1605780 - division by zero in layout/generic/nsGfxScrollFrame.cpp:1020

Status: RESOLVED DUPLICATE of bug 1772640

(Core :: Layout: Scrolling and Overflow, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c 20191220-1759c1b2fa6b

To enable this check add the following to your mozconfig:

ac_add_options --enable-undefined-sanitizer="float-divide-by-zero"

layout/generic/nsGfxScrollFrame.cpp:1020:24: runtime error: division by zero
    #0 0x7fa63c72e398 in GetScrollableOverflowForPerspective(nsIFrame*, nsIFrame*, nsRect, nsPoint, nsRect&) layout/generic/nsGfxScrollFrame.cpp:1020:24
    #1 0x7fa63c72ca78 in nsHTMLScrollFrame::AdjustForPerspective(nsRect&) /home/twsmith/code/mozilla-central/layout/generic/nsGfxScrollFrame.cpp:1076:3
    #2 0x7fa63c72c779 in nsHTMLScrollFrame::PlaceScrollArea(mozilla::ScrollReflowInput&, nsPoint const&) layout/generic/nsGfxScrollFrame.cpp:851:3
    #3 0x7fa63c72ebf2 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsGfxScrollFrame.cpp:1158:3
    #4 0x7fa63c62b0d6 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, nsOverflowAreas*) layout/generic/nsAbsoluteContainingBlock.cpp:760:14
    #5 0x7fa63c62951b in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsOverflowAreas*) layout/generic/nsAbsoluteContainingBlock.cpp:212:7
    #6 0x7fa63c633dae in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsBlockFrame.cpp:1614:26
    #7 0x7fa63c62b0d6 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, nsOverflowAreas*) layout/generic/nsAbsoluteContainingBlock.cpp:760:14
    #8 0x7fa63c62951b in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsOverflowAreas*) layout/generic/nsAbsoluteContainingBlock.cpp:212:7
    #9 0x7fa63c633dae in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/nsBlockFrame.cpp:1614:26
    #10 0x7fa63c62b0d6 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, nsOverflowAreas*) layout/generic/nsAbsoluteContainingBlock.cpp:760:14
    #11 0x7fa63c62951b in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsOverflowAreas*) layout/generic/nsAbsoluteContainingBlock.cpp:212:7
    #12 0x7fa63c6282ee in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) layout/generic/ViewportFrame.cpp:342:35
    #13 0x7fa63c44b26f in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) layout/base/PresShell.cpp:9180:11
    #14 0x7fa63c4598f1 in mozilla::PresShell::ProcessReflowCommands(bool) /home/twsmith/code/mozilla-central/layout/base/PresShell.cpp:9353:24
    #15 0x7fa63c458c35 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) layout/base/PresShell.cpp:4114:11
    #16 0x7fa63c3f96e4 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp:2050:20
    #17 0x7fa63c408fbe in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) layout/base/nsRefreshDriver.cpp:351:7
    #18 0x7fa63c408d21 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp:368:5
    #19 0x7fa63c407709 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp:740:16
    #20 0x7fa63c406a67 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) layout/base/nsRefreshDriver.cpp:635:9
    #21 0x7fa63cae1376 in mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) layout/ipc/VsyncChild.cpp:65:16
    #22 0x7fa635abafe6 in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) objdir-ff-ubsan/ipc/ipdl/PVsyncChild.cpp:187:54
    #23 0x7fa63549f7eb in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) objdir-ff-ubsan/ipc/ipdl/PBackgroundChild.cpp:5876:32 
    #24 0x7fa634c4187b in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) ipc/glue/MessageChannel.cpp:2212:25
    #24 0x7fa634c4187b in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) ipc/glue/MessageChannel.cpp:2212:25
    #25 0x7fa634c3ccc7 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) ipc/glue/MessageChannel.cpp:2134:9
    #26 0x7fa634c3e843 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) ipc/glue/MessageChannel.cpp:1973:3
    #27 0x7fa634c3f788 in mozilla::ipc::MessageChannel::MessageTask::Run() ipc/glue/MessageChannel.cpp:2004:13
    #28 0x7fa633849f44 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1241:14
    #29 0x7fa633850a6e in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:486:10
    #30 0x7fa634c4e44e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:87:21
    #31 0x7fa634a90d14 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:290:3
    #32 0x7fa63bfff61a in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:137:27
    #33 0x7fa6400f8939 in XRE_RunAppShell() toolkit/xre/nsEmbedFunctions.cpp:946:20
    #34 0x7fa634c4fa61 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:237:9
    #35 0x7fa634a90d14 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:290:3
    #36 0x7fa6400f7d87 in XRE_InitChildProcess(int, char**, XREChildData const*) toolkit/xre/nsEmbedFunctions.cpp:781:34
    #37 0x558fbc6771c5 in content_process_main(mozilla::Bootstrap*, int, char**) browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #38 0x558fbc6773ef in main browser/app/nsBrowserApp.cpp:303:18

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/A5suBxCwIYgWuA-0kDiVhQ/index.html

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:heycam, could you have a look please?

For more information, please visit auto_nag documentation.