Closed Bug 1601819 Opened 6 years ago Closed 3 years ago

member call on null pointer in layout/generic/nsGridContainerFrame.cpp:8455

Categories

(Core :: Layout: Grid, defect, P3)

Product:
Core
Component:
Layout: Grid
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
firefox73 --- wontfix

People

(Reporter: tsmith, Assigned: dholbert)

References

(Blocks 1 open bug)

Details

(Keywords: crash, csectype-nullptr, testcase)

Attachments

(2 files)

testcase.html
141 bytes, text/html
Details
Bug 1601819: Add crashtest for this no-longer-reproducible bug. (no review, crashtest-only)
48 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Reduced with m-c 20191205-3dc70a33491f

layout/generic/nsGridContainerFrame.cpp:8455:20: runtime error: member call on null pointer of type 'nsIFrame'
    #0 0x7f341709e1ce in nsGridContainerFrame::GetGridContainerFrame(nsIFrame*) layout/generic/nsGridContainerFrame.cpp:8455:20
    #1 0x7f34170e621a in nsGridContainerFrame::GridItemInfo::GridItemInfo(nsIFrame*, nsGridContainerFrame::GridArea const&) layout/generic/nsGridContainerFrame.cpp:678:39
    #2 0x7f34170ed687 in nsGridContainerFrame::GridReflowInput::InitializeForContinuation(nsGridContainerFrame*, int) layout/generic/nsGridContainerFrame.cpp:2587:40
    #3 0x7f34170976e1 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsGridContainerFrame.cpp:7407:21
    #4 0x7f3416f8a38a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) layout/generic/nsContainerFrame.cpp:910:14
    #5 0x7f3416f58dca in nsContainerFrame::ReflowOverflowContainerChildren(nsPresContext*, mozilla::ReflowInput const&, nsOverflowAreas&, nsIFrame::ReflowChildFlags, nsReflowStatus&, void (*)(nsFrameList&, nsFrameList&, nsContainerFrame*)) layout/generic/nsContainerFrame.cpp:1178:7
    #6 0x7f3416f5643a in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsBlockFrame.cpp:1292:5
    #7 0x7f3416f8a38a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) layout/generic/nsContainerFrame.cpp:910:14
    #8 0x7f3416f8e92d in nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) layout/generic/nsColumnSetFrame.cpp:796:7
    #9 0x7f3416f8da30 in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig&, bool) layout/generic/nsColumnSetFrame.cpp:453:37
    #10 0x7f3416f92710 in nsColumnSetFrame::FindBestBalanceBSize(mozilla::ReflowInput const&, nsPresContext*, nsColumnSetFrame::ReflowConfig&, nsColumnSetFrame::ColumnBalanceData, mozilla::ReflowOutput&, bool, nsReflowStatus&) layout/generic/nsColumnSetFrame.cpp:1227:9
    #11 0x7f3416f9352b in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsColumnSetFrame.cpp:1360:5
    #12 0x7f3416f8a38a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) layout/generic/nsContainerFrame.cpp:910:14
    #13 0x7f3417088e62 in MeasuringReflow(nsIFrame*, mozilla::ReflowInput const*, gfxContext*, mozilla::LogicalSize const&, mozilla::LogicalSize const&, int, int) layout/generic/nsGridContainerFrame.cpp:4660:11
    #14 0x7f341708d652 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) layout/generic/nsGridContainerFrame.cpp:4887:14
    #15 0x7f341708758b in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) layout/generic/nsGridContainerFrame.cpp:4938:15
    #16 0x7f3417086a83 in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) layout/generic/nsGridContainerFrame.cpp:5106:13
    #17 0x7f341708377d in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, SizingConstraint) layout/generic/nsGridContainerFrame.cpp:5558:11
    #18 0x7f34170771ea in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, SizingConstraint) layout/generic/nsGridContainerFrame.cpp:5047:3
    #19 0x7f34170768dd in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, SizingConstraint) layout/generic/nsGridContainerFrame.cpp:3370:12
    #20 0x7f341709786d in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsGridContainerFrame.cpp:7386:21
    #21 0x7f3416f8a38a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) layout/generic/nsContainerFrame.cpp:910:14
    #22 0x7f3417088e62 in MeasuringReflow(nsIFrame*, mozilla::ReflowInput const*, gfxContext*, mozilla::LogicalSize const&, mozilla::LogicalSize const&, int, int) layout/generic/nsGridContainerFrame.cpp:4660:11
    #23 0x7f341708d652 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) layout/generic/nsGridContainerFrame.cpp:4887:14
    #24 0x7f341708758b in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) layout/generic/nsGridContainerFrame.cpp:4938:15
    #25 0x7f3417086a83 in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) layout/generic/nsGridContainerFrame.cpp:5106:13
    #26 0x7f341708377d in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, SizingConstraint) layout/generic/nsGridContainerFrame.cpp:5558:11
    #27 0x7f34170771ea in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, SizingConstraint) layout/generic/nsGridContainerFrame.cpp:5047:3
    #28 0x7f34170768dd in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, SizingConstraint) layout/generic/nsGridContainerFrame.cpp:3370:12
    #29 0x7f341709786d in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsGridContainerFrame.cpp:7386:21
    #30 0x7f3416f8a38a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) layout/generic/nsContainerFrame.cpp:910:14
    #31 0x7f3416f895b3 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsCanvasFrame.cpp:738:5
    #32 0x7f3416f8a38a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) layout/generic/nsContainerFrame.cpp:910:14
    #33 0x7f3417049f0c in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*) layout/generic/nsGfxScrollFrame.cpp:649:3
    #34 0x7f341704b60c in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) layout/generic/nsGfxScrollFrame.cpp:763:3
    #35 0x7f341704e8ae in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsGfxScrollFrame.cpp:1142:3
    #36 0x7f3416f4be46 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) layout/generic/nsContainerFrame.cpp:950:14
    #37 0x7f3416f4b76f in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/ViewportFrame.cpp:299:7
    #38 0x7f3416d75bf6 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) layout/base/PresShell.cpp:9179:11
    #39 0x7f3416d84191 in mozilla::PresShell::ProcessReflowCommands(bool) layout/base/PresShell.cpp:9352:24
    #40 0x7f3416d83505 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) layout/base/PresShell.cpp:4111:11
    #41 0x7f3416d258df in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp:2050:20
    #42 0x7f3416d34e6e in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) layout/base/nsRefreshDriver.cpp:350:7
    #43 0x7f3416d34bd1 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp:367:5
    #44 0x7f3416d335d9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp:739:16
    #45 0x7f3416d32967 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) layout/base/nsRefreshDriver.cpp:634:9
    #46 0x7f34173f58d6 in mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) layout/ipc/VsyncChild.cpp:65:16
    #47 0x7f34106157f6 in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) objdir-ff-ubsan/ipc/ipdl/PVsyncChild.cpp:187:54
    #48 0x7f3410019eab in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) objdir-ff-ubsan/ipc/ipdl/PBackgroundChild.cpp:5876:32
    #49 0x7f340f7fa3e6 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) ipc/glue/MessageChannel.cpp:2208:25
    #50 0x7f340f7f5967 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) ipc/glue/MessageChannel.cpp:2130:9
    #51 0x7f340f7f7423 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) ipc/glue/MessageChannel.cpp:1972:3
    #52 0x7f340f7f8358 in mozilla::ipc::MessageChannel::MessageTask::Run() ipc/glue/MessageChannel.cpp:2003:13
    #53 0x7f340e48a6b4 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1250:14
    #54 0x7f340e490336 in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:486:10
    #55 0x7f340f806c4e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:88:21
    #56 0x7f340f64ea94 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:290:3
    #57 0x7f341693b54a in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:137:27
    #58 0x7f341a9439a1 in XRE_RunAppShell() toolkit/xre/nsEmbedFunctions.cpp:943:20
    #59 0x7f340f808241 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:238:9
    #60 0x7f340f64ea94 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:290:3
    #61 0x7f341a942e56 in XRE_InitChildProcess(int, char**, XREChildData const*) toolkit/xre/nsEmbedFunctions.cpp:778:34
    #62 0x557ca74e01bd in content_process_main(mozilla::Bootstrap*, int, char**) browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #63 0x557ca74e03e1 in main browser/app/nsBrowserApp.cpp:303:18
Flags: in-testsuite?

A Pernosco session is available here: https://pernos.co/debug/msSQpwo8an-KZ64zFRqugA/index.html

Grid+fieldset fragmentation crash. Probably from bug 471015?

Mats, do your recent regression fixes fix this?

Flags: needinfo?(mats)
Priority: -- → P3
Severity: normal → S3

Not sure if a particular build configuration was required to reproduce this, but FWIW, I can't reproduce a crash in:

  • current Nightly
  • current debug build (from mozregression -B debug --launch 2023-01-12)
  • nightly or ASAN-nightly from the day this was filed (mozregression -B asan --launch 2019-12-05 --pref security.sandbox.content.level:0
    (we don't have debug builds from the day this was filed, so I can't test that)

I think this is WFM; Tyson, could you confirm?

Flags: needinfo?(MatsPalmgren_bugz) → needinfo?(twsmith)

(Assuming this is fixed, we should land the testcase as a crashtest. Setting ni=me to remind myself to do that.)

Flags: needinfo?(dholbert)

I am no longer able to reproduce the issue either. The fuzzers last reported while targeting m-c 20200722-5e83cc94405f.

Flags: needinfo?(twsmith)
Pushed by dholbert@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/97fc9f3f9d39 Add crashtest for this no-longer-reproducible bug. (no review, crashtest-only)

Great - seems pretty likely this became WFM at some point then. Crashtest checked in to be sure it stays fixed. :)

Status: NEW → RESOLVED
Closed: 3 years ago
Flags: needinfo?(dholbert)
Flags: in-testsuite?
Flags: in-testsuite+
Resolution: --- → FIXED
Assignee: nobody → dholbert
status-firefox73: affected → wontfix
Resolution: FIXED → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: