Open Bug 1764205 Opened 2 years ago Updated 1 year ago

crash near null in [@ nsBlockFrame::ReflowInlineFrame]

Categories

(Core :: Layout: Block and Inline, defect)

Product:
Core
Component:
Layout: Block and Inline
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox101 --- affected

People

(Reporter: tsmith, Unassigned, NeedInfo)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(1 file)

testcase.html
648 bytes, text/html
Details
Attached file testcase.html —

Found while fuzzing m-c 20220407-b8732a1c1fa9 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

==3003==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000006d (pc 0x7fba8fee872f bp 0x7ffda9a51c70 sp 0x7ffda9a51b40 T0)
==3003==The signal is caused by a READ memory access.
==3003==Hint: address points to the zero page.
    #0 0x7fba8fee872f in IsPlaceholderFrame /builds/worker/workspace/obj-build/dist/include/mozilla/FrameTypeList.h:77:1
    #1 0x7fba8fee872f in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /gecko/layout/generic/nsBlockFrame.cpp:4545:15
    #2 0x7fba8fee782d in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /gecko/layout/generic/nsBlockFrame.cpp:4355:5
    #3 0x7fba8fee0aae in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /gecko/layout/generic/nsBlockFrame.cpp:4240:9
    #4 0x7fba8feda2a9 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /gecko/layout/generic/nsBlockFrame.cpp:3227:5
    #5 0x7fba8fed1c2e in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /gecko/layout/generic/nsBlockFrame.cpp:2761:7
    #6 0x7fba8fecaebd in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsBlockFrame.cpp:1394:3
    #7 0x7fba8ff03ded in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1005:14
    #8 0x7fba8ff07b44 in nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /gecko/layout/generic/nsColumnSetFrame.cpp:686:7
    #9 0x7fba8ff06940 in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig&, bool) /gecko/layout/generic/nsColumnSetFrame.cpp:396:37
    #10 0x7fba8ff0c706 in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsColumnSetFrame.cpp:1228:37
    #11 0x7fba8fee5392 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /gecko/layout/generic/nsBlockReflowContext.cpp:288:11
    #12 0x7fba8fedd4a2 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /gecko/layout/generic/nsBlockFrame.cpp:3874:11
    #13 0x7fba8feda3f6 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /gecko/layout/generic/nsBlockFrame.cpp:3224:5
    #14 0x7fba8fed1c2e in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /gecko/layout/generic/nsBlockFrame.cpp:2761:7
    #15 0x7fba8fecaebd in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsBlockFrame.cpp:1394:3
    #16 0x7fba8fee5392 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /gecko/layout/generic/nsBlockReflowContext.cpp:288:11
    #17 0x7fba8fedd4a2 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /gecko/layout/generic/nsBlockFrame.cpp:3874:11
    #18 0x7fba8feda3f6 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /gecko/layout/generic/nsBlockFrame.cpp:3224:5
    #19 0x7fba8fed1c2e in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /gecko/layout/generic/nsBlockFrame.cpp:2761:7
    #20 0x7fba8fecaebd in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsBlockFrame.cpp:1394:3
    #21 0x7fba8ff03ded in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1005:14
    #22 0x7fba8ff07b44 in nsColumnSetFrame::ReflowChildren(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /gecko/layout/generic/nsColumnSetFrame.cpp:686:7
    #23 0x7fba8ff06940 in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig&, bool) /gecko/layout/generic/nsColumnSetFrame.cpp:396:37
    #24 0x7fba8ff0c706 in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsColumnSetFrame.cpp:1228:37
    #25 0x7fba8fee5392 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, nsCollapsingMargin&, int, bool, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /gecko/layout/generic/nsBlockReflowContext.cpp:288:11
    #26 0x7fba8fedd4a2 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /gecko/layout/generic/nsBlockFrame.cpp:3874:11
