Closed Bug 1724245 Opened 4 years ago Closed 4 years ago

Assertion failure: !aParent || result->mParentAGR == aParent, at /layout/painting/nsDisplayList.cpp:888

Categories

(Core :: Web Painting, defect)

Product:
Core
Component:
Web Painting
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
94 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- unaffected
firefox-esr91 --- wontfix
firefox92 --- wontfix
firefox93 --- wontfix
firefox94 --- fixed

People

(Reporter: jkratzer, Assigned: mattwoodrow)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file)

Testcase
3.53 KB, application/octet-stream
Details

Testcase found while fuzzing mozilla-central rev d66e0aca4012 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build d66e0aca4012  --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Assertion failure: !aParent || result->mParentAGR == aParent, at /layout/painting/nsDisplayList.cpp:888

    ==1887767==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f55e998e41e bp 0x7ffe917e11d0 sp 0x7ffe917e1120 T1887767)
    ==1887767==The signal is caused by a WRITE memory access.
    ==1887767==Hint: address points to the zero page.
        #0 0x7f55e998e41e in mozilla::nsDisplayListBuilder::WrapAGRForFrame(nsIFrame*, bool, mozilla::AnimatedGeometryRoot*) /layout/painting/nsDisplayList.cpp:888:3
        #1 0x7f55e99c12f2 in mozilla::nsDisplayListBuilder::AutoBuildingDisplayList::AutoBuildingDisplayList(mozilla::nsDisplayListBuilder*, nsIFrame*, nsRect const&, nsRect const&, bool) /layout/painting/nsDisplayList.cpp:10533:21
        #2 0x7f55e96a0394 in AutoBuildingDisplayList /layout/painting/nsDisplayList.h:1077:11
        #3 0x7f55e96a0394 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4169:49
        #4 0x7f55e967dddd in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /layout/generic/nsBlockFrame.cpp:6924:13
        #5 0x7f55e967c834 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsBlockFrame.cpp:7082:9
        #6 0x7f55e96a0fcd in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4260:14
        #7 0x7f55e96db942 in mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsGfxScrollFrame.cpp:3951:15
        #8 0x7f55e96a0fcd in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4260:14
        #9 0x7f55e97d7938 in nsFieldSetFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/forms/nsFieldSetFrame.cpp:262:5
        #10 0x7f55e971c1d3 in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /layout/generic/nsIFrame.cpp:3416:5
        #11 0x7f55e96a0d11 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4227:12
        #12 0x7f55e967dddd in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /layout/generic/nsBlockFrame.cpp:6924:13
        #13 0x7f55e967c834 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsBlockFrame.cpp:7082:9
        #14 0x7f55e96a0fcd in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4260:14
        #15 0x7f55e967dddd in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /layout/generic/nsBlockFrame.cpp:6924:13
        #16 0x7f55e967c834 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsBlockFrame.cpp:7082:9
        #17 0x7f55e96a0fcd in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4260:14
        #18 0x7f55e96db942 in mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsGfxScrollFrame.cpp:3951:15
        #19 0x7f55e971c1d3 in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /layout/generic/nsIFrame.cpp:3416:5
        #20 0x7f55e96a0d11 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4227:12
        #21 0x7f55e967dddd in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /layout/generic/nsBlockFrame.cpp:6924:13
        #22 0x7f55e967c834 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsBlockFrame.cpp:7082:9
        #23 0x7f55e971edb6 in nsIFrame::BuildDisplayListForSimpleChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&) /layout/generic/nsIFrame.cpp:3947:11
        #24 0x7f55e969fa24 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4051:5
        #25 0x7f55e96db942 in mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsGfxScrollFrame.cpp:3951:15
        #26 0x7f55e971c1d3 in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /layout/generic/nsIFrame.cpp:3416:5
        #27 0x7f55e96a0d11 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4227:12
        #28 0x7f55e967dddd in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /layout/generic/nsBlockFrame.cpp:6924:13
        #29 0x7f55e967c834 in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsBlockFrame.cpp:7082:9
        #30 0x7f55e971c1d3 in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /layout/generic/nsIFrame.cpp:3416:5
        #31 0x7f55e96a0d11 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4227:12
        #32 0x7f55e9683058 in nsCanvasFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsCanvasFrame.cpp:642:5
        #33 0x7f55e971edb6 in nsIFrame::BuildDisplayListForSimpleChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&) /layout/generic/nsIFrame.cpp:3947:11
        #34 0x7f55e969fa24 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4051:5
        #35 0x7f55e96db942 in mozilla::ScrollFrameHelper::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/nsGfxScrollFrame.cpp:3951:15
        #36 0x7f55e971edb6 in nsIFrame::BuildDisplayListForSimpleChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&) /layout/generic/nsIFrame.cpp:3947:11
        #37 0x7f55e969fa24 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /layout/generic/nsIFrame.cpp:4051:5
        #38 0x7f55e9653cfc in mozilla::ViewportFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /layout/generic/ViewportFrame.cpp:66:3
        #39 0x7f55e971c1d3 in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /layout/generic/nsIFrame.cpp:3416:5
        #40 0x7f55e9969742 in mozilla::RetainedDisplayListBuilder::AttemptPartialUpdate(unsigned int) /layout/painting/RetainedDisplayListBuilder.cpp:1449:34
        #41 0x7f55e95fbce5 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /layout/base/nsLayoutUtils.cpp:3443:40
        #42 0x7f55e9572e9f in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) /layout/base/PresShell.cpp:6429:5
        #43 0x7f55e9213c51 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /view/nsViewManager.cpp:459:18
        #44 0x7f55e921376b in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /view/nsViewManager.cpp:394:22
        #45 0x7f55e9214cdf in nsViewManager::ProcessPendingUpdates() /view/nsViewManager.cpp:972:5
        #46 0x7f55e9531c9c in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2498:11
        #47 0x7f55e9538e8a in TickDriver /layout/base/nsRefreshDriver.cpp:348:13
        #48 0x7f55e9538e8a in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:326:7
        #49 0x7f55e9538da3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:342:5
        #50 0x7f55e9538c70 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:771:5
        #51 0x7f55e953830a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:700:16
        #52 0x7f55e9537c25 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /layout/base/nsRefreshDriver.cpp:617:7
        #53 0x7f55e95376a9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:538:9
        #54 0x7f55e8d4ace6 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncChild.cpp:68:15
        #55 0x7f55e5a26cf4 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
        #56 0x7f55e57ee72c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6091:32
        #57 0x7f55e545d2a1 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:2051:25
        #58 0x7f55e5459de1 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /ipc/glue/MessageChannel.cpp:1978:9
        #59 0x7f55e545b265 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1826:3
        #60 0x7f55e545bdfb in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1857:13
        #61 0x7f55e4b4cc1e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:502:16
        #62 0x7f55e4b2a959 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:805:26
        #63 0x7f55e4b297d8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:641:15
        #64 0x7f55e4b29a53 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:425:36
        #65 0x7f55e4b50416 in operator() /xpcom/threads/TaskController.cpp:135:37
        #66 0x7f55e4b50416 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:532:5
        #67 0x7f55e4b3c58f in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1148:16
        #68 0x7f55e4b42ffa in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:466:10
        #69 0x7f55e5463116 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #70 0x7f55e53bd9e7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #71 0x7f55e53bd902 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #72 0x7f55e53bd902 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #73 0x7f55e925d388 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #74 0x7f55eac13c83 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:923:20
        #75 0x7f55e546400a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #76 0x7f55e53bd9e7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #77 0x7f55e53bd902 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #78 0x7f55e53bd902 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #79 0x7f55eac1389e in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:755:34
        #80 0x562e11f539b6 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #81 0x562e11f539b6 in main /browser/app/nsBrowserApp.cpp:327:18
        #82 0x7f55f98a30b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
        #83 0x562e11f307bc in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x157bc)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/painting/nsDisplayList.cpp:888:3 in mozilla::nsDisplayListBuilder::WrapAGRForFrame(nsIFrame*, bool, mozilla::AnimatedGeometryRoot*)
    ==1887767==ABORTING
Attached file Testcase —

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210805163446-f5921ffeaee4.
The bug appears to have been introduced in the following build range:

Start: aafff593562887152fdabcd62ff55dd23630bf4e (20210207100438)
End: e2e967977e4bc5f9da2bc35f18c6bec772ae1760 (20210207171426)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=aafff593562887152fdabcd62ff55dd23630bf4e&tochange=e2e967977e4bc5f9da2bc35f18c6bec772ae1760

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

(In reply to Bugmon [:jkratzer for issues] from comment #2)

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210805163446-f5921ffeaee4.
The bug appears to have been introduced in the following build range:

Start: aafff593562887152fdabcd62ff55dd23630bf4e (20210207100438)
End: e2e967977e4bc5f9da2bc35f18c6bec772ae1760 (20210207171426)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=aafff593562887152fdabcd62ff55dd23630bf4e&tochange=e2e967977e4bc5f9da2bc35f18c6bec772ae1760

probably bug 1675547

Regressed by: 1675547
Has Regression Range: --- → yes
Depends on: domino
Blocks: domino
No longer depends on: domino

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20210805092724-d66e0aca4012) but not with tip (mozilla-central 20210917215008-186467330eb1.)
The bug appears to have been fixed in the following build range:

Start: 0995ed1fe696eafdf7da2535c50da2b643bb33ca (20210915082220)
End: 8a9d97b273e76e44939b6ef6c4f9dd5b21ed37d0 (20210915152638)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=0995ed1fe696eafdf7da2535c50da2b643bb33ca&tochange=8a9d97b273e76e44939b6ef6c4f9dd5b21ed37d0
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
Status: NEW → RESOLVED
Closed: 4 years ago
Depends on: 1714138
Resolution: --- → FIXED

Is it worth landing the attached testcase as a crashtest?

Assignee: nobody → matt.woodrow
status-firefox92: --- → wontfix
status-firefox93: --- → wontfix
status-firefox94: --- → fixed
status-firefox-esr78: --- → unaffected
status-firefox-esr91: --- → wontfix
Flags: needinfo?(matt.woodrow)
Target Milestone: --- → 94 Branch

(In reply to Ryan VanderMeulen [:RyanVM] from comment #5)

Is it worth landing the attached testcase as a crashtest?

Not sure there's much value, this is asserting the state of AGRs, which no longer exist.

Flags: needinfo?(matt.woodrow)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: