Open Bug 1806900 Opened 1 year ago Updated 11 months ago

Assertion failure: item->mFrame == ph->GetOutOfFlowFrame(), at /layout/generic/nsGridContainerFrame.cpp:8003 , with masonry styling

Categories

(Core :: Layout: Grid, defect)

Product:
Core
Component:
Layout: Grid
Platform:
x86_64
Linux
Type:
defect

Tracking

()

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: bugmon, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file)

Testcase
674 bytes, text/plain
Details

Testcase found while fuzzing mozilla-central rev bd78e2e5b1fe (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build bd78e2e5b1fe --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: item->mFrame == ph->GetOutOfFlowFrame(), at /layout/generic/nsGridContainerFrame.cpp:8003

    ==37461==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fc840734e5d bp 0x7ffe25cdabd0 sp 0x7ffe25cda8a0 T37461)
    ==37461==The signal is caused by a WRITE memory access.
    ==37461==Hint: address points to the zero page.
        #0 0x7fc840734e5d in nsGridContainerFrame::MasonryLayout(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsGridContainerFrame::SizingConstraint, mozilla::ReflowOutput&, nsReflowStatus&, nsGridContainerFrame::Fragmentainer*, nsSize const&) /layout/generic/nsGridContainerFrame.cpp:8003:9
        #1 0x7fc840736022 in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsSize const&, mozilla::ReflowOutput&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8484:18
        #2 0x7fc8407376d0 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8758:11
        #3 0x7fc84067e866 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:817:14
        #4 0x7fc84067caec in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:221:7
        #5 0x7fc840759774 in nsIFrame::ReflowAbsoluteFrames(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, bool) /layout/generic/nsIFrame.cpp:6826:24
        #6 0x7fc8406fadfa in nsIFrame::FinishReflowWithAbsoluteFrames(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, bool) /layout/generic/nsIFrame.cpp:6793:3
        #7 0x7fc8406ab072 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsCanvasFrame.cpp:831:3
        #8 0x7fc8406ab599 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:1029:14
        #9 0x7fc8406f3c10 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /layout/generic/nsGfxScrollFrame.cpp:841:3
        #10 0x7fc8406f499f in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /layout/generic/nsGfxScrollFrame.cpp:977:3
        #11 0x7fc8406f94ad in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGfxScrollFrame.cpp:1404:3
        #12 0x7fc84067c306 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:1069:14
        #13 0x7fc84067ba54 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ViewportFrame.cpp:384:7
        #14 0x7fc8405765ea in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /layout/base/PresShell.cpp:9696:11
        #15 0x7fc84059a89f in mozilla::PresShell::ProcessReflowCommands(bool) /layout/base/PresShell.cpp:9868:24
        #16 0x7fc840580049 in DoFlushLayout /layout/base/PresShell.cpp:9938:10
        #17 0x7fc840580049 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4440:11
        #18 0x7fc840543e9d in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1462:5
        #19 0x7fc840543e9d in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2639:20
        #20 0x7fc8405537e2 in operator() /layout/base/nsRefreshDriver.cpp:1786:25
        #21 0x7fc8405537e2 in mozilla::detail::RunnableFunction<nsRefreshDriver::EnsureTimerStarted(nsRefreshDriver::EnsureTimerStartedFlags)::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
        #22 0x7fc83b1c34f5 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:538:16
        #23 0x7fc83b1beadc in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:851:26
        #24 0x7fc83b1bd6aa in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:683:15
        #25 0x7fc83b1bda05 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:461:36
        #26 0x7fc83b1c6e69 in operator() /xpcom/threads/TaskController.cpp:190:37
        #27 0x7fc83b1c6e69 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
        #28 0x7fc83b1dc7a8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1204:16
        #29 0x7fc83b1e2fed in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:474:10
        #30 0x7fc83ff680b8 in SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, (lambda at /dom/xhr/XMLHttpRequestMainThread.cpp:3074:29)> /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
        #31 0x7fc83ff680b8 in mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*, bool, mozilla::ErrorResult&) /dom/xhr/XMLHttpRequestMainThread.cpp:3073:10
        #32 0x7fc83ff66fbb in mozilla::dom::XMLHttpRequestMainThread::Send(mozilla::dom::Nullable<mozilla::dom::DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString> const&, mozilla::ErrorResult&) /dom/xhr/XMLHttpRequestMainThread.cpp
        #33 0x7fc83ddd7379 in mozilla::dom::XMLHttpRequest_Binding::send(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/XMLHttpRequestBinding.cpp:1682:24
        #34 0x7fc83e3510f2 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3287:13
        #35 0x7fc8426634ec in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:459:13
        #36 0x7fc842662e0f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:547:12
        #37 0x7fc842654822 in CallFromStack /js/src/vm/Interpreter.cpp:619:10
        #38 0x7fc842654822 in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3379:16
        #39 0x7fc84264898e in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:431:13
        #40 0x7fc842662d0b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:579:13
        #41 0x7fc84266424c in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:646:8
        #42 0x7fc84271dbfc in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #43 0x7fc83e109e6e in mozilla::dom::Function::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/FunctionBinding.cpp:50:8
        #44 0x7fc83cdb27de in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject>>(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:71:12
        #45 0x7fc83cdb2583 in mozilla::dom::CallbackTimeoutHandler::Call(char const*) /dom/base/TimeoutHandler.cpp:167:29
        #46 0x7fc83ca8b1c6 in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) /dom/base/nsGlobalWindowInner.cpp:6511:38
        #47 0x7fc83cdc3935 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /dom/base/TimeoutManager.cpp:903:44
        #48 0x7fc83cdb0189 in mozilla::dom::TimeoutExecutor::MaybeExecute() /dom/base/TimeoutExecutor.cpp:179:11
        #49 0x7fc83cdb0727 in Notify /dom/base/TimeoutExecutor.cpp:246:5
        #50 0x7fc83cdb0727 in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /dom/base/TimeoutExecutor.cpp
        #51 0x7fc83b1cfeeb in operator() /xpcom/threads/nsTimerImpl.cpp:657:44
        #52 0x7fc83b1cfeeb in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:661:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:662:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
        #53 0x7fc83b1cfeeb in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:661:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:662:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
        #54 0x7fc83b1cfeeb in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:661:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:662:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:902:12
        #55 0x7fc83b1cfeeb in match<(lambda at /xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:661:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:662:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:857:12
        #56 0x7fc83b1cfeeb in nsTimerImpl::Fire(int) /xpcom/threads/nsTimerImpl.cpp:655:22
        #57 0x7fc83b1cfa0a in nsTimerEvent::Run() /xpcom/threads/TimerThread.cpp:365:11
        #58 0x7fc83b1f3c3d in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /xpcom/threads/ThrottledEventQueue.cpp:254:22
        #59 0x7fc83b1f04f1 in mozilla::ThrottledEventQueue::Inner::Executor::Run() /xpcom/threads/ThrottledEventQueue.cpp:81:15
        #60 0x7fc83b1c34f5 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:538:16
        #61 0x7fc83b1beadc in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:851:26
        #62 0x7fc83b1bd6aa in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:683:15
        #63 0x7fc83b1bda05 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:461:36
        #64 0x7fc83b1c6e69 in operator() /xpcom/threads/TaskController.cpp:190:37
        #65 0x7fc83b1c6e69 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
        #66 0x7fc83b1dc7a8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1204:16
        #67 0x7fc83b1e2fed in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:474:10
        #68 0x7fc83bdd4aa3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #69 0x7fc83bcf9a88 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #70 0x7fc83bcf9991 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #71 0x7fc83bcf9991 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #72 0x7fc8401f2298 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:150:27
        #73 0x7fc84241f4bb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:884:20
        #74 0x7fc83bdd59b9 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #75 0x7fc83bcf9a88 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #76 0x7fc83bcf9991 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #77 0x7fc83bcf9991 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #78 0x7fc84241ea4c in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:743:34
        #79 0x55f4d967dca0 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #80 0x55f4d967dca0 in main /browser/app/nsBrowserApp.cpp:359:18
        #81 0x7fc84f126d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #82 0x7fc84f126e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #83 0x55f4d9654308 in _start (/home/jkratzer/builds/m-c-20221213041109-fuzzing-debug/firefox-bin+0x5b308) (BuildId: be85c748d6fca08f1793e5d193145523e881d675)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/generic/nsGridContainerFrame.cpp:8003:9 in nsGridContainerFrame::MasonryLayout(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsGridContainerFrame::SizingConstraint, mozilla::ReflowOutput&, nsReflowStatus&, nsGridContainerFrame::Fragmentainer*, nsSize const&)
    ==37461==ABORTING
Attached file Testcase — 

    
    

    
  
Verified bug as reproducible on mozilla-central 20221221212123-1de20be14b0d.

Unable to bisect testcase (Testcase reproduces on start build!):




Start: afa784e31b58d71cd71ead41ae260d8162801678 (20211223093436)

End: bd78e2e5b1fe852424cf7c035580e44de70ac135 (20221213041109)

BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)




Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Blocks: masonry
Summary: Assertion failure: item->mFrame == ph->GetOutOfFlowFrame(), at /layout/generic/nsGridContainerFrame.cpp:8003 → Assertion failure: item->mFrame == ph->GetOutOfFlowFrame(), at /layout/generic/nsGridContainerFrame.cpp:8003 , with masonry styling

    
    

    
  
S3 given the testcase uses masonry which we're not shipping beyond Nightly yet.


Severity: -- → S3

    
    

    
  
Bugmon was unable reproduce this issue.

Removing bugmon keyword as no further action possible.  Please review the bug and re-add the keyword for further analysis.


Keywords: bugmon

    
    

    
  
A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues.  This issue has been corrected.  Re-enabling bugmon.


Keywords: bugmon

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: