Closed Bug 1493710 Opened 2 years ago Closed 2 years ago

SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/WritingModes.h:244:38 in IsVertical

Categories

(Core :: Layout, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla64
Tracking Status
firefox-esr60 --- unaffected
firefox62 --- unaffected
firefox63 --- fixed
firefox64 --- fixed

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, regression, testcase)

Attachments

(3 files)

Attached file testcase.html
Testcase found while fuzzing mozilla-central rev 095ec59a8800.

==30963==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000011 (pc 0x7f2f5ccdb7f2 bp 0x7ffc37dbd7f0 sp 0x7ffc37dbd460 T0)
==30963==The signal is caused by a READ memory access.
==30963==Hint: address points to the zero page.
    #0 0x7f2f5ccdb7f1 in IsVertical /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/WritingModes.h:244:38
    #1 0x7f2f5ccdb7f1 in IsOrthogonalTo /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/WritingModes.h:595
    #2 0x7f2f5ccdb7f1 in IsBResizeForWM /builds/worker/workspace/build/src/layout/generic/ReflowInput.h:639
    #3 0x7f2f5ccdb7f1 in mozilla::ReflowInput::InitResizeFlags(nsPresContext*, mozilla::LayoutFrameType) /builds/worker/workspace/build/src/layout/generic/ReflowInput.cpp:720
    #4 0x7f2f5d1a7acd in nsTextControlFrame::ReflowTextControlChild(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, mozilla::ReflowOutput&) /builds/worker/workspace/build/src/layout/forms/nsTextControlFrame.cpp:685:18
    #5 0x7f2f5d1a7202 in nsTextControlFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/forms/nsTextControlFrame.cpp:655:5
    #6 0x7f2f5cd34603 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, nsOverflowAreas*) /builds/worker/workspace/build/src/layout/generic/nsAbsoluteContainingBlock.cpp:745:14
    #7 0x7f2f5cd2d785 in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsOverflowAreas*) /builds/worker/workspace/build/src/layout/generic/nsAbsoluteContainingBlock.cpp:168:7
    #8 0x7f2f5ce795a8 in nsFrame::ReflowAbsoluteFrames(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, bool) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:6444:24
    #9 0x7f2f5cdcecae in FinishReflowWithAbsoluteFrames /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:6411:3
    #10 0x7f2f5cdcecae in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsCanvasFrame.cpp:882
    #11 0x7f2f5cdd044b in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:951:14
    #12 0x7f2f5cf0861b in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*, bool) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:606:3
    #13 0x7f2f5cf0a189 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:730:3
    #14 0x7f2f5cf0f710 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:1120:3
    #15 0x7f2f5cd2c058 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:995:14
    #16 0x7f2f5cd2a77b in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:338:7
    #17 0x7f2f5ca8046b in mozilla::PresShell::DoReflow(nsIFrame*, bool) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9016:11
    #18 0x7f2f5ca9b248 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9189:24
    #19 0x7f2f5ca9936c in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:4342:11
    #20 0x7f2f5ca0f747 in FlushPendingNotifications /builds/worker/workspace/build/src/layout/base/nsIPresShell.h:577:5
    #21 0x7f2f5ca0f747 in nsRefreshDriver::Tick(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:1930
    #22 0x7f2f5ca21441 in TickDriver /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:325:13
    #23 0x7f2f5ca21441 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:300
    #24 0x7f2f5ca20f61 in mozilla::RefreshDriverTimer::Tick(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:318:5
    #25 0x7f2f5ca24241 in RunRefreshDrivers /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:756:5
    #26 0x7f2f5ca24241 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:672
    #27 0x7f2f5ca23998 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:572:9
    #28 0x7f2f5d4eada8 in mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) /builds/worker/workspace/build/src/layout/ipc/VsyncChild.cpp:78:16
    #29 0x7f2f541d708b in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:167:20
    #30 0x7f2f53f4de60 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:2280:28
    #31 0x7f2f53738685 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2248:25
    #32 0x7f2f537343b9 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2175:17
    #33 0x7f2f537364fd in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2012:5
    #34 0x7f2f53737227 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2045:15
    #35 0x7f2f52527897 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1166:14
    #36 0x7f2f52530415 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10
    #37 0x7f2f53741d03 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21
    #38 0x7f2f5364473c in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:325:10
    #39 0x7f2f5364473c in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:318
    #40 0x7f2f5364473c in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:298
    #41 0x7f2f5c3311a3 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:158:27
    #42 0x7f2f607f62ee in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:939:22
    #43 0x7f2f5364473c in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:325:10
    #44 0x7f2f5364473c in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:318
    #45 0x7f2f5364473c in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:298
    #46 0x7f2f607f5413 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:765:34
    #47 0x558b0e6d0b91 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30
    #48 0x558b0e6d0b91 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:287
    #49 0x7f2f74482b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
Flags: in-testsuite?
Hmm, the frame tree here is a bit surprising to me:
(rr) call this->DumpFrameTreeLimited()
nsTextControlFrame@62500075b8e8<
  Placeholder(div)(-1)@62500075b350 parent=62500075b8e8 outOfFlowFrame=HTMLScroll(div)(-1)@62500075b9c8
>
AbsoluteList 602000353e30 <
  HTMLScroll(div)(-1)@62500075b9c8<
    Block(div)(-1)@62500075b448<
      line 62500075b568: count=1 <
        Text(0)""@62500075bbe8
      >
    >
  >
>

I wasn't aware that one could use custom elements + shadow DOM
to create frame trees for replaced elements like this...

Anyway, it's a valid bug all the same.  We're failing to
initialize ReflowInput::mCBReflowInput in this case because
we early return for placeholders here:
https://searchfox.org/mozilla-central/rev/0640ea80fbc8d48f8b197cd363e2535c95a15eb3/layout/generic/ReflowInput.cpp#403,411
and later use it to query its mWritingMode per the stack above.
Assignee: nobody → mats
Hmm, hold on, I'm not sure that's totally expected... Let me look at how the DOM looks like in that test-case.
Yeah, the shadow rules should not affect the NAC here. That's a bug.
This is a regression from bug 1487856.
Blocks: 1487856
Let me steal this. I think your patch looks fine as well, but I have a patch for the root cause of the issue.

I think we should uplift the real fix for the underlying issue to beta given we plan to ship Shadow DOM and the regressing bug slipped through beta.
Assignee: mats → emilio
This is a regression from bug 1487856.
Comment on attachment 9011590 [details]
Don't apply containing shadow-host rules to NAC.

Approval Request Comment
[Feature/Bug causing the regression]: bug 1487856
[User impact if declined]: Wrong rules may be applied to internal elements, which may cause crashes since we assume we're in control of those.
[Is this code covered by automated tests?]: yes (included in the patch)
[Has the fix been verified in Nightly?]: not yet
[Needs manual test from QE? If yes, steps to reproduce]: not really
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: not risky
[Why is the change risky/not risky?]: It just wraps a bit of code in a condition to preserve the behavior from before bug 1487856.
[String changes made/needed]: none
Attachment #9011590 - Flags: approval-mozilla-beta?
I spawned off bug 1493805 for adding the missing initialization
of ReflowInput::mCBReflowInput.
Comment on attachment 9011590 [details]
Don't apply containing shadow-host rules to NAC.

Mats Palmgren (:mats) has approved the revision.
Attachment #9011590 - Flags: review+
Pushed by emilio@crisal.io:
https://hg.mozilla.org/integration/autoland/rev/73a8628576e4
Don't apply containing shadow-host rules to NAC. r=mats
Backed out for failures on layout/reftests/forms/input/shadow-rules.html

It affects the subsequent pushes as well, especially https://treeherder.mozilla.org/#/jobs?repo=autoland&searchStr=reftest&group_state=expanded&revision=f629b66a235fdf3f37646dc55bf4e2e8e188a48a

backout:  https://hg.mozilla.org/integration/autoland/rev/2fa7c04b9118285082959c0873d47e198e9be150

push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&searchStr=reftest&group_state=expanded&revision=73a8628576e4e6e6361065044d1dd8ee4296b10c&selectedJob=201308352

failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=201308352&repo=autoland&lineNumber=38613

00:38:10     INFO - REFTEST TEST-START | file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/shadow-rules.html == file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/shadow-rules-ref.html
00:38:10     INFO - REFTEST TEST-LOAD | file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/shadow-rules.html | 2 / 3 (66%)
00:43:10     INFO - REFTEST TEST-UNEXPECTED-FAIL | file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/shadow-rules.html == file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/shadow-rules-ref.html | load failed: timed out after 300000 ms waiting for 'load' event for file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/shadow-rules.html
00:43:10     INFO - REFTEST INFO | Saved log: START file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/shadow-rules.html
00:43:10     INFO - REFTEST TEST-END | file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/shadow-rules.html == file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/shadow-rules-ref.html
00:43:10     INFO - REFTEST INFO | Slowest test took 46ms (file:///Z:/task_1537833696/build/tests/reftest/tests/layout/reftests/forms/input/selector-read-write-type-change-002.html)
00:43:10     INFO - REFTEST INFO | Total canvas count = 2
00:43:10     INFO - [Parent 4188, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
00:43:10     INFO - [Child 1108, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
00:43:10     INFO - [Child 1108, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
00:43:10     INFO - JavaScript error: resource://reftest/reftest.jsm, line 1546: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIPropertyBag2.getPropertyAsAString]
00:43:10     INFO - [Parent 4188, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
00:43:10     INFO - [Child 5572, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
00:43:10     INFO - [Child 5572, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
00:43:10     INFO - JavaScript error: resource://reftest/reftest.jsm, line 1546: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIPropertyBag2.getPropertyAsAString]
00:43:10     INFO - [Parent 4188, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
00:43:10     INFO - [Child 4432, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
00:43:10     INFO - [Child 4432, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
00:43:10     INFO - JavaScript error: resource://reftest/reftest.jsm, line 1546: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIPropertyBag2.getPropertyAsAString]
00:43:11     INFO - 1537836190969	Marionette	DEBUG	Received observer notification xpcom-will-shutdown
00:43:11     INFO - 1537836190969	Marionette	INFO	Stopped listening on port 2828
00:43:11     INFO - 1537836190969	Marionette	DEBUG	Remote service is inactive
00:43:11     INFO - [GPU 1848,
00:43:11     INFO - ###!!! [Child][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost
00:43:11     INFO -  Chrome_ChildThread] WARNING: pipe error: 109: file z:/bu
Flags: needinfo?(emilio)
The manifest file layout/reftests/forms/input/reftest.list doesn't match
where the test was added (under text/).  My bad, I should've caught that
in the review...
Keywords: regression
Duplicate of this bug: 1493843
Pushed by emilio@crisal.io:
https://hg.mozilla.org/integration/autoland/rev/c5e55282c2d1
Don't apply containing shadow-host rules to NAC. r=mats
Flags: needinfo?(emilio)
https://hg.mozilla.org/mozilla-central/rev/c5e55282c2d1
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
Comment on attachment 9011590 [details]
Don't apply containing shadow-host rules to NAC.

Emilio, could you request the approval on the updated patch? Thanks
Flags: needinfo?(emilio)
Attachment #9011590 - Flags: approval-mozilla-beta? → approval-mozilla-beta-
Comment on attachment 9011590 [details]
Don't apply containing shadow-host rules to NAC.

emilio updated the patch
Flags: needinfo?(emilio)
Attachment #9011590 - Flags: approval-mozilla-beta- → approval-mozilla-beta?
Comment on attachment 9011590 [details]
Don't apply containing shadow-host rules to NAC.

Uplift approved for 63 beta 10, thanks!
Attachment #9011590 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
When trying to graft this bug for uplift I got a conflict on servo/components/style/stylist.rs.

emilio: Can you please take a look ?
Flags: needinfo?(pascalc)
Flags: needinfo?(emilio)
Attached patch Rebased patch.Splinter Review
They were only formatting changes since the style system was rustfmt'd.
Flags: needinfo?(pascalc)
Flags: needinfo?(emilio)
Flags: needinfo?(dluca)
Flags: in-testsuite? → in-testsuite+
Flags: needinfo?(dluca)
You need to log in before you can comment on or make changes to this bug.