Closed Bug 1724237 Opened 3 months ago Closed 2 months ago

Assertion failure: IsAncestorFrameCrossDocInProcess(aAncestor.mFrame, aFrame) (Fix the caller), at /layout/base/nsLayoutUtils.cpp:2597

Categories

(Core :: Layout, defect, P3)

x86_64
Linux
defect

Tracking

()

VERIFIED FIXED
93 Branch
Tracking Status
firefox-esr78 --- unaffected
firefox-esr91 --- unaffected
firefox91 --- unaffected
firefox92 --- fixed
firefox93 --- verified

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files)

Testcase found while fuzzing mozilla-central rev d66e0aca4012 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build d66e0aca4012  --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html
Assertion failure: IsAncestorFrameCrossDocInProcess(aAncestor.mFrame, aFrame) (Fix the caller), at /layout/base/nsLayoutUtils.cpp:2597

    ==1858140==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f65fa5bbee7 bp 0x7ffe39dc8420 sp 0x7ffe39dc8380 T1858140)
    ==1858140==The signal is caused by a WRITE memory access.
    ==1858140==Hint: address points to the zero page.
        #0 0x7f65fa5bbee7 in nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame const*, nsRect const&, mozilla::RelativeTo, bool*, mozilla::Maybe<mozilla::gfx::Matrix4x4TypedFlagged<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> >*, bool, nsIFrame**) /layout/base/nsLayoutUtils.cpp:2596:3
        #1 0x7f65fa5eaca0 in TransformFrameRectToAncestor /layout/base/nsLayoutUtils.h:895:12
        #2 0x7f65fa5eaca0 in BoxToRect::AddBox(nsIFrame*) /layout/base/nsLayoutUtils.cpp:3801:13
        #3 0x7f65fa5c2549 in GetAllInFlowBoxes /layout/base/nsLayoutUtils.cpp:3716:5
        #4 0x7f65fa5c2549 in GetAllInFlowRects /layout/base/nsLayoutUtils.cpp:3860:3
        #5 0x7f65fa5c2549 in nsLayoutUtils::GetAllInFlowRectsUnion(nsIFrame*, nsIFrame const*, unsigned int) /layout/base/nsLayoutUtils.cpp:3900:3
        #6 0x7f65f761f7c0 in ComputeTheIntersection /dom/base/DOMIntersectionObserver.cpp:347:41
        #7 0x7f65f761f7c0 in mozilla::dom::DOMIntersectionObserver::Update(mozilla::dom::Document*, double) /dom/base/DOMIntersectionObserver.cpp:649:26
        #8 0x7f65f77c03a6 in mozilla::dom::Document::UpdateIntersectionObservations(mozilla::TimeStamp) /dom/base/Document.cpp:15520:17
        #9 0x7f65fa4f5cf7 in nsRefreshDriver::UpdateIntersectionObservations(mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:1921:10
        #10 0x7f65fa4f41a8 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2387:3
        #11 0x7f65fa4fbe8a in TickDriver /layout/base/nsRefreshDriver.cpp:348:13
        #12 0x7f65fa4fbe8a in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:326:7
        #13 0x7f65fa4fbda3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:342:5
        #14 0x7f65fa4fbc70 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:771:5
        #15 0x7f65fa4fb30a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:700:16
        #16 0x7f65fa4fac25 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /layout/base/nsRefreshDriver.cpp:617:7
        #17 0x7f65fa4fa6a9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:538:9
        #18 0x7f65f9d0dce6 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncChild.cpp:68:15
        #19 0x7f65f69e9cf4 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
        #20 0x7f65f67b172c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6091:32
        #21 0x7f65f64202a1 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:2051:25
        #22 0x7f65f641cde1 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /ipc/glue/MessageChannel.cpp:1978:9
        #23 0x7f65f641e265 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1826:3
        #24 0x7f65f641edfb in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1857:13
        #25 0x7f65f5b0fc1e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:502:16
        #26 0x7f65f5aed959 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:805:26
        #27 0x7f65f5aec7d8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:641:15
        #28 0x7f65f5aeca53 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:425:36
        #29 0x7f65f5b13489 in operator() /xpcom/threads/TaskController.cpp:138:37
        #30 0x7f65f5b13489 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:532:5
        #31 0x7f65f5aff58f in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1148:16
        #32 0x7f65f5b05ffa in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:466:10
        #33 0x7f65f64260c4 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #34 0x7f65f63809e7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #35 0x7f65f6380902 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #36 0x7f65f6380902 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #37 0x7f65fa220388 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #38 0x7f65fbbd6c83 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:923:20
        #39 0x7f65f642700a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #40 0x7f65f63809e7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #41 0x7f65f6380902 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #42 0x7f65f6380902 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #43 0x7f65fbbd689e in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:755:34
        #44 0x5583d17db9b6 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #45 0x5583d17db9b6 in main /browser/app/nsBrowserApp.cpp:327:18
        #46 0x7f660c5a60b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
        #47 0x5583d17b87bc in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x157bc)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/base/nsLayoutUtils.cpp:2596:3 in nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame const*, nsRect const&, mozilla::RelativeTo, bool*, mozilla::Maybe<mozilla::gfx::Matrix4x4TypedFlagged<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> >*, bool, nsIFrame**)
    ==1858140==ABORTING
Attached file Testcase

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210805092724-d66e0aca4012.
The bug appears to have been introduced in the following build range:

Start: 74375e38baefa4a063b0d3f9087a83321078756b (20210730120448)
End: 0f01ac89ab321792a4f77823c256d9a1fdfb666a (20210730142217)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=74375e38baefa4a063b0d3f9087a83321078756b&tochange=0f01ac89ab321792a4f77823c256d9a1fdfb666a

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Bug 1722968 looks like the most likely culprit in that range.

Severity: -- → S3
Flags: needinfo?(emilio)
Priority: -- → P3
Regressed by: 1722968
Attachment #9234910 - Attachment mime type: text/plain → text/html
Flags: needinfo?(emilio)
Assignee: nobody → emilio
Flags: needinfo?(emilio)
Flags: needinfo?(emilio)
Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/2bb68b925cea
Fix optimization from bug 1722968 to account for when we may dig out of the target subtree for SVG. r=TYLin
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/30139 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]
Status: NEW → RESOLVED
Closed: 2 months ago
Resolution: --- → FIXED
Target Milestone: --- → 93 Branch
Upstream PR merged by moz-wptsync-bot

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210824094724-7857f4c37a92.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon

Is there a user-facing issue from this bug that would warrant uplift consideration or can this fix ride with Fx93?

Flags: needinfo?(emilio)
Flags: in-testsuite+

Comment on attachment 9236828 [details]
Bug 1724237 - Fix optimization from bug 1722968 to account for when we may dig out of the target subtree for SVG. r=#layout-reviewers

Beta/Release Uplift Approval Request

  • User impact if declined: IntersectionObserver on SVG could misbehave.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: none
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Simple low-risk tweak to a recently-introduced optimization.
  • String changes made/needed: none
Flags: needinfo?(emilio)
Attachment #9236828 - Flags: approval-mozilla-beta?

Comment on attachment 9236828 [details]
Bug 1724237 - Fix optimization from bug 1722968 to account for when we may dig out of the target subtree for SVG. r=#layout-reviewers

Approved for 92.0b9.

Attachment #9236828 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Blocks: domino
You need to log in before you can comment on or make changes to this bug.