Closed Bug 1761756 Opened 4 years ago Closed 4 years ago

Assertion failure: mDirtyRect.Intersects(mOuterRect), at /layout/painting/nsCSSRenderingBorders.cpp:2079

Categories

(Core :: Web Painting, defect)

Product:
Core
Component:
Web Painting
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
101 Branch
Tracking Flags:
Tracking Status
firefox-esr91 --- unaffected
firefox98 --- unaffected
firefox99 --- unaffected
firefox100 --- fixed
firefox101 --- verified

People

(Reporter: jkratzer, Assigned: arai)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

Testcase
674 bytes, text/plain
Details
Bug 1761756 - Check the intersection again after conditioning the rect. r=miko!
48 bytes, text/x-phabricator-request
diannaS
: approval-mozilla-beta+
Details | Review

Testcase found while fuzzing mozilla-central rev eaf3521f3b37 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build eaf3521f3b37 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: mDirtyRect.Intersects(mOuterRect), at /layout/painting/nsCSSRenderingBorders.cpp:2079

    ==2980599==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f59e1028414 bp 0x7ffcd037ef40 sp 0x7ffcd037ee30 T2980599)
    ==2980599==The signal is caused by a WRITE memory access.
    ==2980599==Hint: address points to the zero page.
        #0 0x7f59e1028414 in nsCSSBorderRenderer::DrawDottedSideSlow(mozilla::Side) /layout/painting/nsCSSRenderingBorders.cpp:2079:3
        #1 0x7f59e10270ae in nsCSSBorderRenderer::DrawDashedOrDottedSide(mozilla::Side) /layout/painting/nsCSSRenderingBorders.cpp:1770:5
        #2 0x7f59e1014a99 in nsCSSBorderRenderer::DrawBorders() /layout/painting/nsCSSRenderingBorders.cpp:3317:9
        #3 0x7f59e1011460 in nsCSSRendering::PaintBorderWithStyleBorder(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&, nsRect const&, nsStyleBorder const&, mozilla::ComputedStyle*, mozilla::PaintBorderFlags, mozilla::Sides) /layout/painting/nsCSSRendering.cpp:888:6
        #4 0x7f59e1010f94 in nsCSSRendering::PaintBorder(nsPresContext*, gfxContext&, nsIFrame*, nsRect const&, nsRect const&, mozilla::ComputedStyle*, mozilla::PaintBorderFlags, mozilla::Sides) /layout/painting/nsCSSRendering.cpp:647:10
        #5 0x7f59e1045478 in mozilla::nsDisplayBorder::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /layout/painting/nsDisplayList.cpp:4271:26
        #6 0x7f59e1010667 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /layout/painting/nsDisplayList.cpp:2183:11
        #7 0x7f59e103921e in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /layout/painting/nsDisplayList.cpp:2248:5
        #8 0x7f59e0c97d1e in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /layout/base/nsLayoutUtils.cpp:3446:9
        #9 0x7f59e10413d6 in mozilla::GenerateAndPushTextMask(nsIFrame*, gfxContext*, nsRect const&, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:320:3
        #10 0x7f59e104319a in mozilla::nsDisplayBackgroundColor::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /layout/painting/nsDisplayList.cpp:3948:10
        #11 0x7f59dcff773b in mozilla::layers::PaintItemByDrawTarget(mozilla::nsDisplayItem*, mozilla::gfx::DrawTarget*, mozilla::gfx::PointTyped<mozilla::LayoutDevicePixel, float> const&, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::nsDisplayListBuilder*, mozilla::gfx::SizeTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::Maybe<mozilla::gfx::DeviceColor>&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:2184:38
        #12 0x7f59dcff684d in mozilla::layers::WebRenderCommandBuilder::GenerateFallbackData(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*, mozilla::gfx::RectTyped<mozilla::LayoutDevicePixel, float>&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:2447:7
        #13 0x7f59dcfeffb3 in mozilla::layers::WebRenderCommandBuilder::PushItemAsImage(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:2734:48
        #14 0x7f59dcfee7b0 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1958:7
        #15 0x7f59e104a956 in CreateWebRenderCommandsNewClipListOption /layout/painting/nsDisplayList.cpp:4651:30
        #16 0x7f59e104a956 in CreateWebRenderCommands /layout/painting/nsDisplayList.h:4939:12
        #17 0x7f59e104a956 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:5277:22
        #18 0x7f59dcfefe87 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1695:41
        #19 0x7f59dcfee7b0 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1958:7
        #20 0x7f59dcfecd17 in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1616:5
        #21 0x7f59dd001524 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) /gfx/layers/wr/WebRenderLayerManager.cpp:362:30
        #22 0x7f59e1039510 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /layout/painting/nsDisplayList.cpp:2288:18
        #23 0x7f59e0c97d1e in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /layout/base/nsLayoutUtils.cpp:3446:9
        #24 0x7f59e0c09be7 in mozilla::PresShell::PaintInternal(nsView*, mozilla::PaintInternalFlags) /layout/base/PresShell.cpp:6367:5
        #25 0x7f59e085ed5b in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /view/nsViewManager.cpp:440:18
        #26 0x7f59e085e87b in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /view/nsViewManager.cpp:375:22
        #27 0x7f59e085fe0c in nsViewManager::ProcessPendingUpdates() /view/nsViewManager.cpp:948:5
        #28 0x7f59e0bc5fbe in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2680:11
        #29 0x7f59e0bcdcb0 in TickDriver /layout/base/nsRefreshDriver.cpp:367:13
        #30 0x7f59e0bcdcb0 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:345:7
        #31 0x7f59e0bcdbb3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:361:5
        #32 0x7f59e0bcda80 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:882:5
        #33 0x7f59e0bcd133 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:762:16
        #34 0x7f59e0bcc7a5 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncOnMainThread() /layout/base/nsRefreshDriver.cpp:642:7
        #35 0x7f59e0bcc2dc in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:534:9
        #36 0x7f59e011e07a in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncMainChild.cpp:68:15
        #37 0x7f59e037cb86 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:54
        #38 0x7f59dc860bec in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6479:32
        #39 0x7f59dc7f61d1 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1707:25
        #40 0x7f59dc7f3407 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message&&) /ipc/glue/MessageChannel.cpp:1632:9
        #41 0x7f59dc7f3efd in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1493:3
        #42 0x7f59dc7f4a8e in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1528:14
        #43 0x7f59dbc6317e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:467:16
        #44 0x7f59dbc3d6d6 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:778:26
        #45 0x7f59dbc3c373 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:612:15
        #46 0x7f59dbc3c5e3 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:390:36
        #47 0x7f59dbc68219 in operator() /xpcom/threads/TaskController.cpp:127:37
        #48 0x7f59dbc68219 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #49 0x7f59dbc51e83 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1187:16
        #50 0x7f59dbc5889d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #51 0x7f59dc7fbb34 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #52 0x7f59dc719887 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:380:10
        #53 0x7f59dc719792 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #54 0x7f59dc719792 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #55 0x7f59e08c4438 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #56 0x7f59e29ce063 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:870:20
        #57 0x7f59dc7fca7a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #58 0x7f59dc719887 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:380:10
        #59 0x7f59dc719792 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #60 0x7f59dc719792 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #61 0x7f59e29cd699 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:729:34
        #62 0x55b34825e2f7 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #63 0x55b34825e2f7 in main /browser/app/nsBrowserApp.cpp:327:18
        #64 0x7f59f1f8a0b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
        #65 0x55b348239a7c in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x15a7c)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/painting/nsCSSRenderingBorders.cpp:2079:3 in nsCSSBorderRenderer::DrawDottedSideSlow(mozilla::Side)
    ==2980599==ABORTING
Attached file Testcase —

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220328154810-7f6b40d63b43.
The bug appears to have been introduced in the following build range:

Start: 57045ad64fb48792be9e513c55520b0a052bac22 (20220316002806)
End: a2742e46efb56e290f294f13ab8aaa1a5fe666c4 (20220316041325)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=57045ad64fb48792be9e513c55520b0a052bac22&tochange=a2742e46efb56e290f294f13ab8aaa1a5fe666c4

Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Regressed by: 1752624

Set release status flags based on info from the regressing bug 1752624

status-firefox100: --- → affected
status-firefox98: --- → unaffected
status-firefox99: --- → unaffected
status-firefox-esr91: --- → unaffected

:arai, since you are the author of the regressor, bug 1752624, could you take a look?
For more information, please visit auto_nag documentation.

Flags: needinfo?(arai.unmht)

I will take a look today.

Assignee: nobody → arai.unmht
Status: NEW → ASSIGNED
Has Regression Range: --- → yes
Severity: -- → S3
Pushed by arai_a@mac.com: https://hg.mozilla.org/integration/autoland/rev/357e5e22e480 Check the intersection again after conditioning the rect. r=miko
Regressions: 1762676

Just realized that the fallback affects the text rendering as well, and that results in more difference.

Attachment #9269802 - Attachment description: Bug 1761756 - Check the intersection again after conditioning the rect. r?miko! → Bug 1761756 - Check the intersection again after conditioning the rect. r=miko!

Set release status flags based on info from the regressing bug 1752624

status-firefox101: --- → affected
Pushed by arai_a@mac.com: https://hg.mozilla.org/integration/autoland/rev/109281d860c9 Check the intersection again after conditioning the rect. r=miko

https://hg.mozilla.org/mozilla-central/rev/109281d860c9

Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox101: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 101 Branch

Comment on attachment 9269802 [details]
Bug 1761756 - Check the intersection again after conditioning the rect. r=miko!

Beta/Release Uplift Approval Request

  • User impact if declined: Fuzzblocker
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This adds one more condition to skip the rendering of invisible border
  • String changes made/needed:
Flags: needinfo?(arai.unmht)
Attachment #9269802 - Flags: approval-mozilla-beta?

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220406043513-678264f22280.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox101: fixed → verified
Keywords: bugmon

Comment on attachment 9269802 [details]
Bug 1761756 - Check the intersection again after conditioning the rect. r=miko!

Approved for 100.0b3

Attachment #9269802 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: