Bug 1855626 Comment 0 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by

djinn

on 2023-09-27 23:43:56 PDT

(Hidden by Administrator)

Revision 1 by

Tyson Smith [:tsmith]

on 2024-12-13 19:06:23 PST

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36

Steps to reproduce:

open the html testcase attached below with firefox 119.0a1 debug and asan build version.
I will upload the minimized testcase as soon as possible.


Actual results:

browser crashed.
carsh log:
Assertion failure: aISize >= 0 (unexpected negative hangable advance), at /home/wuyue/browser/mozilla-unified/layout/generic/nsTextFrame.cpp:8320
```
#01: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x167b2eaf]
#02: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16723b7f]
#03: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671da6c]
#04: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667f5dc]
#05: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667e5cf]
#06: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667d678]
#07: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#08: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667f5dc]
#09: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667e5cf]
#10: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667d678]
#11: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#12: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667f5dc]
#13: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667e5cf]
#14: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667d678]
#15: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#16: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667f5dc]
#17: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667e5cf]
#18: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667d678]
#19: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#20: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667f5dc]
#21: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667e5cf]
#22: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667d678]
#23: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#24: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667f5dc]
#25: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667e5cf]
#26: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667d678]
#27: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#28: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667f5dc]
#29: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667e5cf]
#30: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1667d678]
#31: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#32: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16481f77]
#33: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16480239]
#34: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16476e60]
#35: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1646cbc0]
#36: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645fef2]
#37: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164559dc]
#38: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#39: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16481f77]
#40: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16480239]
#41: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16476e60]
#42: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1646cbc0]
#43: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645fef2]
#44: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164559dc]
#45: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#46: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16481f77]
#47: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16480239]
#48: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16476e60]
#49: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1646cbc0]
#50: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645fef2]
#51: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164559dc]
#52: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#53: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16481f77]
#54: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16480239]
#55: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16476e60]
#56: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1646cbc0]
#57: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645fef2]
#58: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164559dc]
#59: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164a5417]
#60: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1655be8e]
#61: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1655d421]
#62: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16566068]
#63: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1647c58b]
#64: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164728c1]
#65: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1646cf6f]
#66: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645fef2]
#67: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164559dc]
#68: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164a5417]
#69: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1655be8e]
#70: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1655d421]
#71: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16566068]
#72: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#73: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16481f77]
#74: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16480239]
#75: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16476e60]
#76: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1646cbc0]
#77: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645fef2]
#78: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164559dc]
#79: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1671dc4c]
#80: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16481f77]
#81: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16480239]
#82: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16476e60]
#83: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1646cbc0]
#84: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645fef2]
#85: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164559dc]
#86: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1647c58b]
#87: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164728c1]
#88: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1646cf6f]
#89: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645fef2]
#90: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164559dc]
#91: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1647c58b]
#92: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164728c1]
#93: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1646cf6f]
#94: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1645fef2]
#95: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164559dc]
#96: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164a5417]
#97: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164a3565]
#98: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x164a5417]
#99: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1655be8e]
#100: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1655d421]
#101: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16566068]
#102: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1643ee48]
#103: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1643dff0]
#104: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x161e2812]
#105: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1622858d]
#106: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x161f734d]
#107: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16178065]
#108: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1618c86a]
#109: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1618c5e4]
#110: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1618c24e]
#111: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1618ada5]
#112: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16189963]
#113: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x16188d5d]
#114: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x161888a4]
#115: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x14952993]
#116: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x14df2738]
#117: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd556e11]
#118: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c36e5]
#119: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c1519]
#120: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c1e83]
#121: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c2a02]
#122: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcf144d]
#123: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcd8bb0]
#124: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcd63db]
#125: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcd6a2c]
#126: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbcdd03a]
#127: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbd2261f]
#128: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xbd2cfab]
#129: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c9075]
#130: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd33bbf9]
#131: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd33b97b]
#132: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x15a13c13]
#133: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1a307ca6]
#134: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd4c9e9e]
#135: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd33bbf9]
#136: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0xd33b97b]
#137: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/libxul.so +0x1a3070ba]
#138: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/firefox +0x1b35e2]
#139: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/firefox +0x1b4014]
#140: __libc_start_main[/lib/x86_64-linux-gnu/libc.so.6 +0x24083]
#141: ???[/home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/firefox +0xdd9b9]
#142: ??? (???:???)
[Parent 260238, IPDL Background] WARNING: [1.1]: Ignoring message 'PVsync::Msg_Notify' to unknown peer 2BB6CA02F24400EB.40F0CD01061142B3: file /home/wuyue/browser/mozilla-unified/ipc/glue/NodeController.cpp:344
[Parent 260238, IPC I/O Parent] WARNING: [1.1]: Ignoring message 'EVENT_MESSAGE' to unknown peer 2BB6CA02F24400EB.40F0CD01061142B3: file /home/wuyue/browser/mozilla-unified/ipc/glue/NodeController.cpp:344
[Parent 260238, IPC I/O Parent] WARNING: [1.1]: Ignoring message 'EVENT_MESSAGE' to unknown peer 2BB6CA02F24400EB.40F0CD01061142B3: file /home/wuyue/browser/mozilla-unified/ipc/glue/NodeController.cpp:344
[Parent 260238, IPC I/O Parent] WARNING: [1.1]: Ignoring message 'EVENT_MESSAGE' to unknown peer 2BB6CA02F24400EB.40F0CD01061142B3: file /home/wuyue/browser/mozilla-unified/ipc/glue/NodeController.cpp:344

Program /home/wuyue/browser/mozilla-unified/objdir-ff-asan/dist/bin/firefox (pid = 260331) received signal 11.
```

Expected results:

not crash