1800476 - Assertion failure: !frame->GetChildList(FrameChildListID::Overflow).FirstChild() (should have drained the overflow list above), at /layout/base/nsBidiPresUtils.cpp:1392

Status: NEW

(Core :: Layout: Text and Fonts, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 20e2590324e2 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 20e2590324e2 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !frame->GetChildList(FrameChildListID::Overflow).FirstChild() (should have drained the overflow list above), at /layout/base/nsBidiPresUtils.cpp:1392

    ==814177==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fa87c7e7e2c bp 0x7fff21f30590 sp 0x7fff21f30440 T814177)
    ==814177==The signal is caused by a WRITE memory access.
    ==814177==Hint: address points to the zero page.
        #0 0x7fa87c7e7e2c in nsBidiPresUtils::TraverseFrames(nsIFrame*, BidiParagraphData*) /layout/base/nsBidiPresUtils.cpp:1391:7
        #1 0x7fa87c7e74d9 in nsBidiPresUtils::TraverseFrames(nsIFrame*, BidiParagraphData*) /layout/base/nsBidiPresUtils.cpp:1394:9
        #2 0x7fa87c7e74d9 in nsBidiPresUtils::TraverseFrames(nsIFrame*, BidiParagraphData*) /layout/base/nsBidiPresUtils.cpp:1394:9
        #3 0x7fa87c7e74d9 in nsBidiPresUtils::TraverseFrames(nsIFrame*, BidiParagraphData*) /layout/base/nsBidiPresUtils.cpp:1394:9
        #4 0x7fa87c7e74d9 in nsBidiPresUtils::TraverseFrames(nsIFrame*, BidiParagraphData*) /layout/base/nsBidiPresUtils.cpp:1394:9
        #5 0x7fa87c7e74d9 in nsBidiPresUtils::TraverseFrames(nsIFrame*, BidiParagraphData*) /layout/base/nsBidiPresUtils.cpp:1394:9
        #6 0x7fa87c7e74d9 in nsBidiPresUtils::TraverseFrames(nsIFrame*, BidiParagraphData*) /layout/base/nsBidiPresUtils.cpp:1394:9
        #7 0x7fa87c7e6783 in nsBidiPresUtils::Resolve(nsBlockFrame*) /layout/base/nsBidiPresUtils.cpp:854:5
        #8 0x7fa87c8af2c1 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsBlockFrame.cpp:1430:54
        #9 0x7fa87c8d3529 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:1029:14
        #10 0x7fa87c8d2a89 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsCanvasFrame.cpp:755:7
        #11 0x7fa87c8d3529 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:1029:14
        #12 0x7fa87c91b910 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /layout/generic/nsGfxScrollFrame.cpp:841:3
        #13 0x7fa87c91c82b in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /layout/generic/nsGfxScrollFrame.cpp:977:3
        #14 0x7fa87c92141d in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGfxScrollFrame.cpp:1404:3
        #15 0x7fa87c8a3e76 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:1069:14
        #16 0x7fa87c8a35c4 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ViewportFrame.cpp:383:7
        #17 0x7fa87c79f17a in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /layout/base/PresShell.cpp:9661:11
        #18 0x7fa87c7c2c2f in mozilla::PresShell::ProcessReflowCommands(bool) /layout/base/PresShell.cpp:9833:24
        #19 0x7fa87c7a8789 in DoFlushLayout /layout/base/PresShell.cpp:9903:10
        #20 0x7fa87c7a8789 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4413:11
        #21 0x7fa87c76cc3d in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1474:5
        #22 0x7fa87c76cc3d in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2614:20
        #23 0x7fa87c77c442 in operator() /layout/base/nsRefreshDriver.cpp:1786:25
        #24 0x7fa87c77c442 in mozilla::detail::RunnableFunction<nsRefreshDriver::EnsureTimerStarted(nsRefreshDriver::EnsureTimerStartedFlags)::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #25 0x7fa87744d535 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:538:16
        #26 0x7fa877448b1c in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:851:26
        #27 0x7fa8774476ea in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:683:15
        #28 0x7fa877447a45 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:461:36
        #29 0x7fa877450e36 in operator() /xpcom/threads/TaskController.cpp:187:37
        #30 0x7fa877450e36 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #31 0x7fa8774667c8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1204:16
        #32 0x7fa87746cf3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #33 0x7fa878052c13 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #34 0x7fa877f78c88 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #35 0x7fa877f78b91 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #36 0x7fa877f78b91 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #37 0x7fa87c421b48 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:150:27
        #38 0x7fa87e657c6b in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:884:20
        #39 0x7fa878053ad9 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #40 0x7fa877f78c88 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #41 0x7fa877f78b91 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #42 0x7fa877f78b91 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #43 0x7fa87e6571fc in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:743:34
        #44 0x564268be6be0 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #45 0x564268be6be0 in main /browser/app/nsBrowserApp.cpp:359:18
        #46 0x7fa88b905d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #47 0x7fa88b905e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #48 0x564268bbd248 in _start (/home/jkratzer/builds/m-c-20221114085151-fuzzing-debug/firefox-bin+0x5b248) (BuildId: d633bff2a8149f90cb651606f90c2bfad553154e)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/base/nsBidiPresUtils.cpp:1391:7 in nsBidiPresUtils::TraverseFrames(nsIFrame*, BidiParagraphData*)
    ==814177==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Ting-Yu Lin [:TYLin] (UTC-8)]

This might be a duplicate of bug 1652990 because nsIFrame::kOverflowList is changed to FrameChildListID::Overflow in bug 1799732.

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20221118154632-3b5a8f67189b.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: f3f6b5125ed7ac306f03d6f7748bb459b104335a (20211119041143)
End: 20e2590324e26b5ebc2f86ade34286967e0a58a8 (20221114085151)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 4

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1800476 using build mozilla-central 20221114085151-20e2590324e2. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.