Stack-overflow /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3578 in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, i
Categories
(Core :: Layout: Grid, defect)
Tracking
()
People
(Reporter: jkratzer, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: crash, testcase, Whiteboard: [bugmon:bisected,confirmed][fuzzblocker])
Crash Data
Attachments
(2 files)
Testcase fond while fuzzing mozilla-central rev 084477976b2d.
==8689==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd424e1fe8 (pc 0x7ffb7b0ad68b bp 0x7ffd424e2140 sp 0x7ffd424e1fe0 T0)
#0 0x7ffb7b0ad68b in nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, gfxContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int, int) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5622
#1 0x7ffb7b2cec83 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5147:18
#2 0x7ffb7b2c5496 in MaxContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5320:15
#3 0x7ffb7b2c449f in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5494:14
#4 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
#5 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
#6 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
#7 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
#8 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
#9 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
#10 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
#11 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
#12 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
#13 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
#14 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
#15 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
#16 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
#17 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
#18 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
#19 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
#20 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
#21 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
#22 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
#23 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
#24 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
#25 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
#26 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
#27 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
#28 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
#29 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
#30 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
#31 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
#32 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
#33 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
#34 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
#35 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
#36 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
#37 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
#38 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
#39 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
#40 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
#41 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
#42 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
#43 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
#44 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
#45 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
#46 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
#47 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
#48 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
#49 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
#50 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
SUMMARY: AddressSanitizer: stack-overflow /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5622 in nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, gfxContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int, int)
Reporter | ||
Comment 1•4 years ago
|
||
Comment 2•4 years ago
|
||
Reporter | ||
Comment 3•4 years ago
|
||
Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200917142508-084477976b2d.
Failed to bisect testcase (Start build crashes!):
Start: e8b7c48d4e7ed1b63aeedff379b51e566ea499d9 (20191107015224)
End: 084477976b2d82a2622bc8ecda5a8e72be8b1d9e (20200917142508)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=False, coverage=False, valgrind=False)
Updated•2 years ago
|
Comment 4•1 year ago
|
||
Bugmon was unable reproduce this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Comment 5•1 year ago
|
||
There has been a major spike in reports of this bug from the DOM fuzzers beginning on May 31 (20230531-0ea1f0bff41a).
dholbert: Is there anyone available to have a look at this issue?
Comment 6•1 year ago
|
||
I can take a look or find someone to.
Comment 7•1 year ago
|
||
Comment 8•1 year ago
|
||
I think this is actually a dupe of bug 1612963. This is a stack overflow involving nested orthogonal writing-mode subgrids, with infinite recursion in ResolveSubgridTrackSizesForAxis
.
Duping to that bug since there's a bit more discussion/analysis over there.
Updated•1 year ago
|
Reporter | ||
Comment 9•1 year ago
|
||
A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.
Comment 10•1 year ago
|
||
No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Description
•