    #27 0x7fba8feda3f6 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /gecko/layout/generic/nsBlockFrame.cpp:3224:5
    #28 0x7fba8fed1c2e in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /gecko/layout/generic/nsBlockFrame.cpp:2761:7
    #29 0x7fba8fecaebd in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsBlockFrame.cpp:1394:3
    #30 0x7fba8ff03ded in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1005:14
    #31 0x7fba8ff025c7 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsCanvasFrame.cpp:791:7
    #32 0x7fba8feba7fb in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1045:14
    #33 0x7fba9010e1e6 in nsPageContentFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsPageContentFrame.cpp:73:5
    #34 0x7fba8feba7fb in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1045:14
    #35 0x7fba9011222f in nsPageFrame::ReflowPageContent(nsPresContext*, mozilla::ReflowInput const&) /gecko/layout/generic/nsPageFrame.cpp:146:3
    #36 0x7fba90112aa4 in nsPageFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsPageFrame.cpp:169:13
    #37 0x7fba8ff03ded in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1005:14
    #38 0x7fba8fe7b23d in mozilla::PrintedSheetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/PrintedSheetFrame.cpp:132:5
    #39 0x7fba8feba7fb in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1045:14
    #40 0x7fba9011a2cf in nsPageSequenceFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsPageSequenceFrame.cpp:370:5
    #41 0x7fba8ff03ded in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1005:14
    #42 0x7fba8ff025c7 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsCanvasFrame.cpp:791:7
    #43 0x7fba8ff03ded in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1005:14
    #44 0x7fba8ff8fcc6 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /gecko/layout/generic/nsGfxScrollFrame.cpp:838:3
    #45 0x7fba8ff91589 in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /gecko/layout/generic/nsGfxScrollFrame.cpp:973:3
    #46 0x7fba8ff97c14 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/nsGfxScrollFrame.cpp:1395:3
    #47 0x7fba8feba7fb in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /gecko/layout/generic/nsContainerFrame.cpp:1045:14
    #48 0x7fba8feb9e29 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /gecko/layout/generic/ViewportFrame.cpp:374:7
    #49 0x7fba8fcf0798 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /gecko/layout/base/PresShell.cpp:9602:11
    #50 0x7fba8fd02867 in mozilla::PresShell::ProcessReflowCommands(bool) /gecko/layout/base/PresShell.cpp:9773:24
    #51 0x7fba8fd00b87 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /gecko/layout/base/PresShell.cpp:4351:11
    #52 0x7fba90584f3d in nsPrintJob::ReflowPrintObject(mozilla::UniquePtr<nsPrintObject, mozilla::DefaultDelete<nsPrintObject> > const&) /gecko/layout/printing/nsPrintJob.cpp:1607:14
    #53 0x7fba9058380e in nsPrintJob::ReflowDocList(mozilla::UniquePtr<nsPrintObject, mozilla::DefaultDelete<nsPrintObject> > const&, bool) /gecko/layout/printing/nsPrintJob.cpp:1169:3
    #54 0x7fba9057cb2f in nsPrintJob::InitPrintDocConstruction(bool) /gecko/layout/printing/nsPrintJob.cpp:1209:5
    #55 0x7fba905793fa in nsPrintJob::DoCommonPrint(bool, nsIPrintSettings*, nsIWebProgressListener*, mozilla::dom::Document*) /gecko/layout/printing/nsPrintJob.cpp:613:3
    #56 0x7fba90577c43 in nsPrintJob::CommonPrint(bool, nsIPrintSettings*, nsIWebProgressListener*, mozilla::dom::Document*) /gecko/layout/printing/nsPrintJob.cpp:457:17
    #57 0x7fba9057d152 in nsPrintJob::PrintPreview(mozilla::dom::Document*, nsIPrintSettings*, nsIWebProgressListener*, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&) /gecko/layout/printing/nsPrintJob.cpp:641:7
    #58 0x7fba8fdd01ea in nsDocumentViewer::PrintPreview(nsIPrintSettings*, nsIWebProgressListener*, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&) /gecko/layout/base/nsDocumentViewer.cpp:2979:18
