Testcase found while fuzzing mozilla-central rev f4ad9b76e5f8 (built with: --enable-debug --enable-fuzzing).
Testcase can be reproduced using the following commands:
```
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build f4ad9b76e5f8 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip
```
```
Assertion failure: IsAncestor(aOne, aTwo) || IsAncestor(aTwo, aOne), at /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:275
==784958==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7feee64f375f bp 0x7ffe5b82ac60 sp 0x7ffe5b82abb0 T784958)
==784958==The signal is caused by a WRITE memory access.
==784958==Hint: address points to the zero page.
#0 0x7feee64f375f in PickDescendant /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:275:5
#1 0x7feee64f375f in mozilla::layers::ClipManager::SwitchItem(mozilla::nsDisplayItem*) /gfx/layers/wr/ClipManager.cpp:215:19
#2 0x7feee65323ae in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1782:43
#3 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#4 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#5 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#6 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#7 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#8 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#9 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#10 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#11 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#12 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#13 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#14 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#15 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#16 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#17 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#18 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#19 0x7feee9d5ff97 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#20 0x7feee9d5ff97 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:5714:22
#21 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#22 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#23 0x7feee653138d in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1601:5
#24 0x7feee6544326 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) /gfx/layers/wr/WebRenderLayerManager.cpp:371:30
#25 0x7feee9d4d4b5 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /layout/painting/nsDisplayList.cpp:2414:18
#26 0x7feee99b6d32 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /layout/base/nsLayoutUtils.cpp:3493:45
#27 0x7feee992a175 in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) /layout/base/PresShell.cpp:6360:5
#28 0x7feee959a92e in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /view/nsViewManager.cpp:467:18
#29 0x7feee959a44b in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /view/nsViewManager.cpp:402:22
#30 0x7feee959ba2f in nsViewManager::ProcessPendingUpdates() /view/nsViewManager.cpp:980:5
#31 0x7feee98e73ca in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2505:11
#32 0x7feee98ee69a in TickDriver /layout/base/nsRefreshDriver.cpp:348:13
#33 0x7feee98ee69a in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:326:7
#34 0x7feee98ee5b3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:342:5
#35 0x7feee98ee480 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:771:5
#36 0x7feee98edb1a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:700:16
#37 0x7feee98ed435 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /layout/base/nsRefreshDriver.cpp:617:7
#38 0x7feee98eceb9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:538:9
#39 0x7feee90b3f26 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncChild.cpp:68:15
#40 0x7feee5cd47e4 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
#41 0x7feee5aa902c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6091:32
#42 0x7feee573730f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:2053:25
#43 0x7feee5733e21 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /ipc/glue/MessageChannel.cpp:1978:9
#44 0x7feee57352a5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1826:3
#45 0x7feee5735e3b in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1857:13
#46 0x7feee4cf983e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:502:16
#47 0x7feee4cd4b0f in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:805:26
#48 0x7feee4cd3778 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:641:15
#49 0x7feee4cd39f3 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:425:36
#50 0x7feee4cfcea9 in operator() /xpcom/threads/TaskController.cpp:138:37
#51 0x7feee4cfcea9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#52 0x7feee4ce82ef in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1148:16
#53 0x7feee4cef03a in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:466:10
#54 0x7feee573d124 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
#55 0x7feee565d867 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#56 0x7feee565d772 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#57 0x7feee565d772 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#58 0x7feee95ec6c8 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
#59 0x7feeeb46cf33 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:917:20
#60 0x7feee573e06a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
#61 0x7feee565d867 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#62 0x7feee565d772 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#63 0x7feee565d772 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#64 0x7feeeb46c56e in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:749:34
#65 0x55c80051dab6 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#66 0x55c80051dab6 in main /browser/app/nsBrowserApp.cpp:327:18
#67 0x7feefa4b30b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#68 0x55c8004fa8bc in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x158bc)
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:275:5 in PickDescendant
==784958==ABORTING
```
Bug 1427792 Comment 16 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Testcase found while fuzzing mozilla-central rev f4ad9b76e5f8 (built with: --enable-debug --enable-fuzzing).
Testcase can be reproduced using the following commands:
```
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build f4ad9b76e5f8 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip
```
```
Assertion failure: IsAncestor(aOne, aTwo) || IsAncestor(aTwo, aOne), at /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:275
==784958==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7feee64f375f bp 0x7ffe5b82ac60 sp 0x7ffe5b82abb0 T784958)
==784958==The signal is caused by a WRITE memory access.
==784958==Hint: address points to the zero page.
#0 0x7feee64f375f in PickDescendant /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:275:5
#1 0x7feee64f375f in mozilla::layers::ClipManager::SwitchItem(mozilla::nsDisplayItem*) /gfx/layers/wr/ClipManager.cpp:215:19
#2 0x7feee65323ae in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1782:43
#3 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#4 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#5 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#6 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#7 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#8 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#9 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#10 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#11 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#12 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#13 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#14 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#15 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#16 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#17 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#18 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#19 0x7feee9d5ff97 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#20 0x7feee9d5ff97 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:5714:22
#21 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#22 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#23 0x7feee653138d in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1601:5
#24 0x7feee6544326 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) /gfx/layers/wr/WebRenderLayerManager.cpp:371:30
#25 0x7feee9d4d4b5 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /layout/painting/nsDisplayList.cpp:2414:18
#26 0x7feee99b6d32 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /layout/base/nsLayoutUtils.cpp:3493:45
#27 0x7feee992a175 in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) /layout/base/PresShell.cpp:6360:5
#28 0x7feee959a92e in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /view/nsViewManager.cpp:467:18
#29 0x7feee959a44b in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /view/nsViewManager.cpp:402:22
#30 0x7feee959ba2f in nsViewManager::ProcessPendingUpdates() /view/nsViewManager.cpp:980:5
#31 0x7feee98e73ca in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2505:11
#32 0x7feee98ee69a in TickDriver /layout/base/nsRefreshDriver.cpp:348:13
#33 0x7feee98ee69a in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:326:7
#34 0x7feee98ee5b3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:342:5
#35 0x7feee98ee480 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:771:5
#36 0x7feee98edb1a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:700:16
#37 0x7feee98ed435 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /layout/base/nsRefreshDriver.cpp:617:7
#38 0x7feee98eceb9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:538:9
#39 0x7feee90b3f26 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncChild.cpp:68:15
#40 0x7feee5cd47e4 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
#41 0x7feee5aa902c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6091:32
#42 0x7feee573730f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:2053:25
#43 0x7feee5733e21 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /ipc/glue/MessageChannel.cpp:1978:9
#44 0x7feee57352a5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1826:3
#45 0x7feee5735e3b in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1857:13
#46 0x7feee4cf983e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:502:16
#47 0x7feee4cd4b0f in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:805:26
#48 0x7feee4cd3778 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:641:15
#49 0x7feee4cd39f3 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:425:36
#50 0x7feee4cfcea9 in operator() /xpcom/threads/TaskController.cpp:138:37
#51 0x7feee4cfcea9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#52 0x7feee4ce82ef in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1148:16
#53 0x7feee4cef03a in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:466:10
#54 0x7feee573d124 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
#55 0x7feee565d867 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#56 0x7feee565d772 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#57 0x7feee565d772 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#58 0x7feee95ec6c8 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
#59 0x7feeeb46cf33 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:917:20
#60 0x7feee573e06a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
#61 0x7feee565d867 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#62 0x7feee565d772 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#63 0x7feee565d772 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#64 0x7feeeb46c56e in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:749:34
#65 0x55c80051dab6 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#66 0x55c80051dab6 in main /browser/app/nsBrowserApp.cpp:327:18
#67 0x7feefa4b30b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#68 0x55c8004fa8bc in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x158bc)
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:275:5 in PickDescendant
==784958==ABORTING
Testcase found while fuzzing mozilla-central rev f4ad9b76e5f8 (built with: --enable-debug --enable-fuzzing).
Testcase can be reproduced using the following commands:
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build f4ad9b76e5f8 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip
```
Assertion failure: IsAncestor(aOne, aTwo) || IsAncestor(aTwo, aOne), at /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:275
==784958==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7feee64f375f bp 0x7ffe5b82ac60 sp 0x7ffe5b82abb0 T784958)
==784958==The signal is caused by a WRITE memory access.
==784958==Hint: address points to the zero page.
