1618312 - AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:332:3 in MOZ_Crash

Reporter

Description

•

3 years ago

Attached file testcase.html — Details

Testcase found while fuzzing mozilla-central rev 7f41334e1044.

==29752==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f444ee7f470 bp 0x7ffcb19ba460 sp 0x7ffcb19ba460 T0)
==29752==The signal is caused by a WRITE memory access.
==29752==Hint: address points to the zero page.
    #0 0x7f444ee7f46f in MOZ_Crash /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:332:3
    #1 0x7f444ee7f46f in InvalidArrayIndex_CRASH(unsigned long, unsigned long) /builds/worker/workspace/build/src/xpcom/ds/nsTArray.cpp:27:3
    #2 0x7f4457b691ff in nsTArray_Impl<nsGridContainerFrame::TrackSize, nsTArrayInfallibleAllocator>::ElementAt(unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1061:7
    #3 0x7f4457ad590b in operator[] /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1097:53
    #4 0x7f4457ad590b in CopyUsedTrackSizes(nsTArray<nsGridContainerFrame::TrackSize>&, nsGridContainerFrame const*, nsGridContainerFrame::UsedTrackSizes const*, nsGridContainerFrame const*, nsGridContainerFrame::Subgrid const*, mozilla::LogicalAxis) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:3274:22
    #5 0x7f4457ad6d68 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, SizingConstraint) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:3379:7
    #6 0x7f4457b0871f in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:7388:21
    #7 0x7f44579b7cc4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:906:14
    #8 0x7f4457a98de8 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:653:3
    #9 0x7f4457a9a675 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:767:3
    #10 0x7f4457a9e762 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:1154:3
    #11 0x7f445795e7d2 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, nsOverflowAreas*) /builds/worker/workspace/build/src/layout/generic/nsAbsoluteContainingBlock.cpp:761:14
    #12 0x7f445795b830 in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsOverflowAreas*) /builds/worker/workspace/build/src/layout/generic/nsAbsoluteContainingBlock.cpp:212:7
    #13 0x7f4457b070c9 in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, mozilla::ReflowOutput&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:7116:37
    #14 0x7f4457b08dd1 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:7455:11
    #15 0x7f44579b7cc4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:906:14
    #16 0x7f4457a98de8 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:653:3
    #17 0x7f4457a9a675 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:767:3
    #18 0x7f4457a9e762 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:1154:3
    #19 0x7f445795e7d2 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, nsOverflowAreas*) /builds/worker/workspace/build/src/layout/generic/nsAbsoluteContainingBlock.cpp:761:14
    #20 0x7f445795b830 in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsOverflowAreas*) /builds/worker/workspace/build/src/layout/generic/nsAbsoluteContainingBlock.cpp:212:7
    #21 0x7f4457b070c9 in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, mozilla::ReflowOutput&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:7116:37
    #22 0x7f4457b08dd1 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGridContainerFrame.cpp:7455:11
    #23 0x7f44579b7cc4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:906:14
    #24 0x7f44579b6d3b in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsCanvasFrame.cpp:750:5
    #25 0x7f44579b7cc4 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:906:14
    #26 0x7f4457a98de8 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:653:3
    #27 0x7f4457a9a675 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:767:3
    #28 0x7f4457a9e762 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/nsGfxScrollFrame.cpp:1154:3
    #29 0x7f445795a3e1 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:946:14
    #30 0x7f4457959980 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:299:7
    #31 0x7f445777b919 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9241:11
    #32 0x7f445778eb77 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:9414:24
    #33 0x7f445778d3ed in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:4126:11
    #34 0x7f445771bae9 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:2061:20
    #35 0x7f445772a986 in TickDriver /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:374:13
    #36 0x7f445772a986 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:351:7
    #37 0x7f445772a51c in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:368:5
    #38 0x7f4457729502 in RunRefreshDrivers /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:825:5
    #39 0x7f4457729502 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:743:16
    #40 0x7f44577288a3 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:642:9
    #41 0x7f4457e9fce9 in mozilla::layout::VsyncChild::RecvNotify(mozilla::VsyncEvent const&) /builds/worker/workspace/build/src/layout/ipc/VsyncChild.cpp:64:16
    #42 0x7f4450f2caf0 in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:187:54
    #43 0x7f4450960d60 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:5806:32
    #44 0x7f44501f9ff2 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2214:25
    #45 0x7f44501f51fa in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2136:9
    #46 0x7f44501f76ff in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1975:3
    #47 0x7f44501f8600 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2006:13
    #48 0x7f444efa4c98 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1220:14
    #49 0x7f444efafafc in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:481:10
    #50 0x7f4450205e9f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:87:21
    #51 0x7f44500f90c7 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #52 0x7f44500f90c7 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #53 0x7f44500f90c7 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #54 0x7f445728d3d8 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #55 0x7f445adc03c6 in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:944:20
    #56 0x7f44500f90c7 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #57 0x7f44500f90c7 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #58 0x7f44500f90c7 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #59 0x7f445adbf989 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:779:34
    #60 0x561910ad6433 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #61 0x561910ad6433 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:303:18
    #62 0x7f4471b79b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:332:3 in MOZ_Crash

Flags: in-testsuite?

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

3 years ago

BugMon: Verified bug as reproducible on 94c8f28a15e8a051aeaad4722deb3fcc8125dab2

Jason Kratzer [:jkratzer]

Reporter

Comment 2

•

3 years ago

BugMon: Reduced build range to...
> Start: a5f7f53421ebce84b0dd4cb3535b49906fdf78ef (20190522152501)
> End: aaae630f30291056f4f40bbd9e12a917309e401e (20190522152821)
> Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a5f7f53421ebce84b0dd4cb3535b49906fdf78ef&tochange=aaae630f30291056f4f40bbd9e12a917309e401e

Jason Kratzer [:jkratzer]

Reporter

Updated

•

3 years ago

Whiteboard: [jsbugmon:confirm] → [jsbugmon:confirmed]

Boris Chiou [:boris]

Updated

•

3 years ago

Priority: -- → P3

Mats Palmgren (inactive)

Assignee

Comment 3

•

3 years ago

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b989ada18cd8fdb6ffa351caadf25495550058e8

Assignee: nobody → mats

Mats Palmgren (inactive)

Assignee

Comment 4

•

3 years ago

Attached file Bug 1618312 - [css-grid] Use the outermost frame to check the computed `position` value since we don't inherit that to anonymous frames. r=dholbert — Details

Phabricator Automation

Updated

•

3 years ago

Attachment #9129927 - Attachment description: Bug 1618312 - Use the outermost frame to check the computed `position` value since we don't inherit that to anonymous frames. r=dholbert → Bug 1618312 - [css-grid] Use the outermost frame to check the computed `position` value since we don't inherit that to anonymous frames. r=dholbert

Pulsebot

Comment 5

•

3 years ago

Pushed by mpalmgren@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/ce295f8ded7e
[css-grid] Use the outermost frame to check the computed `position` value since we don't inherit that to anonymous frames.  r=dholbert

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Comment 6

•

3 years ago

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/22050 for changes under testing/web-platform/tests

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Updated

•

3 years ago

Whiteboard: [jsbugmon:confirmed] → [jsbugmon:confirmed], [wptsync upstream]

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Comment 7

•

3 years ago

Can't merge web-platform-tests PR due to failing upstream checks:
Github PR https://github.com/web-platform-tests/wpt/pull/22050
* Community-TC (pull_request) (https://community-tc.services.mozilla.com/tasks/groups/ESBRv6v3SxKhy2PglPshPw)

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Updated

•

3 years ago

Flags: needinfo?(mats)

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Updated

•

3 years ago

Whiteboard: [jsbugmon:confirmed], [wptsync upstream] → [jsbugmon:confirmed], [wptsync upstream error]

Bogdan Tara[:bogdan_tara | bogdant]

Comment 8

•

3 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/ce295f8ded7e

Status: NEW → RESOLVED

Closed: 3 years ago

status-firefox75: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla75

Mats Palmgren (inactive)

Assignee

Updated

•

3 years ago

Flags: needinfo?(mats)

Ryan VanderMeulen [:RyanVM]

Updated

•

3 years ago

status-firefox73: --- → unaffected

status-firefox74: --- → wontfix

status-firefox-esr68: --- → unaffected

Flags: in-testsuite? → in-testsuite+

Regressed by: 1606516

BMO Automation

Updated

•

3 years ago

Has Regression Range: --- → yes

Release mgmt bot [:suhaib / :marco/ :calixte]

Updated

•

3 years ago

Keywords: regression

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Updated

•

3 years ago

Whiteboard: [jsbugmon:confirmed], [wptsync upstream error] → [jsbugmon:confirmed], [wptsync upstream]

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Comment 9

•

3 years ago

Upstream PR merged by jgraham

testcase.html 3 years ago Jason Kratzer [:jkratzer] 404 bytes, text/html		Details
Bug 1618312 - [css-grid] Use the outermost frame to check the computed `position` value since we don't inherit that to anonymous frames. r=dholbert 3 years ago Mats Palmgren (inactive) 47 bytes, text/x-phabricator-request		Details \| Review

Bugzilla

Quick Search

AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:332:3 in MOZ_Crash

Categories

(Core :: Layout: Grid, defect, P3)

Tracking

()

People

(Reporter: jkratzer, Assigned: MatsPalmgren_bugz)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: crash, regression, testcase, Whiteboard: [jsbugmon:confirmed], [wptsync upstream])

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Comment 2

Updated

Updated

Comment 3

Comment 4

Updated

Comment 5

Comment 6

Updated

Comment 7

Updated

Updated

Comment 8

Updated

Updated

Updated

Updated

Updated

Comment 9