    #59 0x7fba8a1b97ae in nsGlobalWindowOuter::Print(nsIPrintSettings*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, mozilla::ErrorResult&) /gecko/dom/base/nsGlobalWindowOuter.cpp:5308:33
    #60 0x7fba8a153f41 in nsGlobalWindowInner::PrintPreview(nsIPrintSettings*, nsIWebProgressListener*, nsIDocShell*, mozilla::ErrorResult&) /gecko/dom/base/nsGlobalWindowInner.cpp:3852:3
    #61 0x7fba8bab3991 in mozilla::dom::Window_Binding::printPreview(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:3216:59
    #62 0x7fba8c2d30bb in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3270:13
    #63 0x7fba9627eb24 in CallJSNative /gecko/js/src/vm/Interpreter.cpp:420:13
    #64 0x7fba9627eb24 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:507:12
    #65 0x7fba9626b26b in CallFromStack /gecko/js/src/vm/Interpreter.cpp:571:10
    #66 0x7fba9626b26b in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3293:16
    #67 0x7fba96250361 in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:389:13
    #68 0x7fba9627ec5f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:539:13
    #69 0x7fba9628084b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:584:8
    #70 0x7fba949cf5bd in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/CallAndConstruct.cpp:117:10
    #71 0x7fba8bee868f in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:283:37
    #72 0x7fba8ccd6703 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:365:12
    #73 0x7fba8ccd4c34 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /gecko/dom/events/JSEventHandler.cpp:201:12
    #74 0x7fba8cc9b038 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /gecko/dom/events/EventListenerManager.cpp:1316:22
    #75 0x7fba8cc9c64c in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /gecko/dom/events/EventListenerManager.cpp:1507:17
    #76 0x7fba8cc8a03e in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:348:17
    #77 0x7fba8cc8884d in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:550:16
    #78 0x7fba8cc8cb3d in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /gecko/dom/events/EventDispatcher.cpp:1119:11
    #79 0x7fba8fdc3d77 in nsDocumentViewer::LoadComplete(nsresult) /gecko/layout/base/nsDocumentViewer.cpp:1084:7
    #80 0x7fba937cc373 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /gecko/docshell/base/nsDocShell.cpp:6450:20
    #81 0x7fba937cb66b in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp:5839:7
    #82 0x7fba937cd63f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp
    #83 0x7fba88f9afb0 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:1377:3
    #84 0x7fba88f998c4 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:975:14
    #85 0x7fba88f960f2 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /gecko/uriloader/base/nsDocLoader.cpp:794:9
    #86 0x7fba88f982b5 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:677:5
    #87 0x7fba93806c3b in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /gecko/docshell/base/nsDocShell.cpp:13834:23
    #88 0x7fba876b747e in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:614:22
    #89 0x7fba876b9ec3 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:518:10
    #90 0x7fba89e7869e in imgRequestProxy::RemoveFromLoadGroup() /gecko/image/imgRequestProxy.cpp:372:15
    #91 0x7fba89e803f9 in imgRequestProxy::OnLoadComplete(bool) /gecko/image/imgRequestProxy.cpp:1005:7
    #92 0x7fba89e3e2f5 in operator() /gecko/image/ProgressTracker.cpp:351:13
    #93 0x7fba89e3e2f5 in void mozilla::image::ImageObserverNotifier<mozilla::image::ObserverTable const*>::operator()<void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)>(mozilla::image::ObserverTable const*) /gecko/image/ProgressTracker.cpp:281:9
    #94 0x7fba89e3bfe9 in void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/image/ProgressTracker.cpp:350:5
    #95 0x7fba89de4b63 in operator() /gecko/image/ProgressTracker.cpp:369:5
    #96 0x7fba89de4b63 in Read<(lambda at /builds/worker/checkouts/gecko/image/ProgressTracker.cpp:368:19)> /gecko/image/CopyOnWrite.h:155:12
    #97 0x7fba89de4b63 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/image/ProgressTracker.cpp:368:14
    #98 0x7fba89defe63 in mozilla::image::RasterImage::NotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::OrientedPixel> const&, mozilla::Maybe<unsigned int> const&, mozilla::image::DecoderFlags, mozilla::image::SurfaceFlags) /gecko/image/RasterImage.cpp:1580:28
    #99 0x7fba89dfaf04 in NotifyForLoadEvent /gecko/image/RasterImage.cpp:917:3
    #100 0x7fba89dfaf04 in mozilla::image::RasterImage::OnImageDataComplete(nsIRequest*, nsresult, bool) /gecko/image/RasterImage.cpp:899:3
    #101 0x7fba89e7258e in imgRequest::OnStopRequest(nsIRequest*, nsresult) /gecko/image/imgRequest.cpp:749:26
    #102 0x7fba88e06d05 in nsJARChannel::OnStopRequest(nsIRequest*, nsresult) /gecko/modules/libjar/nsJARChannel.cpp:1229:16
    #103 0x7fba88e0c13c in non-virtual thunk to nsJARChannel::OnStopRequest(nsIRequest*, nsresult) /gecko/modules/libjar/nsJARChannel.cpp
    #104 0x7fba876b36f3 in nsInputStreamPump::OnStateStop() /gecko/netwerk/base/nsInputStreamPump.cpp:657:16
    #105 0x7fba876b1c3e in nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) /gecko/netwerk/base/nsInputStreamPump.cpp:382:21
    #106 0x7fba87298796 in nsInputStreamReadyEvent::Run() /gecko/xpcom/io/nsStreamUtils.cpp:94:20
    #107 0x7fba87363e32 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:467:16
    #108 0x7fba8732a1ad in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:780:26
    #109 0x7fba873276a8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:612:15
    #110 0x7fba87327dd9 in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:390:36
    #111 0x7fba873707d1 in operator() /gecko/xpcom/threads/TaskController.cpp:124:37
    #112 0x7fba873707d1 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
    #113 0x7fba8734a6b7 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1187:16
    #114 0x7fba873547bc in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:465:10
    #115 0x7fba88a5ba7f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:85:21
    #116 0x7fba888d5ab1 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:380:10
    #117 0x7fba888d5ab1 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:373:3
    #118 0x7fba888d5ab1 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:355:3
    #119 0x7fba8f73c5c7 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
    #120 0x7fba9457a7ef in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:870:20
    #121 0x7fba888d5ab1 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:380:10
    #122 0x7fba888d5ab1 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:373:3
    #123 0x7fba888d5ab1 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:355:3
    #124 0x7fba94579a13 in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:729:34
    #125 0x55858187547d in content_process_main(mozilla::Bootstrap*, int, char**) /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #126 0x5585818758b0 in main /gecko/browser/app/nsBrowserApp.cpp:327:18
    #127 0x7fbaabf360b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
    #128 0x5585817c4569 in _start (/home/worker/builds/m-c-20220407212910-fuzzing-asan-opt/firefox+0x5e569)
Flags: in-testsuite?

A Pernosco session (debug build) is available here: https://pernos.co/debug/mjIDwDIWF3DSuLNML_65Mg/index.html

Crash Signature: [@ nsBlockFrame::ReflowLine ]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220411215938-872b574394a6.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: d68cc4d521d9d920770e70b428301e0d55aa44bb (20210413035647)
End: b8732a1c1fa931fc3cc5369e31a64db459f60c83 (20220407212910)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

Whiteboard: [bugmon:bisected,confirmed]
Flags: needinfo?(emilio)

(Downgrading to S3, since we're only considering crashes to be S2 if they have [or are likely to have] substantial crash volume or have security implications.)

Severity: S2 → S3

Bugmon was unable reproduce this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon

A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.

Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: