1605797 - division by zero in dist/include/Units.h:717

Status: NEW

(Core :: Layout, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c 20191223-6d2e33d632e7

To enable this check add the following to your mozconfig:

ac_add_options --enable-undefined-sanitizer="float-divide-by-zero"

objdir-ff-ubsan/dist/include/Units.h:717:42: runtime error: division by zero
    #0 0x7f495d760a7b in mozilla::gfx::SizeTyped<mozilla::CSSPixel, float> mozilla::operator/<mozilla::ScreenPixel, mozilla::CSSPixel>(mozilla::gfx::SizeTyped<mozilla::ScreenPixel, float> const&, mozilla::gfx::ScaleFactors2D<mozilla::CSSPixel, mozilla::ScreenPixel> const&) objdir-ff-ubsan/dist/include/Units.h:717:42
    #1 0x7f495d717e2c in nsLayoutUtils::CalculateRootCompositionSize(nsIFrame*, bool, mozilla::layers::FrameMetrics const&) layout/base/nsLayoutUtils.cpp:8689:30
    #2 0x7f495d7171cf in nsLayoutUtils::CalculateBasicFrameMetrics(nsIScrollableFrame*) layout/base/nsLayoutUtils.cpp:3296:7
    #3 0x7f495d71880c in nsLayoutUtils::CalculateAndSetDisplayPortMargins(nsIScrollableFrame*, nsLayoutUtils::RepaintMode) layout/base/nsLayoutUtils.cpp:3314:26
    #4 0x7f495d718af4 in nsLayoutUtils::MaybeCreateDisplayPort(nsDisplayListBuilder*, nsIFrame*, nsLayoutUtils::RepaintMode) layout/base/nsLayoutUtils.cpp:3343:7
    #5 0x7f495d718ece in nsLayoutUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) layout/base/nsLayoutUtils.cpp:3395:9
    #6 0x7f495d718fe1 in nsLayoutUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) layout/base/nsLayoutUtils.cpp:3426:9
    #7 0x7f495d718fe1 in nsLayoutUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) layout/base/nsLayoutUtils.cpp:3426:9
    #8 0x7f495d718fe1 in nsLayoutUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) layout/base/nsLayoutUtils.cpp:3426:9
    #9 0x7f495d718fe1 in nsLayoutUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) layout/base/nsLayoutUtils.cpp:3426:9
    #10 0x7f495d718fe1 in nsLayoutUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) layout/base/nsLayoutUtils.cpp:3426:9
    #11 0x7f495d718fe1 in nsLayoutUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) layout/base/nsLayoutUtils.cpp:3426:9
    #12 0x7f495d71a9b3 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) layout/base/nsLayoutUtils.cpp:3909:5
    #13 0x7f495d648a0b in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) layout/base/PresShell.cpp:6037:5
    #14 0x7f495d147dec in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) view/nsViewManager.cpp:461:18
    #15 0x7f495d1476c2 in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) view/nsViewManager.cpp:396:22
    #16 0x7f495d149702 in nsViewManager::ProcessPendingUpdates() view/nsViewManager.cpp:1019:5
    #17 0x7f495d5dca68 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp:2177:11
    #18 0x7f495d5eba6e in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) layout/base/nsRefreshDriver.cpp:351:7
    #19 0x7f495d5eb7d1 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp:368:5
    #20 0x7f495d5ea1b9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) layout/base/nsRefreshDriver.cpp:740:16
    #21 0x7f495d5e9517 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) layout/base/nsRefreshDriver.cpp:635:9
    #22 0x7f495dcc3ee6 in mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) layout/ipc/VsyncChild.cpp:65:16
    #23 0x7f4956c955b6 in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) objdir-ff-ubsan/ipc/ipdl/PVsyncChild.cpp:187:54
    #24 0x7f4956679f2b in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) objdir-ff-ubsan/ipc/ipdl/PBackgroundChild.cpp:5876:32
    #25 0x7f4955e1c0db in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) ipc/glue/MessageChannel.cpp:2212:25
    #26 0x7f4955e17527 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) ipc/glue/MessageChannel.cpp:2134:9
    #27 0x7f4955e190a3 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) ipc/glue/MessageChannel.cpp:1973:3
    #28 0x7f4955e19fe8 in mozilla::ipc::MessageChannel::MessageTask::Run() ipc/glue/MessageChannel.cpp:2004:13
    #29 0x7f4954a23f44 in nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp:1241:14
    #30 0x7f4954a2aa6e in NS_ProcessNextEvent(nsIThread*, bool) xpcom/threads/nsThreadUtils.cpp:486:10
    #31 0x7f4955e28cae in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:87:21
    #32 0x7f4955c6ae64 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:290:3
    #33 0x7f495d1e07fa in nsBaseAppShell::Run() widget/nsBaseAppShell.cpp:137:27
    #34 0x7f49612dbe29 in XRE_RunAppShell() toolkit/xre/nsEmbedFunctions.cpp:946:20
    #35 0x7f4955e2a2c1 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) ipc/glue/MessagePump.cpp:237:9
    #36 0x7f4955c6ae64 in MessageLoop::Run() ipc/chromium/src/base/message_loop.cc:290:3
    #37 0x7f49612db277 in XRE_InitChildProcess(int, char**, XREChildData const*) toolkit/xre/nsEmbedFunctions.cpp:781:34
    #38 0x560759ce71c5 in content_process_main(mozilla::Bootstrap*, int, char**) browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #39 0x560759ce73ef in main browser/app/nsBrowserApp.cpp:303:18

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/pBSDZTw74LTTAJ5clk010A/index.html

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:heycam, could you have a look please?

For more information, please visit auto_nag documentation.