Assertion failure: (isUsingFlexGrow && availableFreeSpace >= 0) || (!isUsingFlexGrow && availableFreeSpace <= 0) (availableFreeSpace's sign should match isUsingFlexGrow), at /layout/generic/nsFlexContainerFrame.cpp:3071
Categories
(Core :: Layout: Flexbox, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr78 | --- | unaffected |
firefox-esr91 | --- | unaffected |
firefox91 | --- | unaffected |
firefox92 | --- | unaffected |
firefox93 | --- | verified |
People
(Reporter: jkratzer, Assigned: TYLin)
References
(Blocks 1 open bug, Regression)
Details
(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])
Attachments
(2 files)
Testcase found while fuzzing mozilla-central rev b5acac258824 (built with: --enable-debug --enable-fuzzing).
Testcase can be reproduced using the following commands:
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build b5acac258824 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html
Assertion failure: (isUsingFlexGrow && availableFreeSpace >= 0) || (!isUsingFlexGrow && availableFreeSpace <= 0) (availableFreeSpace's sign should match isUsingFlexGrow), at /layout/generic/nsFlexContainerFrame.cpp:3071
==3028890==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6885e6cf50 bp 0x7ffe26b0ed40 sp 0x7ffe26b0ecb0 T3028890)
==3028890==The signal is caused by a WRITE memory access.
==3028890==Hint: address points to the zero page.
#0 0x7f6885e6cf50 in nsFlexContainerFrame::FlexLine::ResolveFlexibleLengths(int, ComputedFlexLineInfo*) /layout/generic/nsFlexContainerFrame.cpp:3069:5
#1 0x7f6885e72da5 in nsFlexContainerFrame::DoFlexLayout(mozilla::ReflowInput const&, int&, int&, int&, nsTArray<nsFlexContainerFrame::FlexLine>&, nsTArray<nsFlexContainerFrame::StrutInfo>&, nsTArray<nsIFrame*>&, nsFlexContainerFrame::FlexboxAxisTracker const&, int, int, int, bool, ComputedFlexContainerInfo*) /layout/generic/nsFlexContainerFrame.cpp:5074:10
#2 0x7f6885e711fe in nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsFlexContainerFrame.cpp:4534:5
#3 0x7f6885e4e7c0 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:1000:14
#4 0x7f6885e4dbca in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsCanvasFrame.cpp:787:7
#5 0x7f6885e4e7c0 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:1000:14
#6 0x7f6885e9a565 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput*, bool, bool, mozilla::ReflowOutput*) /layout/generic/nsGfxScrollFrame.cpp:759:3
#7 0x7f6885e9b029 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput*, mozilla::ReflowOutput const&) /layout/generic/nsGfxScrollFrame.cpp:880:3
#8 0x7f6885e9f4c9 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGfxScrollFrame.cpp:1299:3
#9 0x7f6885e1f418 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:1040:14
#10 0x7f6885e1ecbc in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ViewportFrame.cpp:374:7
#11 0x7f6885d2211b in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /layout/base/PresShell.cpp:9597:11
#12 0x7f6885d2c2ee in mozilla::PresShell::ProcessReflowCommands(bool) /layout/base/PresShell.cpp:9768:24
#13 0x7f6885d2b7a9 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4256:11
#14 0x7f6885cf26df in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1423:5
#15 0x7f6885cf26df in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2357:20
#16 0x7f6885cfa7fa in TickDriver /layout/base/nsRefreshDriver.cpp:348:13
#17 0x7f6885cfa7fa in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:326:7
#18 0x7f6885cfa713 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:342:5
#19 0x7f6885cfa5e0 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:771:5
#20 0x7f6885cf9c7a in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:700:16
#21 0x7f6885cf9595 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /layout/base/nsRefreshDriver.cpp:617:7
#22 0x7f6885cf9019 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:538:9
#23 0x7f68854c42e6 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncChild.cpp:68:15
#24 0x7f68820e6064 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
#25 0x7f6881eba8ac in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6091:32
#26 0x7f6881b3986f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:2053:25
#27 0x7f6881b36381 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /ipc/glue/MessageChannel.cpp:1978:9
#28 0x7f6881b37805 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1826:3
#29 0x7f6881b3839b in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1857:13
#30 0x7f68810fe53e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:502:16
#31 0x7f68810da59f in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:805:26
#32 0x7f68810d9208 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:641:15
#33 0x7f68810d9483 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:425:36
#34 0x7f6881101b36 in operator() /xpcom/threads/TaskController.cpp:135:37
#35 0x7f6881101b36 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:532:5
#36 0x7f68810ecf3f in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1148:16
#37 0x7f68810f3d3a in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:466:10
#38 0x7f6881b3f6d6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
#39 0x7f6881a5fdc7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#40 0x7f6881a5fcd2 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#41 0x7f6881a5fcd2 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#42 0x7f68859fca78 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
#43 0x7f688787bf93 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:917:20
#44 0x7f6881b405ca in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
#45 0x7f6881a5fdc7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
#46 0x7f6881a5fcd2 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#47 0x7f6881a5fcd2 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#48 0x7f688787b5ce in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:749:34
#49 0x55614bd7eab6 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#50 0x55614bd7eab6 in main /browser/app/nsBrowserApp.cpp:327:18
#51 0x7f6897a040b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#52 0x55614bd5b8bc in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x158bc)
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/generic/nsFlexContainerFrame.cpp:3069:5 in nsFlexContainerFrame::FlexLine::ResolveFlexibleLengths(int, ComputedFlexLineInfo*)
==3028890==ABORTING
Reporter | ||
Comment 1•2 years ago
|
||
Comment 2•2 years ago
|
||
Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210831152836-86d5ab060da8.
The bug appears to have been introduced in the following build range:
Start: 4e0dafb873bd3b45c0cecf4a8e64f7e324211f7c (20210825095400)
End: 9a8bac0b93fdeb3e66fc1ab5814854b4cc377697 (20210825092302)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=4e0dafb873bd3b45c0cecf4a8e64f7e324211f7c&tochange=9a8bac0b93fdeb3e66fc1ab5814854b4cc377697
Comment 3•2 years ago
|
||
In that range, it seems bug 1469649 is the culprit.
Updated•2 years ago
|
Updated•2 years ago
|
Comment 4•2 years ago
|
||
Set release status flags based on info from the regressing bug 1469649
Assignee | ||
Updated•2 years ago
|
Assignee | ||
Comment 5•2 years ago
|
||
Promote FlexLine::mTotalItemMBP
to AuCoord64
can fix the testcase in
this patch, but layout/generic/crashtests/1488762-1.html
will start
crashing. It is because FlexItem::OuterMainSize()
can return negative
size due to integer overflow, and the negative sizes will accumulate in
mTotalOuterHypotheticalMainSize
.
Instead of promoting more variables to AuCoord64
to workaround huge
margin/border/padding that we cannot handle gracefully, this patch tweak
the assertion to test only if mTotalOuterHypotheticalMainSize
and
mTotalItemMBP
have valid values.
Updated•2 years ago
|
Pushed by aethanyc@gmail.com: https://hg.mozilla.org/integration/autoland/rev/737edd21c6e2 Tweak an assertion to recognize integer overflow due to huge margin/border/padding. r=dholbert
Assignee | ||
Updated•2 years ago
|
Comment 7•2 years ago
|
||
bugherder |
Comment 8•2 years ago
|
||
Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210904094024-8d40319470d4.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Description
•