Closed Bug 1764936 Opened 2 years ago Closed 2 years ago

Hit MOZ_CRASH(ElementAt(aIndex = 18446744073709551615, aLength = 0)) at /mfbt/Assertions.cpp:51

Categories

(Core :: Graphics, defect, P3)

Product:
Core
Component:
Graphics
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
103 Branch
Tracking Flags:
Tracking Status
firefox-esr91 --- wontfix
firefox101 --- wontfix
firefox102 --- wontfix
firefox103 --- verified

People

(Reporter: jkratzer, Assigned: mikokm)

References

(Blocks 2 open bugs, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(2 files)

Testcase
549 bytes, text/plain
Details
Bug 1764936 - Apply empty clip if clip-path creation fails r=emilio
48 bytes, text/x-phabricator-request
Details | Review

Testcase found while fuzzing mozilla-central rev 7f6fc25d231f (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 7f6fc25d231f --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(ElementAt(aIndex = 18446744073709551615, aLength = 0)) at /mfbt/Assertions.cpp:51

    =================================================================
    ==2364485==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x55596b1000a4 bp 0x7fffac121bc0 sp 0x7fffac121bc0 T0)
    ==2364485==The signal is caused by a WRITE memory access.
    ==2364485==Hint: address points to the zero page.
        #0 0x55596b1000a4 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
        #1 0x55596b1000a4 in mozilla::detail::InvalidArrayIndex_CRASH(unsigned long, unsigned long) /mfbt/Assertions.cpp:50:3
        #2 0x7f3e51cd3d82 in nsTArray_Impl<gfxContext::AzureState::PushedClip, nsTArrayInfallibleAllocator>::TruncateLength(unsigned long) /builds/worker/workspace/obj-build/dist/include/nsTArray.h:2253:7
        #3 0x7f3e51c50ccd in RemoveLastElements /builds/worker/workspace/obj-build/dist/include/nsTArray.h:1862:5
        #4 0x7f3e51c50ccd in RemoveLastElement /builds/worker/workspace/obj-build/dist/include/nsTArray.h:1855:30
        #5 0x7f3e51c50ccd in gfxContext::PopClip() /gfx/thebes/gfxContext.cpp:518:30
        #6 0x7f3e5868fb50 in mozilla::nsDisplayMasksAndClipPaths::PaintWithContentsPaintCallback(mozilla::nsDisplayListBuilder*, gfxContext*, std::function<void ()> const&) /layout/painting/nsDisplayList.cpp:8003:12
        #7 0x7f3e51af87a7 in mozilla::layers::Grouper::PaintContainerItem(mozilla::layers::DIGroup*, mozilla::nsDisplayItem*, mozilla::layers::BlobItemData*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, mozilla::nsDisplayList*, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1025:19
        #8 0x7f3e51afa9f3 in mozilla::layers::DIGroup::PaintItemRange(mozilla::layers::Grouper*, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:840:19
        #9 0x7f3e51af7dbd in mozilla::layers::Grouper::PaintContainerItem(mozilla::layers::DIGroup*, mozilla::nsDisplayItem*, mozilla::layers::BlobItemData*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, mozilla::nsDisplayList*, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1068:15
        #10 0x7f3e51afa9f3 in mozilla::layers::DIGroup::PaintItemRange(mozilla::layers::Grouper*, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, gfxContext*, mozilla::layers::WebRenderDrawEventRecorder*, mozilla::layers::RenderRootStateManager*, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:840:19
        #11 0x7f3e51aff0e2 in mozilla::layers::DIGroup::EndGroup(mozilla::layers::WebRenderLayerManager*, mozilla::nsDisplayListBuilder*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::Grouper*, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>, mozilla::LinkedListIterator<mozilla::nsDisplayItem*>) /gfx/layers/wr/WebRenderCommandBuilder.cpp:670:5
        #12 0x7f3e51afc2ab in mozilla::layers::Grouper::ConstructGroups(mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderCommandBuilder*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::DIGroup*, mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::layers::StackingContextHelper const&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1399:17
        #13 0x7f3e51b042e3 in mozilla::layers::WebRenderCommandBuilder::DoGroupingForDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1659:5
        #14 0x7f3e51b0696e in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1893:5
        #15 0x7f3e5866eb75 in mozilla::nsDisplayWrapList::CreateWebRenderCommandsNewClipListOption(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*, bool) /layout/painting/nsDisplayList.cpp:4655:30
        #16 0x7f3e58694e83 in mozilla::nsDisplaySVGWrapper::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:8500:10
        #17 0x7f3e51b09e3c in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1804:41
        #18 0x7f3e51b07f73 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /gfx/layers/wr/WebRenderCommandBuilder.cpp:2067:7
        #19 0x7f3e586816de in mozilla::nsDisplayTransform::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:6718:30
        #20 0x7f3e51b09e3c in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1804:41
        #21 0x7f3e51b07f73 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /gfx/layers/wr/WebRenderCommandBuilder.cpp:2067:7
        #22 0x7f3e5866eb75 in mozilla::nsDisplayWrapList::CreateWebRenderCommandsNewClipListOption(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*, bool) /layout/painting/nsDisplayList.cpp:4655:30
        #23 0x7f3e58674561 in CreateWebRenderCommands /layout/painting/nsDisplayList.h:4941:12
        #24 0x7f3e58674561 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /layout/painting/nsDisplayList.cpp:5281:22
        #25 0x7f3e51b09e3c in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1804:41
        #26 0x7f3e51b07f73 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /gfx/layers/wr/WebRenderCommandBuilder.cpp:2067:7
        #27 0x7f3e51b05ca2 in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /gfx/layers/wr/WebRenderCommandBuilder.cpp:1725:5
        #28 0x7f3e51b26756 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) /gfx/layers/wr/WebRenderLayerManager.cpp:363:30
        #29 0x7f3e5865030d in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /layout/painting/nsDisplayList.cpp:2292:18
        #30 0x7f3e57f6cb5f in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /layout/base/nsLayoutUtils.cpp:3446:9
        #31 0x7f3e57e8da11 in mozilla::PresShell::PaintInternal(nsView*, mozilla::PaintInternalFlags) /layout/base/PresShell.cpp:6412:5
        #32 0x7f3e577b250d in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /view/nsViewManager.cpp:440:18
        #33 0x7f3e577b1c8f in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /view/nsViewManager.cpp:375:22
        #34 0x7f3e577b3c4b in nsViewManager::ProcessPendingUpdates() /view/nsViewManager.cpp:948:5
        #35 0x7f3e57e03e8e in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2694:11
        #36 0x7f3e57e103d7 in TickDriver /layout/base/nsRefreshDriver.cpp:368:13
        #37 0x7f3e57e103d7 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /layout/base/nsRefreshDriver.cpp:346:7
        #38 0x7f3e57e1013d in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:362:5
        #39 0x7f3e57e0fdf5 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:896:5
        #40 0x7f3e57e0eed2 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:771:16
        #41 0x7f3e57e0e0b1 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncOnMainThread() /layout/base/nsRefreshDriver.cpp:650:7
        #42 0x7f3e57e0dad8 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:536:9
        #43 0x7f3e56b2a64e in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncMainChild.cpp:68:15
        #44 0x7f3e56f2c722 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:54
        #45 0x7f3e50c4a239 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6518:32
        #46 0x7f3e50bab2b9 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1707:25
        #47 0x7f3e50ba8db2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message&&) /ipc/glue/MessageChannel.cpp:1632:9
        #48 0x7f3e50baa371 in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1528:14
        #49 0x7f3e4f4b1a62 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:467:16
        #50 0x7f3e4f47806d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:780:26
        #51 0x7f3e4f475568 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:612:15
        #52 0x7f3e4f475c99 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:390:36
        #53 0x7f3e4f4be6a4 in operator() /xpcom/threads/TaskController.cpp:127:37
        #54 0x7f3e4f4be6a4 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #55 0x7f3e4f4983e7 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1180:16
        #56 0x7f3e4f4a214c in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #57 0x7f3e50bb2984 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #58 0x7f3e50a2c971 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #59 0x7f3e50a2c971 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #60 0x7f3e50a2c971 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #61 0x7f3e578b2fa7 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #62 0x7f3e5c7490af in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:870:20
        #63 0x7f3e50a2c971 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #64 0x7f3e50a2c971 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #65 0x7f3e50a2c971 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #66 0x7f3e5c7482d3 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:729:34
        #67 0x55596b1b147d in content_process_main(mozilla::Bootstrap*, int, char**) /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #68 0x55596b1b18b0 in main /browser/app/nsBrowserApp.cpp:327:18
        #69 0x7f3e742120b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
        #70 0x55596b100569 in _start (/home/jkratzer/builds/mc-asan/firefox+0x5e569)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3 in MOZ_Crash
    ==2364485==ABORTING
Attached file Testcase — 

    
    

    
  
Bugmon Analysis

Verified bug as reproducible on mozilla-central 20220415092909-7f6fc25d231f.

Unable to bisect testcase (Testcase reproduces on start build!):




Start: d26e6241a27381f7d94a055d1dc8297a9d7a7fc2 (20210416030733)

End: 7f6fc25d231faac14b0174d1f701b7488988bc3a (20220415092909)

BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)




Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

    
    

    
  
got a crash : https://crash-stats.mozilla.org/report/index/1d9f0459-2f80-4052-91fb-472c00220416#tab-bugzilla


Crash Signature: [@ mozilla::detail::InvalidArrayIndex_CRASH | gfxContext::PopClip ]

    
    

    
  
Looks like something in display list code. Miko, any thoughts?


Severity: -- → S4
Flags: needinfo?(mikokm)
Priority: -- → P3

    
  
Blocks: wr-fuzz

    
  
Assignee: nobody → mikokm
Status: NEW → ASSIGNED
Flags: needinfo?(mikokm)
Regressed by: 1764943

    
  
Regressed by: 1609786
No longer regressed by: 1764943

    
    

    
  
The testcase goes boom because clip-path receives invalid path due to missing initial move-to. This skips pushing the clip here.



    
    

    
  
Pushed by mikokm@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/19a759fd59cb
Apply empty clip if clip-path creation fails r=emilio

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/19a759fd59cb


Status: ASSIGNED → RESOLVED
Closed: 2 years ago

          status-firefox103:
          --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 103 Branch

    
    

    
  
Bugmon Analysis

Verified bug as fixed on rev mozilla-central 20220603034138-1377267c6dc1.

Removing bugmon keyword as no further action possible.  Please review the bug and re-add the keyword for further analysis.


Status: RESOLVED → VERIFIED

          status-firefox103:
          fixed → verified
Keywords: bugmon

    
    

    
  
Set release status flags based on info from the regressing bug 1609786



          status-firefox101:
          --- → affected

          status-firefox102:
          --- → affected

          status-firefox-esr91:
          --- → affected

    
    

    
  
The patch landed in nightly and beta is affected.

:miko, is this bug important enough to require an uplift?

If not please set status_beta to wontfix.


For more information, please visit auto_nag documentation.


Flags: needinfo?(mikokm)

    
  

          status-firefox102:
          affected → wontfix
Flags: needinfo?(mikokm)

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: