use-after-poison in [@ mozilla::ReflowInput::ReflowInput]
Categories
(Core :: Layout: Form Controls, defect, P3)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr68 | --- | unaffected |
firefox71 | --- | unaffected |
firefox72 | --- | fixed |
firefox73 | --- | fixed |
People
(Reporter: tsmith, Assigned: MatsPalmgren_bugz)
References
(Blocks 1 open bug, Regression)
Details
(5 keywords)
Crash Data
Attachments
(3 files)
99 bytes,
text/html
|
Details | |
2.81 KB,
text/plain
|
Details | |
47 bytes,
text/x-phabricator-request
|
jcristau
:
approval-mozilla-beta+
|
Details | Review |
Reduced with m-c:
BuildID=20191125161209
SourceStamp=b4755981c1382cb88fed4e4fcff3ba73779b2080
==26665==ERROR: AddressSanitizer: use-after-poison on address 0x62500029e5ec at pc 0x7feeb2be8d08 bp 0x7ffe5cf0d140 sp 0x7ffe5cf0d138
READ of size 1 at 0x62500029e5ec thread T0 (file:// Content)
#0 0x7feeb2be8d07 in GetWritingMode src/layout/generic/nsIFrame.h:906:56
#1 0x7feeb2be8d07 in SizeComputationInput src/layout/generic/ReflowInput.h:181:30
#2 0x7feeb2be8d07 in mozilla::ReflowInput::ReflowInput(nsPresContext*, mozilla::ReflowInput const&, nsIFrame*, mozilla::LogicalSize const&, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int) src/layout/generic/ReflowInput.cpp:169:7
#3 0x7feeb2fa1364 in nsFieldSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/forms/nsFieldSetFrame.cpp:566:17
#4 0x7feeb2c59b5c in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&) src/layout/generic/nsBlockReflowContext.cpp:293:11
#5 0x7feeb2c4fc52 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3694:11
#6 0x7feeb2c4d2fb in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3039:5
#7 0x7feeb2c42b4c in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) src/layout/generic/nsBlockFrame.cpp:2582:7
#8 0x7feeb2c39c6d in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsBlockFrame.cpp:1325:3
#9 0x7feeb2c90fa7 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) src/layout/generic/nsContainerFrame.cpp:910:14
#10 0x7feeb2c95843 in nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) src/layout/generic/nsColumnSetFrame.cpp:796:7
#11 0x7feeb2c9c0d2 in ReflowColumns src/layout/generic/nsColumnSetFrame.cpp:453:37
#12 0x7feeb2c9c0d2 in nsColumnSetFrame::FindBestBalanceBSize(mozilla::ReflowInput const&, nsPresContext*, nsColumnSetFrame::ReflowConfig&, nsColumnSetFrame::ColumnBalanceData, mozilla::ReflowOutput&, bool, nsReflowStatus&) src/layout/generic/nsColumnSetFrame.cpp:1286:7
#13 0x7feeb2c9c9fe in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsColumnSetFrame.cpp:1360:5
#14 0x7feeb2c59b5c in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&) src/layout/generic/nsBlockReflowContext.cpp:293:11
#15 0x7feeb2c4fc52 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3694:11
#16 0x7feeb2c4d2fb in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3039:5
#17 0x7feeb2c42b4c in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) src/layout/generic/nsBlockFrame.cpp:2582:7
#18 0x7feeb2c39c6d in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsBlockFrame.cpp:1325:3
#19 0x7feeb2c59b5c in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&) src/layout/generic/nsBlockReflowContext.cpp:293:11
#20 0x7feeb2c4fc52 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3694:11
#21 0x7feeb2c4d2fb in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3039:5
#22 0x7feeb2c42b4c in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) src/layout/generic/nsBlockFrame.cpp:2582:7
#23 0x7feeb2c39c6d in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsBlockFrame.cpp:1325:3
#24 0x7feeb2c90fa7 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) src/layout/generic/nsContainerFrame.cpp:910:14
#25 0x7feeb2c95843 in nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) src/layout/generic/nsColumnSetFrame.cpp:796:7
#26 0x7feeb2c9c0d2 in ReflowColumns src/layout/generic/nsColumnSetFrame.cpp:453:37
#27 0x7feeb2c9c0d2 in nsColumnSetFrame::FindBestBalanceBSize(mozilla::ReflowInput const&, nsPresContext*, nsColumnSetFrame::ReflowConfig&, nsColumnSetFrame::ColumnBalanceData, mozilla::ReflowOutput&, bool, nsReflowStatus&) src/layout/generic/nsColumnSetFrame.cpp:1286:7
#28 0x7feeb2c9c9fe in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsColumnSetFrame.cpp:1360:5
#29 0x7feeb2c59b5c in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowInput&) src/layout/generic/nsBlockReflowContext.cpp:293:11
#30 0x7feeb2c4fc52 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3694:11
#31 0x7feeb2c4d2fb in nsBlockFrame::ReflowLine(mozilla::BlockReflowInput&, nsLineList_iterator, bool*) src/layout/generic/nsBlockFrame.cpp:3039:5
#32 0x7feeb2c42b4c in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowInput&) src/layout/generic/nsBlockFrame.cpp:2582:7
#33 0x7feeb2c39c6d in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsBlockFrame.cpp:1325:3
#34 0x7feeb2c90fa7 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) src/layout/generic/nsContainerFrame.cpp:910:14
#35 0x7feeb2c8fad1 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsCanvasFrame.cpp:738:5
#36 0x7feeb2c90fa7 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) src/layout/generic/nsContainerFrame.cpp:910:14
#37 0x7feeb2d9c96b in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*) src/layout/generic/nsGfxScrollFrame.cpp:649:3
#38 0x7feeb2d9dd28 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) src/layout/generic/nsGfxScrollFrame.cpp:763:3
#39 0x7feeb2da36c1 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/nsGfxScrollFrame.cpp:1142:3
#40 0x7feeb2c2628c in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) src/layout/generic/nsContainerFrame.cpp:950:14
#41 0x7feeb2c25451 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) src/layout/generic/ViewportFrame.cpp:299:7
#42 0x7feeb29fa12f in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) src/layout/base/PresShell.cpp:9179:11
#43 0x7feeb2a12be7 in mozilla::PresShell::ProcessReflowCommands(bool) src/layout/base/PresShell.cpp:9352:24
#44 0x7feeb2a1056a in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) src/layout/base/PresShell.cpp:4111:11
#45 0x7feeb29933ff in FlushPendingNotifications src/obj-firefox/dist/include/mozilla/PresShell.h:1452:5
#46 0x7feeb29933ff in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2050:20
#47 0x7feeb29a3ff1 in TickDriver src/layout/base/nsRefreshDriver.cpp:373:13
#48 0x7feeb29a3ff1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:350:7
#49 0x7feeb29a3b1b in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:367:5
#50 0x7feeb29a2e63 in RunRefreshDrivers src/layout/base/nsRefreshDriver.cpp:819:5
#51 0x7feeb29a2e63 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:739:16
#52 0x7feeb29a2197 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) src/layout/base/nsRefreshDriver.cpp:634:9
#53 0x7feeb328c3f9 in mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) src/layout/ipc/VsyncChild.cpp:65:16
#54 0x7feeab54626f in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
#55 0x7feeaafb1cde in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:5876:32
#56 0x7feeaa822df6 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2208:25
#57 0x7feeaa81de11 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2130:9
#58 0x7feeaa820381 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1972:3
#59 0x7feeaa821247 in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:2003:13
#60 0x7feea960affa in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1250:14
#61 0x7feea96124a1 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:486:10
#62 0x7feeaa82bfaf in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
#63 0x7feeaa735dd2 in RunInternal src/ipc/chromium/src/base/message_loop.cc:315:10
#64 0x7feeaa735dd2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:308:3
#65 0x7feeaa735dd2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#66 0x7feeb24171e8 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#67 0x7feeb647e6b6 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:934:20
#68 0x7feeaa735dd2 in RunInternal src/ipc/chromium/src/base/message_loop.cc:315:10
#69 0x7feeaa735dd2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:308:3
#70 0x7feeaa735dd2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
#71 0x7feeb647df04 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:769:34
#72 0x55c6e3499c5c in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#73 0x55c6e3499c5c in main src/browser/app/nsBrowserApp.cpp:272:18
Reporter | ||
Comment 1•4 years ago
|
||
A Pernosco session is available here: https://pernos.co/debug/V9Ho6xnQ2ZlipuN2peetdg/index.html
It will expire in 7 days.
Comment 2•4 years ago
|
||
This happens after we support fragmenting <fieldset>
in bug 471015.
Assignee | ||
Comment 3•4 years ago
|
||
It seems this fieldset was reflowed once and the inner frame was incomplete and thus we created a next-in-flow for it on the OverflowList, then we got another reflow before its next-in-flow picked it up, so DrainSelfOverflowList put it back on mFrames. This makes GetInner() confused since it only expects one inner frame.
Assignee | ||
Comment 4•4 years ago
|
||
Also, don't drain OverflowList unless we need to.
And make EnsureChildContinuation deal with continuations going from being
normal continuations to overflow-continuations (and vice versa) better.
Updated•4 years ago
|
Updated•4 years ago
|
Pushed by mpalmgren@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/8056d04a14bc Make GetInner()/GetLegend() robust also in presence of additional continuations on the principal child list. r=TYLin
Comment 7•4 years ago
|
||
bugherder |
Comment 8•4 years ago
|
||
Should we uplift this to beta?
Assignee | ||
Comment 9•4 years ago
|
||
Comment on attachment 9113183 [details]
Bug 1600207 - Make GetInner()/GetLegend() robust also in presence of additional continuations on the principal child list. r=TYLin
Beta/Release Uplift Approval Request
- User impact if declined: possible crash with fieldset inside a column layout
- Is this code covered by automated tests?: Yes
- Has the fix been verified in Nightly?: Yes
- Needs manual test from QE?: No
- If yes, steps to reproduce:
- List of other uplifts needed: None
- Risk to taking this patch: Medium
- Why is the change risky/not risky? (and alternatives if risky): The change is non-trivial, but it only affects fragmented fieldsets, so it should have zero risk of causing regressions in other layout.
- String changes made/needed:
Comment 10•4 years ago
|
||
Comment on attachment 9113183 [details]
Bug 1600207 - Make GetInner()/GetLegend() robust also in presence of additional continuations on the principal child list. r=TYLin
crash fix for 72.0b6
Comment 11•4 years ago
|
||
bugherder uplift |
Updated•2 years ago
|
Description
•