Open Bug 1665826 Opened 3 years ago Updated 5 months ago

Stack-overflow /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3578 in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, i

Categories

(Core :: Layout: Grid, defect)

Product:
Core
Component:
Layout: Grid
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox82 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: bugmon, crash, testcase, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(1 file)

testcase.html
369 bytes, text/html
Details

Testcase fond while fuzzing mozilla-central rev 084477976b2d.

==8689==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd424e1fe8 (pc 0x7ffb7b0ad68b bp 0x7ffd424e2140 sp 0x7ffd424e1fe0 T0)
    #0 0x7ffb7b0ad68b in nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, gfxContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int, int) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5622
    #1 0x7ffb7b2cec83 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5147:18
    #2 0x7ffb7b2c5496 in MaxContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5320:15
    #3 0x7ffb7b2c449f in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5494:14
    #4 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
    #5 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
    #6 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
    #7 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
    #8 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
    #9 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
    #10 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
    #11 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
    #12 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
    #13 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
    #14 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
    #15 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
    #16 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
    #17 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
    #18 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
    #19 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
    #20 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
    #21 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
    #22 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
    #23 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
    #24 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
    #25 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
    #26 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
    #27 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
    #28 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
    #29 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
    #30 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
    #31 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
    #32 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
    #33 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
    #34 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
    #35 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
    #36 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
    #37 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
    #38 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
    #39 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
    #40 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
    #41 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3
    #42 0x7ffb7b2aa375 in nsGridContainerFrame::GridReflowInput::CalculateTrackSizesForAxis(mozilla::LogicalAxis, nsGridContainerFrame::Grid const&, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3642:12
    #43 0x7ffb7b2a8cfa in nsGridContainerFrame::UsedTrackSizes::ResolveSubgridTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, nsGridContainerFrame::Subgrid*, gfxContext&, int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3584:9
    #44 0x7ffb7b2a8588 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp
    #45 0x7ffb7b2a83b9 in nsGridContainerFrame::UsedTrackSizes::ResolveTrackSizesForAxis(nsGridContainerFrame*, mozilla::LogicalAxis, gfxContext&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:3552:16
    #46 0x7ffb7b2cefa1 in ContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, mozilla::Maybe<mozilla::LogicalSize> const&, nsLayoutUtils::IntrinsicISizeType, int, unsigned int) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5178:12
    #47 0x7ffb7b2c51a6 in MinContentContribution(nsGridContainerFrame::GridItemInfo const&, nsGridContainerFrame::GridReflowInput const&, gfxContext*, mozilla::WritingMode, mozilla::LogicalAxis, CachedIntrinsicSizes*) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5301:15
    #48 0x7ffb7b2c440c in nsGridContainerFrame::Tracks::ResolveIntrinsicSizeStep1(nsGridContainerFrame::GridReflowInput&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::SizingConstraint, nsGridContainerFrame::LineRange const&, nsGridContainerFrame::GridItemInfo const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5469:13
    #49 0x7ffb7b2bf6c5 in nsGridContainerFrame::Tracks::ResolveIntrinsicSize(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, int, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:6133:11
    #50 0x7ffb7b2ac325 in nsGridContainerFrame::Tracks::CalculateSizes(nsGridContainerFrame::GridReflowInput&, nsTArray<nsGridContainerFrame::GridItemInfo>&, nsGridContainerFrame::TrackSizingFunctions const&, int, nsGridContainerFrame::LineRange nsGridContainerFrame::GridArea::*, nsGridContainerFrame::SizingConstraint) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:5410:3

SUMMARY: AddressSanitizer: stack-overflow /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5622 in nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, gfxContext*, nsIFrame*, nsLayoutUtils::IntrinsicISizeType, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int, int)
Flags: in-testsuite?
Attached file testcase.html —

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200917142508-084477976b2d.
Failed to bisect testcase (Start build crashes!):

Start: e8b7c48d4e7ed1b63aeedff379b51e566ea499d9 (20191107015224)
End: 084477976b2d82a2622bc8ecda5a8e72be8b1d9e (20200917142508)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=False, coverage=False, valgrind=False)

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.