3e5a37b0249977838c4a98c162c80 (20210105043131)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

This is similar to bug 1458145: FrameLayerBuilder produces a malformed layer tree, with an ancestor and a descendant layer that both have scroll metadata with the same scrollid.

This is basically the same issue as bug 1458145. There we had the following display list structure:

OwnLayer
   Perspective
      Transform

and here we have:

BlendMode
   Perspective
      Transform

and the ASR adjustment needs to be extended to the BlendMode item as well.

The new testcase triggers the assertion with WebRender, which means my patch (which applies to non-WebRender) no longer applies.

Here's a WebRenderLayerScrollData tree for the new testcase:

WebRenderLayerScrollData(0x7ff08b543008), descendantCount=9, visible=[]
    WebRenderLayerScrollData(0x7ff08b543190), descendantCount=8, visible=[]
        WebRenderLayerScrollData(0x7ff08b543dd0), descendantCount=0, metadata0={ [metrics={ [cb=(x=0, y=0, w=1280, h=887)] [sr=(x=0, y=0, w=1280, h=887)] [s=(0,0)] [dp=(x=0, y=0, w=1280, h=887)] [cdp=(x=0, y=0, w=0, h=0)] [rcs=(1280 x 887)] [v=(x=0, y=0, w=1280, h=887)] [z=(ld=1.000 r=1.000 cr=1 z=1 er=1 )] [u=(0 2)] scrollId=3 [rcd] }] [color=dev_rgba(255, 255, 255, 1.000000)] [overscroll=auto] [1 scrollupdates] }, visible=[]
        WebRenderLayerScrollData(0x7ff08b543ac0), descendantCount=1, metadata0={ [metrics={ [cb=(x=0, y=0, w=1280, h=887)] [sr=(x=0, y=0, w=1280, h=887)] [s=(0,0)] [dp=(x=0, y=0, w=1280, h=887)] [cdp=(x=0, y=0, w=0, h=0)] [rcs=(1280 x 887)] [v=(x=0, y=0, w=1280, h=887)] [z=(ld=1.000 r=1.000 cr=1 z=1 er=1 )] [u=(0 2)] scrollId=3 [rcd] }] [color=dev_rgba(255, 255, 255, 1.000000)] [overscroll=auto] [1 scrollupdates] }, ancestorTransform=[ 1 0; 0 1; 8 12; ], visible=[]
            WebRenderLayerScrollData(0x7ff08b543c48), descendantCount=0, metadata0={ [metrics={ [cb=(x=0, y=0, w=1252, h=0)] [sr=(x=0, y=0, w=1252, h=19)] [s=(0,0)] [dp=(x=0, y=0, w=1252, h=19)] [cdp=(x=0, y=0, w=0, h=0)] [rcs=(1280 x 887)] [v=(x=0, y=0, w=1252, h=0)] [z=(ld=1.000 r=1.000 cr=1 z=1 er=1 )] [u=(0 3)] scrollId=4 }] [color=dev_rgba(0, 0, 0, 0.000000)] [scrollParent=3] [overscroll=auto] [1 scrollupdates] }, visible=[]
        WebRenderLayerScrollData(0x7ff08b543938), descendantCount=0, metadata0={ [metrics={ [cb=(x=0, y=0, w=1280, h=887)] [sr=(x=0, y=0, w=1280, h=887)] [s=(0,0)] [dp=(x=0, y=0, w=1280, h=887)] [cdp=(x=0, y=0, w=0, h=0)] [rcs=(1280 x 887)] [v=(x=0, y=0, w=1280, h=887)] [z=(ld=1.000 r=1.000 cr=1 z=1 er=1 )] [u=(0 2)] scrollId=3 [rcd] }] [color=dev_rgba(255, 255, 255, 1.000000)] [overscroll=auto] [1 scrollupdates] }, ancestorTransform=[ 1 0; 0 1; 8 12; ], visible=[]
        WebRenderLayerScrollData(0x7ff08b543318), descendantCount=3, metadata0={ [metrics={ [cb=(x=0, y=0, w=1280, h=887)] [sr=(x=0, y=0, w=1280, h=887)] [s=(0,0)] [dp=(x=0, y=0, w=1280, h=887)] [cdp=(x=0, y=0, w=0, h=0)] [rcs=(1280 x 887)] [v=(x=0, y=0, w=1280, h=887)] [z=(ld=1.000 r=1.000 cr=1 z=1 er=1 )] [u=(0 2)] scrollId=3 [rcd] }] [color=dev_rgba(255, 255, 255, 1.000000)] [overscroll=auto] [1 scrollupdates] }, ancestorTransform=[ 1 0; 0 1; 8 12; ], visible=[]
            WebRenderLayerScrollData(0x7ff08b5434a0), descendantCount=2, metadata0={ [metrics={ [cb=(x=0, y=0, w=1252, h=0)] [sr=(x=0, y=0, w=1252, h=19)] [s=(0,0)] [dp=(x=0, y=0, w=1252, h=19)] [cdp=(x=0, y=0, w=0, h=0)] [rcs=(1280 x 887)] [v=(x=0, y=0, w=1252, h=0)] [z=(ld=1.000 r=1.000 cr=1 z=1 er=1 )] [u=(0 3)] scrollId=4 }] [color=dev_rgba(0, 0, 0, 0.000000)] [scrollParent=3] [overscroll=auto] [1 scrollupdates] }, visible=[]
                WebRenderLayerScrollData(0x7ff08b543628), descendantCount=1, ancestorTransform=[ 1 0; 0 1; 8 12; ], visible=[]
                    WebRenderLayerScrollData(0x7ff08b5437b0), descendantCount=0, metadata0={ [metrics={ [cb=(x=0, y=0, w=1252, h=0)] [sr=(x=0, y=0, w=1252, h=19)] [s=(0,0)] [dp=(x=0, y=0, w=1252, h=19)] [cdp=(x=0, y=0, w=0, h=0)] [rcs=(1280 x 887)] [v=(x=0, y=0, w=1252, h=0)] [z=(ld=1.000 r=1.000 cr=1 z=1 er=1 )] [u=(0 3)] scrollId=4 }] [color=dev_rgba(0, 0, 0, 0.000000)] [scrollParent=3] [overscroll=auto] [1 scrollupdates] }, visible=[]

