1267132 - AddressSanitizer: global-buffer-overflow [@ nsGridContainerFrame::TrackSize::Initialize] with READ of size 1

Status: RESOLVED DUPLICATE of bug 1248227

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes)

Debug: same assertion as in bug 1248227

Assertion failure: !mHasRepeatAuto || (mMinSizingFunctions.Length() >= 1 && mRepeatAutoStart < mMinSizingFunctions.Length()), at /builds/slave/m-cen-m64-d-000000000000000000/build/src/layout/generic/nsGridContainerFrame.cpp:825

ASan: memory safety error near some globals related to hash tables

AddressSanitizer: global-buffer-overflow [@ nsGridContainerFrame::TrackSize::Initialize] with READ of size 1

Comment 1

[Jesse Ruderman]

Attachment: ASan output

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Mats, could you have a look at this one?

Comment 3

[Mats Palmgren (inactive)]

It's a dupe of bug 1248227.  I think you can safely assume that any combination of
'subgrid' and 'auto-fill/fit' is bug 1248227 if you see the above assertion in
a debug build.

Comment 4

[Daniel Holbert [:dholbert]]

I think this bug was focused on the ASAN memory-safety issue, though -- are you confident that that part is also the same underlying cause as bug 1248227?

Comment 5

[Mats Palmgren (inactive)]

Yeah, it's the same underlying issue.  The reason the test in bug 1248227 doesn't
crash with ASAN is that it doesn't have an item, so we don't reach the code that
does the array access.  Just adding an item to that test leads to the same crash.
It's the same root cause, which is what the assertion is about.