1707636 - AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/FrameTypeList.h:59:1 in IsLetterFrame

Status: NEW

(Core :: Layout, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 289e41464376 (built with --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 289e41464376 --asan --fuzzing -n build
$ python -m grizzly.replay --xvfb ./build/firefox ./testcase.html

==2635920==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000006d (pc 0x7fc6d6d2c5da bp 0x7ffc036ebc70 sp 0x7ffc036eb8e0 T0)
==2635920==The signal is caused by a READ memory access.
==2635920==Hint: address points to the zero page.
    #0 0x7fc6d6d2c5da in IsLetterFrame /builds/worker/workspace/obj-build/dist/include/mozilla/FrameTypeList.h:59:1
    #1 0x7fc6d6d2c5da in nsBidiPresUtils::TraverseFrames(nsIFrame*, BidiParagraphData*) /builds/worker/checkouts/gecko/layout/base/nsBidiPresUtils.cpp:1174:22
    #2 0x7fc6d6d2adcd in nsBidiPresUtils::Resolve(nsBlockFrame*) /builds/worker/checkouts/gecko/layout/base/nsBidiPresUtils.cpp:840:5
    #3 0x7fc6d6e7c7a1 in ResolveBidi /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7755:10
    #4 0x7fc6d6e7c7a1 in nsBlockFrame::GetMinISize(gfxContext*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:773:5
    #5 0x7fc6d6dcbf94 in nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, gfxContext*, nsIFrame*, mozilla::IntrinsicISizeType, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int, int) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp
    #6 0x7fc6d6dcf7bc in nsLayoutUtils::IntrinsicForContainer(gfxContext*, nsIFrame*, mozilla::IntrinsicISizeType, unsigned int) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5061:10
    #7 0x7fc6d6f140e4 in nsFlexContainerFrame::IntrinsicISize(gfxContext*, mozilla::IntrinsicISizeType) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:5657:28
    #8 0x7fc6d6f14310 in nsFlexContainerFrame::GetMinISize(gfxContext*) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:5690:15
    #9 0x7fc6d6dcbf94 in nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, gfxContext*, nsIFrame*, mozilla::IntrinsicISizeType, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int, int) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp
    #10 0x7fc6d6dcf7bc in nsLayoutUtils::IntrinsicForContainer(gfxContext*, nsIFrame*, mozilla::IntrinsicISizeType, unsigned int) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5061:10
    #11 0x7fc6d6f140e4 in nsFlexContainerFrame::IntrinsicISize(gfxContext*, mozilla::IntrinsicISizeType) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:5657:28
    #12 0x7fc6d6f14310 in nsFlexContainerFrame::GetMinISize(gfxContext*) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:5690:15
    #13 0x7fc6d6dcbf94 in nsLayoutUtils::IntrinsicForAxis(mozilla::PhysicalAxis, gfxContext*, nsIFrame*, mozilla::IntrinsicISizeType, mozilla::Maybe<mozilla::LogicalSize> const&, unsigned int, int) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp
    #14 0x7fc6d6dcf7bc in nsLayoutUtils::IntrinsicForContainer(gfxContext*, nsIFrame*, mozilla::IntrinsicISizeType, unsigned int) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5061:10
    #15 0x7fc6d70c3345 in nsPlaceholderFrame::AddInlineMinISize(gfxContext*, nsIFrame::InlineMinISizeData*) /builds/worker/checkouts/gecko/layout/generic/nsPlaceholderFrame.cpp:79:26
    #16 0x7fc6d6e7ca9f in nsBlockFrame::GetMinISize(gfxContext*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:806:16
    #17 0x7fc6d6ec56f1 in nsColumnSetFrame::GetMinISize(gfxContext*) /builds/worker/checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:437:35
    #18 0x7fc6d6e2db85 in mozilla::ColumnSetWrapperFrame::GetMinISize(gfxContext*) /builds/worker/checkouts/gecko/layout/generic/ColumnSetWrapperFrame.cpp:181:34
    #19 0x7fc6d6ede141 in ShrinkWidthToFit /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:6460:22
    #20 0x7fc6d6ede141 in nsContainerFrame::ComputeAutoSize(gfxContext*, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::StyleSizeOverrides const&, mozilla::EnumSet<mozilla::ComputeSizeFlag, unsigned char>) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:917:11
    #21 0x7fc6d6eeeb35 in nsIFrame::ComputeSize(gfxContext*, mozilla::WritingMode, mozilla::LogicalSize const&, int, mozilla::LogicalSize const&, mozilla::LogicalSize const&, mozilla::StyleSizeOverrides const&, mozilla::EnumSet<mozilla::ComputeSizeFlag, unsigned char>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:6093:7
    #22 0x7fc6d6ef848e in nsFlexContainerFrame::ResolveAutoFlexBasisAndMinSize(nsFlexContainerFrame::FlexItem&, mozilla::ReflowInput const&, nsFlexContainerFrame::FlexboxAxisTracker const&, bool) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:1683:54
    #23 0x7fc6d6ef56f5 in nsFlexContainerFrame::GenerateFlexItemForChild(nsFlexContainerFrame::FlexLine&, nsIFrame*, mozilla::ReflowInput const&, nsFlexContainerFrame::FlexboxAxisTracker const&, bool) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:1530:3
    #24 0x7fc6d6f07090 in nsFlexContainerFrame::GenerateFlexLines(mozilla::ReflowInput const&, int, nsTArray<nsFlexContainerFrame::StrutInfo> const&, nsFlexContainerFrame::FlexboxAxisTracker const&, int, bool, nsTArray<nsIFrame*>&, nsTArray<nsFlexContainerFrame::FlexLine>&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:4111:7
    #25 0x7fc6d6f0cade in nsFlexContainerFrame::DoFlexLayout(mozilla::ReflowInput const&, int&, int&, int&, nsTArray<nsFlexContainerFrame::FlexLine>&, nsTArray<nsFlexContainerFrame::StrutInfo>&, nsTArray<nsIFrame*>&, nsFlexContainerFrame::FlexboxAxisTracker const&, int, int, int, bool, ComputedFlexContainerInfo*) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:5017:3
    #26 0x7fc6d6f0aa80 in nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:4540:5
    #27 0x7fc6d6ede64f in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1001:14
    #28 0x7fc6d6ebd947 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:818:7
    #29 0x7fc6d6ede64f in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1001:14
    #30 0x7fc6d6f519ae in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:758:3
    #31 0x7fc6d6f5330c in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:881:3
    #32 0x7fc6d6f59328 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:1300:3
    #33 0x7fc6d6eded96 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1041:14
    #34 0x7fc6d6e72320 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:372:7
    #35 0x7fc6d6cb72c4 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9597:11
    #36 0x7fc6d6cc8237 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9768:24
    #37 0x7fc6d6cc6a9d in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4245:11
    #38 0x7fc6d6c57e2e in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1406:5
    #39 0x7fc6d6c57e2e in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2216:20
    #40 0x7fc6d6c63d85 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:346:13
    #41 0x7fc6d6c63d85 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:324:7
    #42 0x7fc6d6c63aed in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:340:5
    #43 0x7fc6d6c62ff1 in RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:773:5
    #44 0x7fc6d6c62ff1 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:702:16
    #45 0x7fc6d6c625ad in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:615:7
    #46 0x7fc6d6c61d31 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:536:9
    #47 0x7fc6d5ebfbc7 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncChild.cpp:68:15
    #48 0x7fc6d09e6c8c in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
    #49 0x7fc6d0673622 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6008:32
    #50 0x7fc6d010c3ba in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2152:25
    #51 0x7fc6d0108a6e in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2076:9
    #52 0x7fc6d010a428 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1924:3
    #53 0x7fc6d010af8b in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1955:13
    #54 0x7fc6ceef1f8a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:473:16
    #55 0x7fc6ceebe4f0 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:757:26
    #56 0x7fc6ceebc027 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:612:15
    #57 0x7fc6ceebc47d in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:396:36
    #58 0x7fc6ceefb071 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:135:37
    #59 0x7fc6ceefb071 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:534:5
    #60 0x7fc6ceed9163 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
    #61 0x7fc6ceee40ec in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #62 0x7fc6d0113cef in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #63 0x7fc6d001e541 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #64 0x7fc6d001e541 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #65 0x7fc6d001e541 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #66 0x7fc6d6787317 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #67 0x7fc6da29a58f in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:906:20
    #68 0x7fc6d001e541 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #69 0x7fc6d001e541 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #70 0x7fc6d001e541 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #71 0x7fc6da299e1f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:738:34
    #72 0x55d2fb90120d in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #73 0x55d2fb901631 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:309:18
    #74 0x7fc6ef5600b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/FrameTypeList.h:59:1 in IsLetterFrame

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210426213158-6f8320a4798f.
The bug appears to have been introduced in the following build range:

Start: 416a44f9c59de1a40b59717e3ee33d1b4677b32e (20200908012258)
End: 90bf9d8e0b52a8dbd137a0bf7f5d57d81cc3eb80 (20200908060020)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=416a44f9c59de1a40b59717e3ee33d1b4677b32e&tochange=90bf9d8e0b52a8dbd137a0bf7f5d57d81cc3eb80

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Do you have a pernosco trace I could look at by chance? Thanks!

Comment 3

[Jason Kratzer [:jkratzer]]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #2)

Do you have a pernosco trace I could look at by chance? Thanks!

Sorry for the delay. You can find a pernosco session for this bug at the following URL:
https://pernos.co/debug/Pc8aZl2wMKkJ9EFZRih3xQ/index.html

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Thanks!

Comment 5

[Emilio Cobos Álvarez (:emilio)]

So we have an overflow continuation that we remove, but its placeholder is still in a previous continuation. Ting-Yu, do you happen to have cycles to take a look?

Comment 6

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

Loading the testcase in normal debug build, there are some extreme block-size on FlexContainer and ColumnSet (the style has a large border-top) before the crash. I'm not surprised that this may lead to an incorrect fragmentation. The testcase doesn't crash immediately in Nightly, so this extreme case is unlikely to affect real sites. I'll set S3 for now.

nsBlockReflowContext: FlexContainer(span)(0)@7f1558ff78b0 metrics=36663,1073741823!
nsBlockReflowContext: FlexContainer(span)(0)@7f1558ff78b0 metrics=36663,1073741823!
nsBlockReflowContext: ColumnSet(details)(2)@7f1558ff7570 metrics=74286,1073741823!
[Child 8382, Main Thread] ###!!! ASSERTION: frame tree not empty, but caller reported complete status: 'aSubtreeRoot->GetPrevInFlow()', file /home/aethanyc/Projects/gecko/layout/base/nsLayoutUtils.cpp:7309

Also, the regression range is wrong because the testcase uses InspectorUtils, which doesn't defined in debug build, but it can still crash. I use mozregression -b 2021-04-01 -g 2020-09-10 -B debug --arg='-layoutdebug', which finds bug 1676966. Setting gfx.font_rendering.fallback.async=false does prevent the testcase from crashing. Maybe the garbled small.innerText change layout somehow after loading the fonts asynchronously?

Comment 7

[Daniel Holbert [:dholbert]]

FWIW: on my machine with official Firefox Nightly 90.0a1 (2021-05-11), the attached testcase crashes with signature [@ nsFrameManager::CaptureFrameState ].

The backtrace shows nsDocShell::InternalLoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>) calling into mozilla::PresShell::CaptureHistoryState(nsILayoutHistoryState**) which then calls into 11 stack-levels of nsFrameManager::CaptureFrameState(nsIFrame*, nsILayoutHistoryState*), and the innermost stack level crashes with a null deref, in a way that looks like we've called CaptureFrameState() with a null aFrame pointer.

My crash reports:
bp-cfb85c9e-2deb-4d20-bcee-68c180210511
bp-02c35071-db23-49c8-9ed5-c0f590210511
bp-ac86f7a8-65d5-4a47-a40a-18d800210511
bp-347c2dd0-687d-44a6-88b3-5ec940210511
bp-dc281716-4c90-4f53-8637-0eb060210511

Comment 8

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
The bug appears to have been fixed in the following build range:

Start: 735ba5802dabbe739a1f6ede60ec052bd17a5008 (20210622000835)
End: 064d1e04ff9f5ddac8fe0889f84106489e15ce13 (20210622024419)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=735ba5802dabbe739a1f6ede60ec052bd17a5008&tochange=064d1e04ff9f5ddac8fe0889f84106489e15ce13
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.