Closed Bug 1603224 Opened 5 years ago Closed 5 years ago

division by zero in gfx/layers/apz/src/AsyncPanZoomController.cpp:5298

Categories

(Core :: Panning and Zooming, defect, P3)

defect

Tracking

()

RESOLVED FIXED
mozilla73
Tracking Status
firefox73 --- fixed

People

(Reporter: tsmith, Assigned: botond)

References

(Blocks 1 open bug)

Details

(Keywords: testcase)

Attachments

(1 file)

Found with m-c 20191211-b823b005f00e
This is triggered with an UBSan build while running gtests. To enable this check add the following to your mozconfig:

ac_add_options --enable-address-sanitizer
ac_add_options --enable-undefined-sanitizer="float-divide-by-zero"
ac_add_options --disable-jemalloc
[ RUN      ] APZCBasicTester.OverScroll_Bug1152051a
gfx/layers/apz/src/AsyncPanZoomController.cpp:5298:36: runtime error: division by zero
    #0 0x7f48e241c1ec in mozilla::layers::AsyncPanZoomController::ScrollSnapToDestination() gfx/layers/apz/src/AsyncPanZoomController.cpp:5298:36
    #1 0x7f48e23d6e29 in mozilla::layers::AsyncPanZoomController::AttemptFling(mozilla::layers::FlingHandoffState const&) gfx/layers/apz/src/AsyncPanZoomController.cpp:3362:3
    #2 0x7f48e23d56ff in mozilla::layers::APZCTreeManager::DispatchFling(mozilla::layers::AsyncPanZoomController*, mozilla::layers::FlingHandoffState const&) gfx/layers/apz/src/APZCTreeManager.cpp:2581:34
    #3 0x7f48e240ee70 in mozilla::layers::AsyncPanZoomController::HandleEndOfPan() gfx/layers/apz/src/AsyncPanZoomController.cpp:1857:23
    #4 0x7f48e240344b in mozilla::layers::AsyncPanZoomController::OnTouchEnd(mozilla::MultiTouchInput const&) gfx/layers/apz/src/AsyncPanZoomController.cpp:1508:14
    #5 0x7f48e2401fa6 in mozilla::layers::AsyncPanZoomController::HandleInputEvent(mozilla::InputData const&, mozilla::gfx::Matrix4x4Typed<mozilla::ScreenPixel, mozilla::ParentLayerPixel, float> const&) gfx/layers/apz/src/AsyncPanZoomController.cpp:1147:16
    #6 0x7f48e253b47c in mozilla::layers::InputQueue::ProcessQueue() gfx/layers/apz/src/InputQueue.cpp:765:19
    #7 0x7f48e2538f16 in mozilla::layers::InputQueue::ReceiveTouchInput(RefPtr<mozilla::layers::AsyncPanZoomController> const&, mozilla::layers::TargetConfirmationFlags, mozilla::MultiTouchInput const&, unsigned long*, mozilla::Maybe<nsTArray<unsigned int> > const&) gfx/layers/apz/src/InputQueue.cpp:178:3
    #8 0x7f48e253842a in mozilla::layers::InputQueue::ReceiveInputEvent(RefPtr<mozilla::layers::AsyncPanZoomController> const&, mozilla::layers::TargetConfirmationFlags, mozilla::InputData const&, unsigned long*, mozilla::Maybe<nsTArray<unsigned int> > const&) gfx/layers/apz/src/InputQueue.cpp:41:14
    #9 0x7f48de035d95 in TestAsyncPanZoomController::ReceiveInputEvent(mozilla::InputData const&, unsigned long*) gfx/layers/apz/test/gtest/APZTestCommon.h:289:29
    #10 0x7f48de0af613 in TestAsyncPanZoomController::ReceiveInputEvent(mozilla::InputData const&) gfx/layers/apz/test/gtest/APZTestCommon.h:283:22
    #11 0x7f48de02d029 in nsEventStatus TouchUp<TestAsyncPanZoomController>(RefPtr<TestAsyncPanZoomController> const&, mozilla::gfx::IntPointTyped<mozilla::ScreenPixel> const&, mozilla::TimeStamp) gfx/layers/apz/test/gtest/InputUtils.h:73:19
    #12 0x7f48de048e1d in void APZCTesterBase::Pan<TestAsyncPanZoomController>(RefPtr<TestAsyncPanZoomController> const&, mozilla::gfx::IntPointTyped<mozilla::ScreenPixel> const&, mozilla::gfx::IntPointTyped<mozilla::ScreenPixel> const&, APZCTesterBase::PanOptions, nsTArray<unsigned int>*, nsEventStatus (*) [4], unsigned long*) gfx/layers/apz/test/gtest/APZTestCommon.h:636:22
    #13 0x7f48de02aa72 in void APZCTesterBase::Pan<TestAsyncPanZoomController>(RefPtr<TestAsyncPanZoomController> const&, int, int, APZCTesterBase::PanOptions, nsTArray<unsigned int>*, nsEventStatus (*) [4], unsigned long*) gfx/layers/apz/test/gtest/APZTestCommon.h:659:3
    #14 0x7f48ddfb3886 in APZCBasicTester::PanIntoOverscroll() gfx/layers/apz/test/gtest/TestBasic.cpp:283:3
    #15 0x7f48ddfb3b08 in APZCBasicTester::TestOverscroll() gfx/layers/apz/test/gtest/TestBasic.cpp:289:3
    #16 0x7f48ddfb42ec in APZCBasicTester_OverScroll_Bug1152051a_Test::TestBody() gfx/layers/apz/test/gtest/TestBasic.cpp:315:3
    #17 0x7f48ddf49d5f in testing::Test::Run() testing/gtest/gtest/src/gtest.cc:2519:5
    #18 0x7f48ddf4ad86 in testing::TestInfo::Run() testing/gtest/gtest/src/gtest.cc:2695:11
    #19 0x7f48ddf4b6da in testing::TestCase::Run() testing/gtest/gtest/src/gtest.cc:2813:28
    #20 0x7f48ddf5999b in testing::internal::UnitTestImpl::RunAllTests() testing/gtest/gtest/src/gtest.cc:5179:43
    #21 0x7f48ddf593f4 in testing::UnitTest::Run() testing/gtest/gtest/src/gtest.cc:4788:10
    #22 0x7f48ddf9a4dc in mozilla::RunGTestFunc(int*, char**) testing/gtest/mozilla/GTestRunner.cpp:158:10
    #23 0x7f48eb18aa6d in XREMain::XRE_mainStartup(bool*) toolkit/xre/nsAppRunner.cpp:3764:16
    #24 0x7f48eb193b4b in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:4722:12
    #25 0x7f48eb194743 in XRE_main(int, char**, mozilla::BootstrapConfig const&) toolkit/xre/nsAppRunner.cpp:4818:21

(In reply to Tyson Smith [:tsmith] from comment #0)

Found with m-c 20191211-b823b005f00e
[...]

    #0 0x7f48e241c1ec in mozilla::layers::AsyncPanZoomController::ScrollSnapToDestination() gfx/layers/apz/src/AsyncPanZoomController.cpp:5298:36

At the given revision, the line in question is:

    predictedDelta.y = -velocity.y / log(1.0 - friction);

log takes on the value 0 when its argument is 1, suggesting that friction is 0.

friction comes from the pref apz.fling_friction, which the failing gtest indeed sets to 0.

Since this is a pref change that a user could potentially make, too, we should check for it and handle it gracefully in the code.

Assignee: nobody → botond
Pushed by bballo@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/8b4144dc9bbd Guard against division-by-zero in AsyncPanZoomController::ScrollSnapToDestination(). r=tnikkel
Priority: -- → P3
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla73
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: