1674011 - crash near null in [@ mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered], with `column-span: all`

Status: VERIFIED FIXED

(Core :: Layout: Columns, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

==387082==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000006d (pc 0x7fd72629b13f bp 0x7ffd078a5210 sp 0x7ffd078a5120 T0)
==387082==The signal is caused by a READ memory access.
==387082==Hint: address points to the zero page.
    #0 0x7fd72629b13f in IsPlaceholderFrame /builds/worker/workspace/obj-build/dist/include/mozilla/FrameTypeList.h:79:1
    #1 0x7fd72629b13f in mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) src/layout/base/DisplayPortUtils.cpp:962:15
    #2 0x7fd72629b170 in mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) src/layout/base/DisplayPortUtils.cpp:964:9
    #3 0x7fd72629b338 in mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) src/layout/base/DisplayPortUtils.cpp:989:9
    #4 0x7fd72629b338 in mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) src/layout/base/DisplayPortUtils.cpp:989:9
    #5 0x7fd72629b338 in mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) src/layout/base/DisplayPortUtils.cpp:989:9
    #6 0x7fd72629b338 in mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) src/layout/base/DisplayPortUtils.cpp:989:9
    #7 0x7fd72629b338 in mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) src/layout/base/DisplayPortUtils.cpp:989:9
    #8 0x7fd72629b338 in mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) src/layout/base/DisplayPortUtils.cpp:989:9
    #9 0x7fd72629b338 in mozilla::DisplayPortUtils::MaybeCreateDisplayPortInFirstScrollFrameEncountered(nsIFrame*, nsDisplayListBuilder*) src/layout/base/DisplayPortUtils.cpp:989:9
    #10 0x7fd7263e071b in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) src/layout/base/nsLayoutUtils.cpp:3238:5
    #11 0x7fd7262ea240 in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) src/layout/base/PresShell.cpp:6360:5
    #12 0x7fd725ca703e in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) src/view/nsViewManager.cpp:460:18
    #13 0x7fd725ca66ae in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/nsViewManager.cpp:395:22
    #14 0x7fd725ca90bc in nsViewManager::ProcessPendingUpdates() src/view/nsViewManager.cpp:1018:5
    #15 0x7fd726260cb9 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:2382:11
    #16 0x7fd72626d6b9 in TickDriver src/layout/base/nsRefreshDriver.cpp:374:13
    #17 0x7fd72626d6b9 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) src/layout/base/nsRefreshDriver.cpp:353:7
    #18 0x7fd72626d331 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:368:5
    #19 0x7fd72626c544 in RunRefreshDrivers src/layout/base/nsRefreshDriver.cpp:829:5
    #20 0x7fd72626c544 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) src/layout/base/nsRefreshDriver.cpp:747:16
    #21 0x7fd72626c07f in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NormalPriorityNotify() src/layout/base/nsRefreshDriver.cpp:663:9
    #22 0x7fd72626c9cf in applyImpl<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1188:12
    #23 0x7fd72626c9cf in apply<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1194:12
    #24 0x7fd72626c9cf in mozilla::detail::RunnableMethodImpl<mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver*, void (mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1240:13
    #25 0x7fd71dd37f89 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:245:16
    #26 0x7fd71dd34a77 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:515:26
    #27 0x7fd71dd32917 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:374:15
    #28 0x7fd71dd32d6d in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:171:36
    #29 0x7fd71dd3f851 in operator() src/xpcom/threads/TaskController.cpp:85:37
    #30 0x7fd71dd3f851 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #31 0x7fd71dd5f2fb in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1197:14
    #32 0x7fd71dd69ffc in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:513:10
    #33 0x7fd71f04298f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
    #34 0x7fd71ef44641 in RunInternal src/ipc/chromium/src/base/message_loop.cc:334:10
    #35 0x7fd71ef44641 in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
    #36 0x7fd71ef44641 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
    #37 0x7fd725d540f7 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
    #38 0x7fd729a84e1f in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #39 0x7fd71ef44641 in RunInternal src/ipc/chromium/src/base/message_loop.cc:334:10
    #40 0x7fd71ef44641 in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
    #41 0x7fd71ef44641 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
    #42 0x7fd729a843bc in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #43 0x5649301a1d3d in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #44 0x5649301a2177 in main src/browser/app/nsBrowserApp.cpp:304:18

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/BN7e32wqmTLxKeC92s3aFg/index.html

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201028214727-9b78e4ae32ae.
The bug appears to have been introduced in the following build range:

Start: 6b2ed41d571480f067b6c83a843c417731ad2111 (20200420180549)
End: 06366bae59660d6019a3f5bb08f0c618cf6a2ab9 (20200420180752)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=6b2ed41d571480f067b6c83a843c417731ad2111&tochange=06366bae59660d6019a3f5bb08f0c618cf6a2ab9

Comment 3

[Daniel Holbert [:dholbert]]

TYLin, looks like there might be a column-span crash lurking here (or maybe just a fragmentation bug, exposed by multi-column). Maybe you could take a look?

Comment 4

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Bug 1674011 - Add a wpt crashtest for column-span and float.

Bug 1671527 fixed the test that used to crash the release build.

Depends on D120105

Comment 5

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

(In reply to Daniel Holbert [:dholbert] from comment #3)

TYLin, looks like there might be a column-span crash lurking here (or maybe just a fragmentation bug, exposed by multi-column). Maybe you could take a look?

I finally get a chance to look into this issue, and the fix is posted in bug 1671527.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6c8e299b1eda
Add a wpt crashtest for column-span and float. r=emilio

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/29772 for changes under testing/web-platform/tests

Comment 8

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/6c8e299b1eda

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 10

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210724215146-8117cf719533.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.