1316884 - [css-grid] AddressSanitizer: use-after-poison [@ StylePosition] with READ of size 8

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Jesse Schwartzentruber (:truber)]

Attachment: testcase.html

The attached testcase crashes mozilla-central d38d06f85ef5.
It looks like a poisoned frame based on the non-asan fault address (0x7ffffffff0dea7ff).

==24619==ERROR: AddressSanitizer: use-after-poison on address 0x625000ce2b90 at pc 0x7f2507fe59a2 bp 0x7fff5c033c20 sp 0x7fff5c033c18
READ of size 8 at 0x625000ce2b90 thread T0
    #0 0x7f2507fe59a1 in StylePosition obj-firefox/dist/include/nsStyleStructList.h:87:1
    #1 0x7f2507fe59a1 in MinSize(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, nsRenderingContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) layout/generic/nsGridContainerFrame.cpp:3883
    #2 0x7f2507fde3b4 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, SizingConstraint) layout/generic/nsGridContainerFrame.cpp:4427:21
    #3 0x7f2507fced31 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, SizingConstraint) layout/generic/nsGridContainerFrame.cpp:3938:3
    #4 0x7f2507fcdee6 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizes(nsGridContainerFrame::Grid const&, mozilla::LogicalSize&, SizingConstraint) layout/generic/nsGridContainerFrame.cpp:2583:3
    #5 0x7f2507ff7f0d in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, unsigned int&) layout/generic/nsGridContainerFrame.cpp:6119:5

The debug log also includes soft assertions prior to segv:
###!!! ASSERTION: got BREAK_BEFORE again after growing the row?: 'Error', file /home/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp, line 5676

Comment 1

[Jesse Schwartzentruber (:truber)]

Attachment: log.txt

Comment 2

[Jesse Schwartzentruber (:truber)]

Attachment: log-dbg.txt

Comment 3

[Julien Cristau [:jcristau]]

Too late for firefox 52, mass-wontfix.

Comment 4

[Jesse Schwartzentruber (:truber)]

This still reproduces in m-c 20170901-a3585c77e2b1

==29725==ERROR: AddressSanitizer: use-after-poison on address 0x6250016889e0 at pc 0x7f632efad045 bp 0x7ffc09ce63b0 sp 0x7ffc09ce63a8
READ of size 8 at 0x6250016889e0 thread T0
    #0 0x7f632efad044 in get /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:287:27
    #1 0x7f632efad044 in operator-> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:319
    #2 0x7f632efad044 in StylePosition /builds/worker/workspace/build/src/obj-firefox/dist/include/nsStyleStructList.h:89
    #3 0x7f632efad044 in nsGridContainerFrame::GridItemInfo::ShouldApplyAutoMinSize(mozilla::WritingMode, mozilla::LogicalAxis, int) const /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:618
    #4 0x7f632efa36cf in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, SizingConstraint) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:4189:18
    #5 0x7f632ef95c85 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, SizingConstraint) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:3730:3
    #6 0x7f632ef95646 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizes(nsGridContainerFrame::Grid const&, mozilla::LogicalSize&, SizingConstraint) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:2348:9
    #7 0x7f632efbb89f in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:5971:21

Comment 5

[Ryan VanderMeulen [:RyanVM]]

INFO: Last good revision: 946ed22cad04431c75ab5093989dfedf1bae5a3e (2016-03-12)
INFO: First bad revision: d1d47ba19ce9d46222030d491f9fe28dbf80be12 (2016-03-13)
INFO: Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=946ed22cad04431c75ab5093989dfedf1bae5a3e&tochange=d1d47ba19ce9d46222030d491f9fe28dbf80be12

--> Bug 1144096 presumably.

On debug builds, the testcase also hits the following assert:
ASSERTION: got BREAK_BEFORE again after growing the row?: 'Error', file z:/build/build/src/layout/generic/nsGridContainerFrame.cpp, line 5522

Comment 6

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 7

[Intermittent Failures Robot]

1 failures in 831 pushes (0.001 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* autoland: 1

Platform breakdown:
* linux64: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1316884&startday=2018-02-26&endday=2018-03-04&tree=all

Comment 8

[BugBot [:suhaib / :marco]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:dholbert, since the bug has high severity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 9

[Daniel Holbert [:dholbert]]

Attachment: testcase with unprefixed column styling

Here's the original testcase, with unprefixed column-fill styling (dropping -moz-) to make that style valid/recognized in current Firefox builds.

This testcase doesn't crash in a recent ASAN build, so I think this bug is WORKSFORME.

Comment 10

[Daniel Holbert [:dholbert]]

Attachment: Bug 1316884: Add crashtest for this no-longer-reproducible bug. (no review, crashtest-only)

Depends on D160734

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e8ac27147434
Add crashtest for this no-longer-reproducible bug. (no review, crashtest-only)

Comment 12

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/e8ac27147434

Comment 13

[BugBot [:suhaib / :marco]]

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)