Open Bug 1807767 Opened 1 year ago Updated 5 months ago

Assertion failure: item->mFrame == ph->GetOutOfFlowFrame(), at /layout/generic/nsGridContainerFrame.cpp:8003

Categories

(Core :: Layout: Grid, defect)

Product:
Core
Component:
Layout: Grid
Platform:
x86_64
Linux
Type:
defect

Tracking

()

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: bugmon, crash, testcase, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(1 file)

Testcase
844 bytes, text/plain
Details

Testcase found while fuzzing mozilla-central rev bd78e2e5b1fe (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build bd78e2e5b1fe --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: item->mFrame == ph->GetOutOfFlowFrame(), at /layout/generic/nsGridContainerFrame.cpp:8003

    ==55507==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f3898734e5d bp 0x7ffd896d0ad0 sp 0x7ffd896d07a0 T55507)
    ==55507==The signal is caused by a WRITE memory access.
    ==55507==Hint: address points to the zero page.
        #0 0x7f3898734e5d in nsGridContainerFrame::MasonryLayout(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsGridContainerFrame::SizingConstraint, mozilla::ReflowOutput&, nsReflowStatus&, nsGridContainerFrame::Fragmentainer*, nsSize const&) /layout/generic/nsGridContainerFrame.cpp:8003:9
        #1 0x7f3898736022 in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsSize const&, mozilla::ReflowOutput&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8484:18
        #2 0x7f38987376d0 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8758:11
        #3 0x7f389867e866 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:817:14
        #4 0x7f389867caec in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:221:7
        #5 0x7f389873674e in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsSize const&, mozilla::ReflowOutput&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8558:37
        #6 0x7f38987376d0 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8758:11
        #7 0x7f389867e866 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:817:14
        #8 0x7f389867caec in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:221:7
        #9 0x7f389873674e in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsSize const&, mozilla::ReflowOutput&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8558:37
        #10 0x7f38987376d0 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8758:11
        #11 0x7f389867e866 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:817:14
        #12 0x7f389867caec in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:221:7
        #13 0x7f389867c10c in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ViewportFrame.cpp:428:35
        #14 0x7f38985765ea in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /layout/base/PresShell.cpp:9696:11
        #15 0x7f389859a89f in mozilla::PresShell::ProcessReflowCommands(bool) /layout/base/PresShell.cpp:9868:24
        #16 0x7f3898580049 in DoFlushLayout /layout/base/PresShell.cpp:9938:10
        #17 0x7f3898580049 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4440:11
        #18 0x7f3898543e9d in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1462:5
        #19 0x7f3898543e9d in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2639:20
        #20 0x7f389854d32d in TickDriver /layout/base/nsRefreshDriver.cpp:374:13
        #21 0x7f389854d32d in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /layout/base/nsRefreshDriver.cpp:352:7
        #22 0x7f389854d233 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:368:5
        #23 0x7f389854d110 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:912:5
        #24 0x7f389854c47a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:826:5
        #25 0x7f389854bc36 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:747:5
        #26 0x7f389854b749 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /layout/base/nsRefreshDriver.cpp:593:14
        #27 0x7f389854b35d in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:550:9
        #28 0x7f3897a09ceb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncMainChild.cpp:68:15
        #29 0x7f3897c90a08 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:78
        #30 0x7f3893e36a3a in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6306:32
        #31 0x7f3893dcf21a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1756:25
        #32 0x7f3893dcbe77 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1681:9
        #33 0x7f3893dcc9c5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1481:3
        #34 0x7f3893dcdcff in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1579:14
        #35 0x7f38931c34f5 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:538:16
        #36 0x7f38931beadc in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:851:26
        #37 0x7f38931bd6aa in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:683:15
        #38 0x7f38931bda05 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:461:36
        #39 0x7f38931c6df6 in operator() /xpcom/threads/TaskController.cpp:187:37
        #40 0x7f38931c6df6 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
        #41 0x7f38931dc7a8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1204:16
        #42 0x7f38931e2fed in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:474:10
        #43 0x7f3893dd4af3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #44 0x7f3893cf9a88 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #45 0x7f3893cf9991 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #46 0x7f3893cf9991 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #47 0x7f38981f2298 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:150:27
        #48 0x7f389a41f4bb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:884:20
        #49 0x7f3893dd59b9 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #50 0x7f3893cf9a88 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #51 0x7f3893cf9991 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #52 0x7f3893cf9991 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #53 0x7f389a41ea4c in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:743:34
        #54 0x55ddafc51ca0 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #55 0x55ddafc51ca0 in main /browser/app/nsBrowserApp.cpp:359:18
        #56 0x7f38a7d45d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #57 0x7f38a7d45e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #58 0x55ddafc28308 in _start (/home/jkratzer/builds/m-c-20221213041109-fuzzing-debug/firefox-bin+0x5b308) (BuildId: be85c748d6fca08f1793e5d193145523e881d675)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/generic/nsGridContainerFrame.cpp:8003:9 in nsGridContainerFrame::MasonryLayout(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsGridContainerFrame::SizingConstraint, mozilla::ReflowOutput&, nsReflowStatus&, nsGridContainerFrame::Fragmentainer*, nsSize const&)
    ==55507==ABORTING
Attached file Testcase — 

    
    

    
  
Verified bug as reproducible on mozilla-central 20221228044022-cadcf8d9a79e.

Unable to bisect testcase (Testcase reproduces on start build!):




Start: 153a98aa1de7f89d97d80d31d96f4113cb9174a0 (20211229092739)

End: bd78e2e5b1fe852424cf7c035580e44de70ac135 (20221213041109)

BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)




Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

    
    

    
  
Classifying as S3, given this is a null deref (assumed to be not-exploitable) correctness assertion-failure in a not-yet-shipped-beyond-Nightly feature (grid masonry).


Blocks: masonry
Severity: -- → S3

    
    

    
  
Got a crash from the testcase on Win11x64 Nightly: https://crash-stats.mozilla.org/report/index/8dbf3a6e-0974-4201-af28-4efde0230102


Crash Signature: [@ nsGridContainerFrame::MasonryLayout ]
Keywords: crash

    
    

    
  
Bugmon was unable reproduce this issue.

Removing bugmon keyword as no further action possible.  Please review the bug and re-add the keyword for further analysis.


Keywords: bugmon

    
    

    
  
A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues.  This issue has been corrected.  Re-enabling bugmon.


Keywords: bugmon

    
  
See Also:  → 1855592

    
  
Duplicate of this bug: 1855592

    
  
See Also: 1855592 → 

    
  
Duplicate of this bug: 1864588

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: