Assertion failure: localTransform.IsIdentity(), at src/gfx/layers/composite/AsyncCompositionManager.cpp:505

eip = 0xc306ac58   esp = 0xb24fe900   ebp = 0xb24feab8   ebx = 0xc9bdede0
esi = 0x000001f9   edi = 0xa9780c00   eax = 0xc7277820   ecx = 0xcacb317c
edx = 0x00000098   efl = 0x00210286
OS|Android|0.0.0 Linux 4.4.124+ #1 SMP PREEMPT Sun Nov 4 14:31:25 UTC 2018 i686
CPU|x86|GenuineIntel family 6 model 6 stepping 3|4
GPU|||
Crash|SIGSEGV|0x0|37
37|0|libxul.so|mozilla::layers::AsyncCompositionManager::AdjustFixedOrStickyLayer(mozilla::layers::Layer*, mozilla::layers::Layer*, unsigned long long, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::MarginTyped<mozilla::ScreenPixel, float> const&, std::__ndk1::map<mozilla::layers::Layer*, mozilla::layers::AsyncCompositionManager::ClipParts, std::__ndk1::less<mozilla::layers::Layer*>, std::__ndk1::allocator<std::__ndk1::pair<mozilla::layers::Layer* const, mozilla::layers::AsyncCompositionManager::ClipParts> > >&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|0|0x8
37|1|libxul.so|mozilla::layers::AsyncCompositionManager::AlignFixedAndStickyLayers(mozilla::layers::Layer*, mozilla::layers::Layer*, unsigned long long, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::MarginTyped<mozilla::ScreenPixel, float> const&, std::__ndk1::map<mozilla::layers::Layer*, mozilla::layers::AsyncCompositionManager::ClipParts, std::__ndk1::less<mozilla::layers::Layer*>, std::__ndk1::allocator<std::__ndk1::pair<mozilla::layers::Layer* const, mozilla::layers::AsyncCompositionManager::ClipParts> > >&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|451|0x21
37|2|libxul.so|mozilla::layers::AsyncCompositionManager::AlignFixedAndStickyLayers(mozilla::layers::Layer*, mozilla::layers::Layer*, unsigned long long, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::MarginTyped<mozilla::ScreenPixel, float> const&, std::__ndk1::map<mozilla::layers::Layer*, mozilla::layers::AsyncCompositionManager::ClipParts, std::__ndk1::less<mozilla::layers::Layer*>, std::__ndk1::allocator<std::__ndk1::pair<mozilla::layers::Layer* const, mozilla::layers::AsyncCompositionManager::ClipParts> > >&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|443|0x1f
37|3|libxul.so|mozilla::layers::AsyncCompositionManager::AlignFixedAndStickyLayers(mozilla::layers::Layer*, mozilla::layers::Layer*, unsigned long long, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::MarginTyped<mozilla::ScreenPixel, float> const&, std::__ndk1::map<mozilla::layers::Layer*, mozilla::layers::AsyncCompositionManager::ClipParts, std::__ndk1::less<mozilla::layers::Layer*>, std::__ndk1::allocator<std::__ndk1::pair<mozilla::layers::Layer* const, mozilla::layers::AsyncCompositionManager::ClipParts> > >&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|443|0x1f
37|4|libxul.so|mozilla::layers::AsyncCompositionManager::AlignFixedAndStickyLayers(mozilla::layers::Layer*, mozilla::layers::Layer*, unsigned long long, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::Matrix4x4Typed<mozilla::LayerPixel, mozilla::ParentLayerPixel, float> const&, mozilla::gfx::MarginTyped<mozilla::ScreenPixel, float> const&, std::__ndk1::map<mozilla::layers::Layer*, mozilla::layers::AsyncCompositionManager::ClipParts, std::__ndk1::less<mozilla::layers::Layer*>, std::__ndk1::allocator<std::__ndk1::pair<mozilla::layers::Layer* const, mozilla::layers::AsyncCompositionManager::ClipParts> > >&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|443|0x1f
37|5|libxul.so|mozilla::layers::AsyncCompositionManager::ApplyAsyncContentTransformToTree(mozilla::layers::Layer*, bool*)::$_4::operator()(mozilla::layers::Layer*) const|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|1157|0x3a
37|6|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer *, (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:916:7), (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:952:7)>|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|145|0xb
37|7|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer *, (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:916:7), (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:952:7)>|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|142|0xf
37|8|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer *, (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:916:7), (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:952:7)>|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|142|0xf
37|9|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer *, (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:916:7), (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:952:7)>|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|142|0xf
37|10|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer *, (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:916:7), (lambda at /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:952:7)>|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|142|0xf
37|11|libxul.so|mozilla::layers::AsyncCompositionManager::ApplyAsyncContentTransformToTree(mozilla::layers::Layer*, bool*)|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|914|0x8
37|12|libxul.so|mozilla::layers::AsyncCompositionManager::TransformShadowTree(mozilla::TimeStamp, mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>, mozilla::layers::CompositorBridgeParentBase::TransformsToSkip)|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|1454|0x16
37|13|libxul.so|mozilla::layers::CompositorBridgeParent::CompositeToTarget(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::gfx::DrawTarget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorBridgeParent.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|985|0x52
37|14|libxul.so|non-virtual thunk to mozilla::layers::CompositorBridgeParent::CompositeToTarget(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::gfx::DrawTarget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorBridgeParent.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|0|0x3c
37|15|libxul.so|mozilla::layers::CompositorVsyncScheduler::Composite(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorVsyncScheduler.cpp:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|238|0x26
37|16|libxul.so|decltype (((*{parm#1}).*{parm#2})((((Get<0u>)({parm#3})).PassAsParameter)(), (((Get<1u>)({parm#3})).PassAsParameter)())) mozilla::detail::RunnableMethodArguments<mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp>::applyImpl<mozilla::layers::CompositorVsyncScheduler, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp), StoreCopyPassByConstLRef<mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> >, StoreCopyPassByConstLRef<mozilla::TimeStamp>, 0u, 1u>(mozilla::layers::CompositorVsyncScheduler*, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp), mozilla::Tuple<StoreCopyPassByConstLRef<mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> >, StoreCopyPassByConstLRef<mozilla::TimeStamp> >&, std::__ndk1::integer_sequence<unsigned int, 0u, 1u>)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|1122|0x3c
37|17|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp), true, (mozilla::RunnableKind)1, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|1174|0x26
37|18|libxul.so|MessageLoop::RunTask(already_AddRefed<nsIRunnable>)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|442|0x10
37|19|libxul.so|MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|450|0x21
37|20|libxul.so|MessageLoop::DoWork()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|523|0xf
37|21|libxul.so|base::MessagePumpDefault::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_pump_default.cc:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|35|0x8
37|22|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|315|0x16
37|23|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|290|0xb
37|24|libxul.so|base::Thread::ThreadMain()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/thread.cc:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|192|0x8
37|25|libxul.so|ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/platform_thread_posix.cc:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|40|0x8
37|26|libc.so||||0x9cce6
37|27|libc.so||||0x33c1c
37|28|libc.so||||0x1fa27
37|29|libc.so||||0x9ccb0
37|30|libxul.so|std::__ndk1::__vector_base<MessageLoop::PendingTask, std::__ndk1::allocator<MessageLoop::PendingTask> >::__destruct_at_end(MessageLoop::PendingTask*)|hg:hg.mozilla.org/mozilla-central:android-ndk/sources/cxx-stl/llvm-libc++/include/vector:c68ff92fe54c75338c3a937bc6c4e615d9b1d45a|415|0x8
37|31|||||0xb2937c80

The priority flag is not set for this bug.
:jbonisteel, could you have a look please?

For more information, please visit auto_nag documentation.

This issue is hit frequently by the fuzzers and can limiting their effectiveness.

Reproduces on both Android and desktop

Pernosco session is available here: https://pernos.co/debug/OoNEP4G0Pp8H94aWQrtw-Q/index.html (updated link)

This bug prevents fuzzing from making progress; however, it has low severity. It is important for fuzz blocker bugs to be addressed in a timely manner (see here why?).
:bhood, could you increase the severity?

For more information, please visit auto_nag documentation.

This code has been removed (bug 1727672). Should the bug be closed?

Great, yes let's close it.