Metadata with scrollId=4 is present on both 0x7ff08b5437b0 and its ancestor 0x7ff08b5437b0.

Here, we have a display list fragment like this:

Transform ASR=2
  Mask ASR=3
    Filter ASR=3

and it builds a WRLSD subtree like this:

W1 item=Mask metrics=[3]
  W2 item=Filter deferredTransform=Transform
    W3 item=Filter metrics=[3]

In addition to having metrics for scrollId=3 present on a pair of ancestor/descendant nodes (which causes the assertion downstream), this is wrong in an additional way: the transform with ASR=2 is emitted at the wrong level. Assuming the node for the Mask item is the one that's supposed to keep the scrollId=3 metrics, the ASR=2 transform item should be on an ancestor of it, i.e. we want something like:

W item=Mask deferredTransform=Transform
  W item=Mask metrics=[3]
    W item=Filter metrics=[]

The reason the wrong tree arises is that WRLSD nodes are emitted on the way out of the recursion over the display list in WebRenderCommandBuilder (i.e. the recursive step is here, and the WRLSD node(s) for the item are emitted here).

So, when processing the above display list:

• We process the Transform item and defer its transform (this happens here, before recursing over the transform's children).
• We recurse and process the Mask item. We do not yet emit a WRLSD node for it.
• We recurse and process the Filter item. Now we're on the way out of the recursion, we emit WRLSD nodes for the Filter. This is what looks at the deferred transform item, sees that it's for ASR=2 and we're emitting an ASR=3 item, so it emits W3 and W2 in the bad tree.
  • The metrics=[3] is mistakenly emitted for W3 because we use the deferred transform item's ASR=2 as the stopAtAsr parameter when constructing W3, even though this is a descendant of what W2's stopAtAsr will be (which is correctly ASR=3).
• Further on our way out of the recursion, we emit W1 for the Mask, and get the metrics=[3] again.

Since WebRenderLayerScrollData nodes are emitted on the way out
of the recursion over the display list, we need to be careful
that a deferred transform doesn't end up on a deeper node than
it should be.

My patch seems to regress helper_bug1550510.html.

(In reply to Botond Ballo [:botond] from comment #11)

My patch seems to regress helper_bug1550510.html.

I made the silly mistake of overlooking that ActiveScrolledRoot::IsAncestor() considers an ASR to be an ancestor of itself.

Depends on D123700

https://hg.mozilla.org/mozilla-central/rev/6e364df994c1
https://hg.mozilla.org/mozilla-central/rev/ec8178c6ba43
https://hg.mozilla.org/mozilla-central/rev/55e941d1494f

:botond, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Sorry, wrong needinfo because of a bug in the bot.