1658756 - AddressSanitizer: SEGV /builds/worker/checkouts/gecko/layout/generic/nsFrameList.cpp in nsFrameList::RemoveFrame(nsIFrame*)

Status: RESOLVED DUPLICATE of bug 1421053

(Core :: Layout: Block and Inline, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 08471023c834.

==20458==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8e9a12ebe6 bp 0x7fff29b233b0 sp 0x7fff29b23380 T0)
==20458==The signal is caused by a READ memory access.
==20458==Hint: address points to the zero page.
    #0 0x7f8e9a12ebe5 in nsFrameList::RemoveFrame(nsIFrame*) /builds/worker/checkouts/gecko/layout/generic/nsFrameList.cpp
    #1 0x7f8e9a12f2ad in nsFrameList::DestroyFrame(nsIFrame*) /builds/worker/checkouts/gecko/layout/generic/nsFrameList.cpp:120:3
    #2 0x7f8e9a0a914c in nsBlockFrame::DoRemoveOutOfFlowFrame(nsIFrame*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:5849:42
    #3 0x7f8e9a0a8914 in nsBlockFrame::RemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:5584:5
    #4 0x7f8e9a2ed510 in nsPlaceholderFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&) /builds/worker/checkouts/gecko/layout/generic/nsPlaceholderFrame.cpp:181:11
    #5 0x7f8e9a0d684e in Destroy /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h:739:5
    #6 0x7f8e9a0d684e in nsContainerFrame::RemoveFrame(mozilla::layout::FrameChildListID, nsIFrame*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:170:19
    #7 0x7f8e99f42cd1 in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7581:5
    #8 0x7f8e99f37a6a in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8565:7
    #9 0x7f8e99ed4a87 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1484:25
    #10 0x7f8e99edf07c in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3037:9
    #11 0x7f8e99e9fe41 in ProcessPendingRestyles /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3116:3
    #12 0x7f8e99e9fe41 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4195:39
    #13 0x7f8e99e2d317 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2112:22
    #14 0x7f8e99e3a739 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:373:13
    #15 0x7f8e99e3a739 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:352:7
    #16 0x7f8e99e3a3b1 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:5
    #17 0x7f8e99e49412 in RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:819:5
    #18 0x7f8e99e49412 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:737:16
    #19 0x7f8e99e489f0 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:639:7
    #20 0x7f8e99e378f2 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:538:20
    #21 0x7f8e912c77f9 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:242:16
    #22 0x7f8e912c3ce5 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:512:26
    #23 0x7f8e912c1ba2 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:371:15
    #24 0x7f8e912c1fdf in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:168:36
    #25 0x7f8e912d3601 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:83:37
    #26 0x7f8e912d3601 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #27 0x7f8e912f86bc in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1234:14
    #28 0x7f8e913035ac in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #29 0x7f8e926da3df in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #30 0x7f8e925bac27 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #31 0x7f8e925bac27 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #32 0x7f8e925bac27 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #33 0x7f8e99958db8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #34 0x7f8e9d550c56 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #35 0x7f8e925bac27 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #36 0x7f8e925bac27 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #37 0x7f8e925bac27 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #38 0x7f8e9d55023f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #39 0x5585e2827433 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #40 0x5585e2827433 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
    #41 0x7f8eb54d5b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/checkouts/gecko/layout/generic/nsFrameList.cpp in nsFrameList::RemoveFrame(nsIFrame*)

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200812155527-fb8518702f1b.
Failed to bisect testcase (Start build crashes!):
> Start: e8b7c48d4e7ed1b63aeedff379b51e566ea499d9 (20191107015224)
> End: 08471023c834ba75bb85d0e92e3d24bf1324b883 (20200812034418)
> BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=False, coverage=False, valgrind=False)

Comment 3

[Jason Kratzer [:jkratzer]]

Bugmon Analysis
No valid actions for resolution (DUPLICATE)
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.