#TestOn
Firefox:107.0a1 (2022-09-19) (64-bit)
Windows NT 10.0; Win64; x64
#Reproduce
python -m ffpuppet firefox.exe -p prefs.js -d -u poc.html
Type of crash
render tab
#Analysis
Come soon
#Patch
Not yet
#asan
=================================================================
==4180==ERROR: AddressSanitizer: use-after-poison on address 0x1220fc4c3f75 at pc 0x7ffb3e605f36 bp 0x00cd0adf6760 sp 0x00cd0adf67a8
READ of size 1 at 0x1220fc4c3f75 thread T0
#0 0x7ffb3e605f35 in nsIFrame::IsRenderedLegend /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:617
#1 0x7ffb3e29d732 in nsCSSFrameConstructor::MaybeRecreateContainerForFrameRemoval /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8315
#2 0x7ffb3e29c2a5 in nsCSSFrameConstructor::ContentRemoved /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7497
#3 0x7ffb3e29bf75 in nsCSSFrameConstructor::ContentRemoved /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7476
#4 0x7ffb3e29bf75 in nsCSSFrameConstructor::ContentRemoved /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7476
#5 0x7ffb3e28a532 in nsCSSFrameConstructor::RecreateFramesForContent /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8553
#6 0x7ffb3e2007b5 in mozilla::RestyleManager::ProcessRestyledFrames /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1590
#7 0x7ffb3e20ca9b in mozilla::RestyleManager::DoProcessPendingRestyles /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3149
#8 0x7ffb3e1bad0e in mozilla::PresShell::DoFlushPendingNotifications /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4392
#9 0x7ffb3e119fc2 in nsRefreshDriver::Tick /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2565
#10 0x7ffb3e132de3 in mozilla::RefreshDriverTimer::TickRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:353
#11 0x7ffb3e1329e3 in mozilla::RefreshDriverTimer::Tick /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:369
#12 0x7ffb3e132083 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:896
#13 0x7ffb3e130a7b in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:810
#14 0x7ffb3e12f920 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:731
#15 0x7ffb3e12ef9b in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:594
#16 0x7ffb3e12ea6d in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:551
#17 0x7ffb3c865bba in mozilla::dom::VsyncMainChild::RecvNotify /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:68
#18 0x7ffb3cc8386e in mozilla::dom::PVsyncChild::OnMessageReceived /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220
#19 0x7ffb35541668 in mozilla::ipc::PBackgroundChild::OnMessageReceived /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6267
#20 0x7ffb354be1e2 in mozilla::ipc::MessageChannel::DispatchAsyncMessage /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1756
#21 0x7ffb354bb526 in mozilla::ipc::MessageChannel::DispatchMessage /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1681
#22 0x7ffb354bc624 in mozilla::ipc::MessageChannel::RunMessage /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1481
#23 0x7ffb354bce56 in mozilla::ipc::MessageChannel::MessageTask::Run /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1579
#24 0x7ffb33e7bf3d in mozilla::RunnableTask::Run /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:538
#25 0x7ffb33e2a192 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:851
#26 0x7ffb33e2659c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:683
#27 0x7ffb33e26f7e in mozilla::TaskController::ProcessPendingMTTask /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:461
#28 0x7ffb33e84d91 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:190:7'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
#29 0x7ffb33e56e35 in nsThread::ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1205
#30 0x7ffb33e662ec in NS_ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465
#31 0x7ffb354c6b81 in mozilla::ipc::MessagePump::Run /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107
#32 0x7ffb353e0b65 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374
#33 0x7ffb353e0935 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356
#34 0x7ffb3d83cb1a in nsBaseAppShell::Run /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150
#35 0x7ffb3da47c9e in nsAppShell::Run /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:614
#36 0x7ffb423dad64 in XRE_RunAppShell /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:880
#37 0x7ffb353e0b65 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374
#38 0x7ffb353e0935 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356
#39 0x7ffb423d9f28 in XRE_InitChildProcess /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:739
#40 0x7ff7cf832bbf in NS_internal_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:359
#41 0x7ff7cf8317bf in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:167
#42 0x7ff7cf926047 in __scrt_common_main_seh d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#43 0x7ffbaa2e7033 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017033)
#44 0x7ffbaa422650 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180052650)
0x1220fc4c3f75 is located 5749 bytes inside of 8192-byte region [0x1220fc4c2900,0x1220fc4c4900)
allocated by thread T0 here:
#0 0x7ffb61e2e02b in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:98
#1 0x7ffb3e38864c in mozilla::ArenaAllocator<8192,8>::Allocate /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:70
#2 0x7ffb3e3fd070 in NS_NewViewportFrame /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:33
#3 0x7ffb3e2739ef in nsCSSFrameConstructor::ConstructRootFrame /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:2578
#4 0x7ffb3e19e3c8 in mozilla::PresShell::Initialize /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:1881
#5 0x7ffb373b95c9 in nsContentSink::StartLayout /builds/worker/checkouts/gecko/dom/base/nsContentSink.cpp:564
#6 0x7ffb35d390c0 in nsHtml5TreeOpExecutor::StartLayout /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:881
#7 0x7ffb35d347cb in nsHtml5TreeOperation::Perform /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOperation.cpp:1207
#8 0x7ffb35d31fe0 in nsHtml5TreeOpExecutor::RunFlushLoop /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:685
#9 0x7ffb35d3ffc7 in nsHtml5ExecutorFlusher::Run /builds/worker/checkouts/gecko/parser/html/nsHtml5StreamParser.cpp:174
#10 0x7ffb33e112f6 in mozilla::SchedulerGroup::Runnable::Run /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:140
#11 0x7ffb33e7bf3d in mozilla::RunnableTask::Run /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:538
#12 0x7ffb33e2a192 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:851
#13 0x7ffb33e2659c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:683
#14 0x7ffb33e26f7e in mozilla::TaskController::ProcessPendingMTTask /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:461
#15 0x7ffb33e84d71 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:187:7'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
#16 0x7ffb33e56e35 in nsThread::ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1205
#17 0x7ffb33e662ec in NS_ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465
#18 0x7ffb354c6a07 in mozilla::ipc::MessagePump::Run /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85
#19 0x7ffb353e0b65 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374
#20 0x7ffb353e0935 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356
#21 0x7ffb3d83cb1a in nsBaseAppShell::Run /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150
#22 0x7ffb3da47c9e in nsAppShell::Run /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:614
#23 0x7ffb423dad64 in XRE_RunAppShell /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:880
#24 0x7ffb353e0b65 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374
#25 0x7ffb353e0935 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356
#26 0x7ffb423d9f28 in XRE_InitChildProcess /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:739
#27 0x7ff7cf832bbf in NS_internal_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:359
SUMMARY: AddressSanitizer: use-after-poison /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:617 in nsIFrame::IsRenderedLegend
Shadow bytes around the buggy address:
0x041b1bc98790: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc987a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc987b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc987c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc987d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x041b1bc987e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7
0x041b1bc987f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc98800: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc98810: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc98820: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc98830: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==4180==ABORTING
Bug 1791811 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
#TestOn
Firefox:107.0a1 (2022-09-19) (64-bit)
Windows NT 10.0; Win64; x64
#Reproduce
python -m ffpuppet firefox.exe -p prefs.js -d -u poc.html
Type of crash
render tab
#Analysis
Come soon
#Patch
Not yet
#asan
```
=================================================================
==4180==ERROR: AddressSanitizer: use-after-poison on address 0x1220fc4c3f75 at pc 0x7ffb3e605f36 bp 0x00cd0adf6760 sp 0x00cd0adf67a8
READ of size 1 at 0x1220fc4c3f75 thread T0
#0 0x7ffb3e605f35 in nsIFrame::IsRenderedLegend /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:617
#1 0x7ffb3e29d732 in nsCSSFrameConstructor::MaybeRecreateContainerForFrameRemoval /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8315
#2 0x7ffb3e29c2a5 in nsCSSFrameConstructor::ContentRemoved /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7497
#3 0x7ffb3e29bf75 in nsCSSFrameConstructor::ContentRemoved /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7476
#4 0x7ffb3e29bf75 in nsCSSFrameConstructor::ContentRemoved /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7476
#5 0x7ffb3e28a532 in nsCSSFrameConstructor::RecreateFramesForContent /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8553
#6 0x7ffb3e2007b5 in mozilla::RestyleManager::ProcessRestyledFrames /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1590
#7 0x7ffb3e20ca9b in mozilla::RestyleManager::DoProcessPendingRestyles /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3149
#8 0x7ffb3e1bad0e in mozilla::PresShell::DoFlushPendingNotifications /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4392
#9 0x7ffb3e119fc2 in nsRefreshDriver::Tick /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2565
#10 0x7ffb3e132de3 in mozilla::RefreshDriverTimer::TickRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:353
#11 0x7ffb3e1329e3 in mozilla::RefreshDriverTimer::Tick /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:369
#12 0x7ffb3e132083 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:896
#13 0x7ffb3e130a7b in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:810
#14 0x7ffb3e12f920 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:731
#15 0x7ffb3e12ef9b in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:594
#16 0x7ffb3e12ea6d in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:551
#17 0x7ffb3c865bba in mozilla::dom::VsyncMainChild::RecvNotify /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:68
#18 0x7ffb3cc8386e in mozilla::dom::PVsyncChild::OnMessageReceived /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220
#19 0x7ffb35541668 in mozilla::ipc::PBackgroundChild::OnMessageReceived /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6267
#20 0x7ffb354be1e2 in mozilla::ipc::MessageChannel::DispatchAsyncMessage /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1756
#21 0x7ffb354bb526 in mozilla::ipc::MessageChannel::DispatchMessage /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1681
#22 0x7ffb354bc624 in mozilla::ipc::MessageChannel::RunMessage /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1481
#23 0x7ffb354bce56 in mozilla::ipc::MessageChannel::MessageTask::Run /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1579
#24 0x7ffb33e7bf3d in mozilla::RunnableTask::Run /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:538
#25 0x7ffb33e2a192 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:851
#26 0x7ffb33e2659c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:683
#27 0x7ffb33e26f7e in mozilla::TaskController::ProcessPendingMTTask /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:461
#28 0x7ffb33e84d91 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:190:7'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
#29 0x7ffb33e56e35 in nsThread::ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1205
#30 0x7ffb33e662ec in NS_ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465
#31 0x7ffb354c6b81 in mozilla::ipc::MessagePump::Run /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107
#32 0x7ffb353e0b65 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374
#33 0x7ffb353e0935 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356
#34 0x7ffb3d83cb1a in nsBaseAppShell::Run /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150
#35 0x7ffb3da47c9e in nsAppShell::Run /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:614
#36 0x7ffb423dad64 in XRE_RunAppShell /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:880
#37 0x7ffb353e0b65 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374
#38 0x7ffb353e0935 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356
#39 0x7ffb423d9f28 in XRE_InitChildProcess /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:739
#40 0x7ff7cf832bbf in NS_internal_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:359
#41 0x7ff7cf8317bf in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:167
#42 0x7ff7cf926047 in __scrt_common_main_seh d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#43 0x7ffbaa2e7033 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017033)
#44 0x7ffbaa422650 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180052650)
0x1220fc4c3f75 is located 5749 bytes inside of 8192-byte region [0x1220fc4c2900,0x1220fc4c4900)
allocated by thread T0 here:
#0 0x7ffb61e2e02b in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:98
#1 0x7ffb3e38864c in mozilla::ArenaAllocator<8192,8>::Allocate /builds/worker/workspace/obj-build/dist/include/mozilla/ArenaAllocator.h:70
#2 0x7ffb3e3fd070 in NS_NewViewportFrame /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:33
#3 0x7ffb3e2739ef in nsCSSFrameConstructor::ConstructRootFrame /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:2578
#4 0x7ffb3e19e3c8 in mozilla::PresShell::Initialize /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:1881
#5 0x7ffb373b95c9 in nsContentSink::StartLayout /builds/worker/checkouts/gecko/dom/base/nsContentSink.cpp:564
#6 0x7ffb35d390c0 in nsHtml5TreeOpExecutor::StartLayout /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:881
#7 0x7ffb35d347cb in nsHtml5TreeOperation::Perform /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOperation.cpp:1207
#8 0x7ffb35d31fe0 in nsHtml5TreeOpExecutor::RunFlushLoop /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:685
#9 0x7ffb35d3ffc7 in nsHtml5ExecutorFlusher::Run /builds/worker/checkouts/gecko/parser/html/nsHtml5StreamParser.cpp:174
#10 0x7ffb33e112f6 in mozilla::SchedulerGroup::Runnable::Run /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:140
#11 0x7ffb33e7bf3d in mozilla::RunnableTask::Run /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:538
#12 0x7ffb33e2a192 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:851
#13 0x7ffb33e2659c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:683
#14 0x7ffb33e26f7e in mozilla::TaskController::ProcessPendingMTTask /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:461
#15 0x7ffb33e84d71 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:187:7'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
#16 0x7ffb33e56e35 in nsThread::ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1205
#17 0x7ffb33e662ec in NS_ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465
#18 0x7ffb354c6a07 in mozilla::ipc::MessagePump::Run /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85
#19 0x7ffb353e0b65 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374
#20 0x7ffb353e0935 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356
#21 0x7ffb3d83cb1a in nsBaseAppShell::Run /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150
#22 0x7ffb3da47c9e in nsAppShell::Run /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:614
#23 0x7ffb423dad64 in XRE_RunAppShell /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:880
#24 0x7ffb353e0b65 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374
#25 0x7ffb353e0935 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356
#26 0x7ffb423d9f28 in XRE_InitChildProcess /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:739
#27 0x7ff7cf832bbf in NS_internal_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:359
SUMMARY: AddressSanitizer: use-after-poison /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:617 in nsIFrame::IsRenderedLegend
Shadow bytes around the buggy address:
0x041b1bc98790: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc987a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc987b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc987c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc987d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x041b1bc987e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7
0x041b1bc987f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc98800: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc98810: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc98820: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x041b1bc98830: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==4180==ABORTING
```
For bugmon: (--enable-address-sanitizer --enable-fuzzing)