1806902 - Assertion failure: !frame->HidesContent() (Should have unobserved element skipping its contents.), at /dom/base/ResizeObserver.cpp:563

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev bd78e2e5b1fe (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build bd78e2e5b1fe --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !frame->HidesContent() (Should have unobserved element skipping its contents.), at /dom/base/ResizeObserver.cpp:563

    ==40170==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fc10c30e611 bp 0x7ffff78321a0 sp 0x7ffff7832130 T40170)
    ==40170==The signal is caused by a WRITE memory access.
    ==40170==Hint: address points to the zero page.
        #0 0x7fc10c30e611 in mozilla::dom::LastRememberedSizeCallback(mozilla::dom::Sequence<mozilla::OwningNonNull<mozilla::dom::ResizeObserverEntry>> const&, mozilla::dom::ResizeObserver&) /dom/base/ResizeObserver.cpp:562:5
        #1 0x7fc10c30bbd1 in mozilla::dom::ResizeObserver::BroadcastActiveObservations() /dom/base/ResizeObserver.cpp:443:5
        #2 0x7fc10c31014d in mozilla::dom::ResizeObserverController::BroadcastAllActiveObservations() /dom/base/ResizeObserverController.cpp:190:34
        #3 0x7fc10c30f39e in mozilla::dom::ResizeObserverController::Notify() /dom/base/ResizeObserverController.cpp:136:29
        #4 0x7fc10fafa622 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2550:12
        #5 0x7fc10fb0432d in TickDriver /layout/base/nsRefreshDriver.cpp:374:13
        #6 0x7fc10fb0432d in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /layout/base/nsRefreshDriver.cpp:352:7
        #7 0x7fc10fb04233 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:368:5
        #8 0x7fc10fb04110 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:912:5
        #9 0x7fc10fb0347a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:826:5
        #10 0x7fc10fb02c36 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:747:5
        #11 0x7fc10fb02749 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /layout/base/nsRefreshDriver.cpp:593:14
        #12 0x7fc10fb0235d in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:550:9
        #13 0x7fc10efc0ceb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncMainChild.cpp:68:15
        #14 0x7fc10f247a08 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:78
        #15 0x7fc10b3eda3a in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6306:32
        #16 0x7fc10b38621a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1756:25
        #17 0x7fc10b382e77 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1681:9
        #18 0x7fc10b3839c5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1481:3
        #19 0x7fc10b384cff in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1579:14
        #20 0x7fc10a77a4f5 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:538:16
        #21 0x7fc10a775adc in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:851:26
        #22 0x7fc10a7746aa in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:683:15
        #23 0x7fc10a774a05 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:461:36
        #24 0x7fc10a77de69 in operator() /xpcom/threads/TaskController.cpp:190:37
        #25 0x7fc10a77de69 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
        #26 0x7fc10a7937a8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1204:16
        #27 0x7fc10a799fed in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:474:10
        #28 0x7fc10b38baa3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #29 0x7fc10b2b0a88 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #30 0x7fc10b2b0991 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #31 0x7fc10b2b0991 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #32 0x7fc10f7a9298 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:150:27
        #33 0x7fc1119d64bb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:884:20
        #34 0x7fc10b38c9b9 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #35 0x7fc10b2b0a88 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #36 0x7fc10b2b0991 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #37 0x7fc10b2b0991 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #38 0x7fc1119d5a4c in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:743:34
        #39 0x5632e4d90ca0 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #40 0x5632e4d90ca0 in main /browser/app/nsBrowserApp.cpp:359:18
        #41 0x7fc11decdd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #42 0x7fc11decde3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #43 0x5632e4d67308 in _start (/home/jkratzer/builds/m-c-20221213041109-fuzzing-debug/firefox-bin+0x5b308) (BuildId: be85c748d6fca08f1793e5d193145523e881d675)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/base/ResizeObserver.cpp:562:5 in mozilla::dom::LastRememberedSizeCallback(mozilla::dom::Sequence<mozilla::OwningNonNull<mozilla::dom::ResizeObserverEntry>> const&, mozilla::dom::ResizeObserver&)
    ==40170==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1806902 using build mozilla-central 20221213041109-bd78e2e5b1fe. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1800955

Comment 4

[Oriol Brufau [:Oriol]]

The problem seems that nsIFrame::Init can do element->ClearContentRelevancy();.
But probably that should only happen when the frame is primary?

Comment 5

[Oriol Brufau [:Oriol]]

Attachment: Bug 1806902 - Avoid assert failure in LastRememberedSizeCallback. r?emilio

HandleLastRememberedSize() only observes an element when HidesContent()
is false, so LastRememberedSizeCallback() expects it to still be false.

The problem was that it could change due to nsIFrame::Init() doing
ClearContentRelevancy().

It seems weird to use ClearContentRelevancy() for non-primary frames,
so this patch adds a InitPrimaryFrame() method which is called when a
frame becomes primary, and takes care of ClearContentRelevancy() and
HandleLastRememberedSize().

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b9af9ace5269
Avoid assert failure in LastRememberedSizeCallback. r=emilio

Comment 7

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/37681 for changes under testing/web-platform/tests

Comment 8

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/b9af9ace5269

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:Oriol, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox109 to wontfix.

For more information, please visit auto_nag documentation.

Comment 10

[Oriol Brufau [:Oriol]]

Doesn't require an uplift because the problem only happens with content-visibility: auto, which is disabled by default.

Comment 11

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot