Assertion failure: IsAncestorFrameCrossDocInProcess(aAncestor.mFrame, aFrame) (Fix the caller), at /layout/base/nsLayoutUtils.cpp:2597
Categories
(Core :: Layout, defect, P3)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr78 | --- | unaffected |
firefox-esr91 | --- | unaffected |
firefox91 | --- | unaffected |
firefox92 | --- | fixed |
firefox93 | --- | verified |
People
(Reporter: jkratzer, Assigned: emilio)
References
(Blocks 1 open bug, Regression)
Details
(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])
Attachments
(2 files)
355 bytes,
text/html
|
Details | |
48 bytes,
text/x-phabricator-request
|
RyanVM
:
approval-mozilla-beta+
|
Details | Review |
Testcase found while fuzzing mozilla-central rev d66e0aca4012 (built with: --enable-debug --enable-fuzzing).
Testcase can be reproduced using the following commands:
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build d66e0aca4012 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html
Assertion failure: IsAncestorFrameCrossDocInProcess(aAncestor.mFrame, aFrame) (Fix the caller), at /layout/base/nsLayoutUtils.cpp:2597
==1858140==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f65fa5bbee7 bp 0x7ffe39dc8420 sp 0x7ffe39dc8380 T1858140)
==1858140==The signal is caused by a WRITE memory access.
==1858140==Hint: address points to the zero page.
#0 0x7f65fa5bbee7 in nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame const*, nsRect const&, mozilla::RelativeTo, bool*, mozilla::Maybe<mozilla::gfx::Matrix4x4TypedFlagged<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> >*, bool, nsIFrame**) /layout/base/nsLayoutUtils.cpp:2596:3
#1 0x7f65fa5eaca0 in TransformFrameRectToAncestor /layout/base/nsLayoutUtils.h:895:12
#2 0x7f65fa5eaca0 in BoxToRect::AddBox(nsIFrame*) /layout/base/nsLayoutUtils.cpp:3801:13
#3 0x7f65fa5c2549 in GetAllInFlowBoxes /layout/base/nsLayoutUtils.cpp:3716:5
#4 0x7f65fa5c2549 in GetAllInFlowRects /layout/base/nsLayoutUtils.cpp:3860:3
#5 0x7f65fa5c2549 in nsLayoutUtils::GetAllInFlowRectsUnion(nsIFrame*, nsIFrame const*, unsigned int) /layout/base/nsLayoutUtils.cpp:3900:3
#6 0x7f65f761f7c0 in ComputeTheIntersection /dom/base/DOMIntersectionObserver.cpp:347:41
#7 0x7f65f761f7c0 in mozilla::dom::DOMIntersectionObserver::Update(mozilla::dom::Document*, double) /dom/base/DOMIntersectionObserver.cpp:649:26
#8 0x7f65f77c03a6 in mozilla::dom::Document::UpdateIntersectionObservations(mozilla::TimeStamp) /dom/base/Document.cpp:15520:17
#9 0x7f65fa4f5cf7 in nsRefreshDriver::UpdateIntersectionObservations(mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:1921:10
#10 0x7f65fa4f41a8 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2387:3
#11 0x7f65fa4fbe8a in TickDriver /layout/base/nsRefreshDriver.cpp:348:13
#12 0x7f65fa4fbe8a in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:326:7
#13 0x7f65fa4fbda3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:342:5
#14 0x7f65fa4fbc70 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:771:5
#15 0x7f65fa4fb30a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:700:16
#16 0x7f65fa4fac25 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /layout/base/nsRefreshDriver.cpp:617:7
#17 0x7f65fa4fa6a9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:538:9
#18 0x7f65f9d0dce6 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncChild.cpp:68:15
#19 0x7f65f69e9cf4 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
#20 0x7f65f67b172c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6091:32
#21 0x7f65f64202a1 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:2051:25
#22 0x7f65f641cde1 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /ipc/glue/MessageChannel.cpp:1978:9
#23 0x7f65f641e265 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1826:3
#24 0x7f65f641edfb in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1857:13
#25 0x7f65f5b0fc1e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:502:16
#26 0x7f65f5aed959 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:805:26
#27 0x7f65f5aec7d8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:641:15
#28 0x7f65f5aeca53 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:425:36
#29 0x7f65f5b13489 in operator() /xpcom/threads/TaskController.cpp:138:37
#30 0x7f65f5b13489 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:532:5
#31 0x7f65f5aff58f in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1148:16
#32 0x7f65f5b05ffa in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:466:10
#33 0x7f65f64260c4 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
#34 0x7f65f63809e7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#35 0x7f65f6380902 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#36 0x7f65f6380902 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#37 0x7f65fa220388 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
#38 0x7f65fbbd6c83 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:923:20
#39 0x7f65f642700a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
#40 0x7f65f63809e7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#41 0x7f65f6380902 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#42 0x7f65f6380902 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#43 0x7f65fbbd689e in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:755:34
#44 0x5583d17db9b6 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#45 0x5583d17db9b6 in main /browser/app/nsBrowserApp.cpp:327:18
#46 0x7f660c5a60b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#47 0x5583d17b87bc in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x157bc)
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/base/nsLayoutUtils.cpp:2596:3 in nsLayoutUtils::TransformFrameRectToAncestor(nsIFrame const*, nsRect const&, mozilla::RelativeTo, bool*, mozilla::Maybe<mozilla::gfx::Matrix4x4TypedFlagged<mozilla::gfx::UnknownUnits, mozilla::gfx::UnknownUnits> >*, bool, nsIFrame**)
==1858140==ABORTING
Reporter | ||
Comment 1•3 years ago
|
||
Comment 2•3 years ago
|
||
Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210805092724-d66e0aca4012.
The bug appears to have been introduced in the following build range:
Start: 74375e38baefa4a063b0d3f9087a83321078756b (20210730120448)
End: 0f01ac89ab321792a4f77823c256d9a1fdfb666a (20210730142217)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=74375e38baefa4a063b0d3f9087a83321078756b&tochange=0f01ac89ab321792a4f77823c256d9a1fdfb666a
Comment 3•3 years ago
|
||
Bug 1722968 looks like the most likely culprit in that range.
Updated•3 years ago
|
Assignee | ||
Updated•3 years ago
|
Assignee | ||
Updated•3 years ago
|
Updated•3 years ago
|
Assignee | ||
Comment 4•3 years ago
|
||
Assignee | ||
Updated•3 years ago
|
Pushed by ealvarez@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/2bb68b925cea Fix optimization from bug 1722968 to account for when we may dig out of the target subtree for SVG. r=TYLin
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/30139 for changes under testing/web-platform/tests
Comment 7•3 years ago
|
||
bugherder |
Upstream PR merged by moz-wptsync-bot
Comment 9•3 years ago
|
||
Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210824094724-7857f4c37a92.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Comment 10•3 years ago
|
||
Is there a user-facing issue from this bug that would warrant uplift consideration or can this fix ride with Fx93?
Assignee | ||
Comment 11•3 years ago
|
||
Comment on attachment 9236828 [details]
Bug 1724237 - Fix optimization from bug 1722968 to account for when we may dig out of the target subtree for SVG. r=#layout-reviewers
Beta/Release Uplift Approval Request
- User impact if declined: IntersectionObserver on SVG could misbehave.
- Is this code covered by automated tests?: Yes
- Has the fix been verified in Nightly?: Yes
- Needs manual test from QE?: No
- If yes, steps to reproduce:
- List of other uplifts needed: none
- Risk to taking this patch: Low
- Why is the change risky/not risky? (and alternatives if risky): Simple low-risk tweak to a recently-introduced optimization.
- String changes made/needed: none
Comment 12•3 years ago
|
||
Comment on attachment 9236828 [details]
Bug 1724237 - Fix optimization from bug 1722968 to account for when we may dig out of the target subtree for SVG. r=#layout-reviewers
Approved for 92.0b9.
Comment 13•3 years ago
|
||
bugherder uplift |
Description
•