#0 0x7feee64f375f in PickDescendant /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:275:5
#1 0x7feee64f375f in mozilla::layers::ClipManager::SwitchItem(mozilla::nsDisplayItem*) /gfx/layers/wr/ClipManager.cpp:215:19
#2 0x7feee65323ae in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1782:43
#3 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#4 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#5 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#6 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#7 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#8 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#9 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#10 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#11 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#12 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#13 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#14 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#15 0x7feee9d708e9 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#16 0x7feee9d708e9 in mozilla::nsDisplayMasksAndClipPaths::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8697:25
#17 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#18 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#19 0x7feee9d5ff97 in CreateWebRenderCommands /layout/painting/nsDisplayList.cpp:5061:30
#20 0x7feee9d5ff97 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:5714:22
#21 0x7feee6533f82 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1681:41
#22 0x7feee653264d in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1803:7
#23 0x7feee653138d in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1601:5
#24 0x7feee6544326 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) /gfx/layers/wr/WebRenderLayerManager.cpp:371:30
#25 0x7feee9d4d4b5 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /layout/painting/nsDisplayList.cpp:2414:18
#26 0x7feee99b6d32 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /layout/base/nsLayoutUtils.cpp:3493:45
#27 0x7feee992a175 in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) /layout/base/PresShell.cpp:6360:5
#28 0x7feee959a92e in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /view/nsViewManager.cpp:467:18
#29 0x7feee959a44b in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /view/nsViewManager.cpp:402:22
#30 0x7feee959ba2f in nsViewManager::ProcessPendingUpdates() /view/nsViewManager.cpp:980:5
#31 0x7feee98e73ca in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2505:11
#32 0x7feee98ee69a in TickDriver /layout/base/nsRefreshDriver.cpp:348:13
#33 0x7feee98ee69a in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:326:7
#34 0x7feee98ee5b3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:342:5
#35 0x7feee98ee480 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:771:5
#36 0x7feee98edb1a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:700:16
#37 0x7feee98ed435 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /layout/base/nsRefreshDriver.cpp:617:7
#38 0x7feee98eceb9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:538:9
#39 0x7feee90b3f26 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncChild.cpp:68:15
#40 0x7feee5cd47e4 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
#41 0x7feee5aa902c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6091:32
#42 0x7feee573730f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:2053:25
#43 0x7feee5733e21 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /ipc/glue/MessageChannel.cpp:1978:9
#44 0x7feee57352a5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1826:3
#45 0x7feee5735e3b in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1857:13
#46 0x7feee4cf983e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:502:16
#47 0x7feee4cd4b0f in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:805:26
#48 0x7feee4cd3778 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:641:15
#49 0x7feee4cd39f3 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:425:36
#50 0x7feee4cfcea9 in operator() /xpcom/threads/TaskController.cpp:138:37
#51 0x7feee4cfcea9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#52 0x7feee4ce82ef in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1148:16
#53 0x7feee4cef03a in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:466:10
#54 0x7feee573d124 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
#55 0x7feee565d867 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#56 0x7feee565d772 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#57 0x7feee565d772 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#58 0x7feee95ec6c8 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
#59 0x7feeeb46cf33 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:917:20
#60 0x7feee573e06a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
#61 0x7feee565d867 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#62 0x7feee565d772 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#63 0x7feee565d772 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#64 0x7feeeb46c56e in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:749:34
#65 0x55c80051dab6 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#66 0x55c80051dab6 in main /browser/app/nsBrowserApp.cpp:327:18
#67 0x7feefa4b30b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#68 0x55c8004fa8bc in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x158bc)
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/nsDisplayList.h:275:5 in PickDescendant
==784958==ABORTING
```
Testcase found while fuzzing mozilla-central rev f4ad9b76e5f8 (built with: --enable-debug --enable-fuzzing). Testcase can be reproduced using the following commands: $ pip install fuzzfetch grizzly-framework $ python -m fuzzfetch --build f4ad9b76e5f8 --debug --fuzzing -n firefox $ python -m grizzly.replay ./firefox/firefox testcase.zip
Testcase found while fuzzing mozilla-central rev f4ad9b76e5f8 (built with: --enable-debug --enable-fuzzing). Testcase can be reproduced using the following commands: ``` $ pip install fuzzfetch grizzly-framework $ python -m fuzzfetch --build f4ad9b76e5f8 --debug --fuzzing -n firefox $ python -m grizzly.replay ./firefox/firefox testcase.zip ```
Testcase found while fuzzing mozilla-central rev f4ad9b76e5f8 (built with: --enable-debug --enable-fuzzing). Testcase can be reproduced using the following commands: $ pip install fuzzfetch grizzly-framework $ python -m fuzzfetch --build f4ad9b76e5f8 --debug --fuzzing -n firefox $ python -m grizzly.replay ./firefox/firefox testcase.zip