1569628 - Crash in [@InvalidArrayIndex_CRASH | @ nsGridContainerFrame::LineNameMap::HasNameAt]

Status: RESOLVED WORKSFORME

(Core :: Layout: Grid, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 50df4b75c9b6.

==19522==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f9820b16437 bp 0x7ffc23ec0860 sp 0x7ffc23ec0860 T0)
==19522==The signal is caused by a WRITE memory access.
==19522==Hint: address points to the zero page.
    #0 0x7f9820b16436 in MOZ_Crash /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:313:3
    #1 0x7f9820b16436 in InvalidArrayIndex_CRASH(unsigned long, unsigned long) /builds/worker/workspace/build/src/xpcom/ds/nsTArray.cpp:27
    #2 0x7f982a9bd63b in ElementAt /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1045:7
    #3 0x7f982a9bd63b in operator[] /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1074
    #4 0x7f982a9bd63b in nsGridContainerFrame::LineNameMap::HasNameAt(unsigned int, nsAtom*) const /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:1176
    #5 0x7f982a9bc7ba in Contains /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:1147:51
    #6 0x7f982a9bc7ba in nsGridContainerFrame::LineNameMap::FindLine(nsAtom*, int*, unsigned int, nsTArray<unsigned int> const&) const /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:1082
    #7 0x7f982a902169 in FindNamedLine /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:978:14
    #8 0x7f982a902169 in nsGridContainerFrame::Grid::ResolveLine(mozilla::StyleGenericGridLine<int> const&, int, unsigned int, nsGridContainerFrame::LineNameMap const&, mozilla::LogicalSide, unsigned int, nsStylePosition const*) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:3430
    #9 0x7f982a903c9c in nsGridContainerFrame::Grid::ResolveLineRangeHelper(mozilla::StyleGenericGridLine<int> const&, mozilla::StyleGenericGridLine<int> const&, nsGridContainerFrame::LineNameMap const&, mozilla::LogicalAxis, unsigned int, nsStylePosition const*) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:3509:13
    #10 0x7f982a9044fa in ResolveLineRange /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:3553:16
    #11 0x7f982a9044fa in nsGridContainerFrame::Grid::PlaceDefinite(nsIFrame*, nsGridContainerFrame::LineNameMap const&, nsGridContainerFrame::LineNameMap const&, nsStylePosition const*) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:3584
    #12 0x7f982a90b7dd in nsGridContainerFrame::Grid::PlaceGridItems(nsGridContainerFrame::GridReflowInput&, RepeatTrackSizingInput const&) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:3990:9
    #13 0x7f982a9380e1 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:7066:12
    #14 0x7f982a7aa487 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:895:14
    #15 0x7f982a7a8dd2 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsCanvasFrame.cpp:731:5
    #16 0x7f982a7aa487 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:895:14
    #17 0x7f982a8ae7a4 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:628:3
    #18 0x7f982a8af9a3 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:741:3
    #19 0x7f982a8b4f7a in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:1143:3
    #20 0x7f982a73ef6c in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, unsigned int, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:934:14
    #21 0x7f982a73df19 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:309:7
    #22 0x7f982a5138e0 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9301:11
    #23 0x7f982a52dec3 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9471:24
    #24 0x7f982a52b5da in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:4238:11
    #25 0x7f982a4b314c in FlushPendingNotifications /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/PresShell.h:1468:5
    #26 0x7f982a4b314c in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:2013
    #27 0x7f982a4c45ff in TickDriver /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:371:13
    #28 0x7f982a4c45ff in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:348
    #29 0x7f982a4c3fae in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:364:5
    #30 0x7f982a4c77c3 in RunRefreshDrivers /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:811:5
    #31 0x7f982a4c77c3 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:731
    #32 0x7f982a4c1f28 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:531:20
    #33 0x7f9820c45800 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1224:14
    #34 0x7f9820c4bc18 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
    #35 0x7f9821e317cf in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:88:21
    #36 0x7f9821d2efa2 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #37 0x7f9821d2efa2 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
    #38 0x7f9821d2efa2 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
    #39 0x7f9829f3b069 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #40 0x7f982db56820 in nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:276:30
    #41 0x7f982ddfd193 in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4636:22
    #42 0x7f982ddff2b0 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4771:8
    #43 0x7f982de00cbe in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4852:21
    #44 0x55bd50e01dd4 in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:213:22
    #45 0x55bd50e01dd4 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:295
    #46 0x7f984258fb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:313:3 in MOZ_Crash

Comment 1

[Mats Palmgren (inactive)]

I can't reproduce this in a local Nightly build on Linux.
(I do see a DevTools issue though - I filed that as bug 1576484)

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.