1826635 - Assertion failure: foundOwnPushedChild || !items.IsEmpty() || mDidPushItemsBitMayLie (The state bit stored in didPushItemsBit lied!), at /layout/generic/nsContainerFrame.cpp:1784

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev f29ff53e9e3b (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build f29ff53e9e3b --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: foundOwnPushedChild || !items.IsEmpty() || mDidPushItemsBitMayLie (The state bit stored in didPushItemsBit lied!), at /layout/generic/nsContainerFrame.cpp:1784

    ==39339==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6a0ba315e2 bp 0x7ffd5c627a10 sp 0x7ffd5c627970 T39339)
    ==39339==The signal is caused by a WRITE memory access.
    ==39339==Hint: address points to the zero page.
        #0 0x7f6a0ba315e2 in nsContainerFrame::NormalizeChildLists() /layout/generic/nsContainerFrame.cpp:1782:5
        #1 0x7f6a0ba47848 in nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsFlexContainerFrame.cpp:4409:3
        #2 0x7f6a0b9fb936 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:817:14
        #3 0x7f6a0b9f9bbc in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:221:7
        #4 0x7f6a0b9f91fc in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ViewportFrame.cpp:429:35
        #5 0x7f6a0b8f2231 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /layout/base/PresShell.cpp:9624:11
        #6 0x7f6a0b9165cf in mozilla::PresShell::ProcessReflowCommands(bool) /layout/base/PresShell.cpp:9802:22
        #7 0x7f6a0b8fb655 in DoFlushLayout /layout/base/PresShell.cpp:9873:10
        #8 0x7f6a0b8fb655 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4350:11
        #9 0x7f6a0b8bf11e in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1470:5
        #10 0x7f6a0b8bf11e in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2657:20
        #11 0x7f6a0b8c875d in TickDriver /layout/base/nsRefreshDriver.cpp:373:13
        #12 0x7f6a0b8c875d in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /layout/base/nsRefreshDriver.cpp:351:7
        #13 0x7f6a0b8c8663 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:367:5
        #14 0x7f6a0b8c8540 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:911:5
        #15 0x7f6a0b8c78aa in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:825:5
        #16 0x7f6a0b8c7076 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:746:5
        #17 0x7f6a0b8c6b89 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /layout/base/nsRefreshDriver.cpp:592:14
        #18 0x7f6a0b8c679d in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:549:9
        #19 0x7f6a0acc6e5b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncMainChild.cpp:66:15
        #20 0x7f6a0af8879e in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:223:78
        #21 0x7f6a06f5d4ac in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6230:32
        #22 0x7f6a06eea33a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1800:25
        #23 0x7f6a06ee6fb7 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1725:9
        #24 0x7f6a06ee7ae5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1525:3
        #25 0x7f6a06ee8e1f in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1623:14
        #26 0x7f6a06291df5 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:553:16
        #27 0x7f6a0628cf48 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:869:26
        #28 0x7f6a0628baba in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:700:15
        #29 0x7f6a0628be45 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:464:36
        #30 0x7f6a06295436 in operator() /xpcom/threads/TaskController.cpp:191:37
        #31 0x7f6a06295436 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:548:5
        #32 0x7f6a062aae77 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1239:16
        #33 0x7f6a062b13dd in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:479:10
        #34 0x7f6a06ef0283 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #35 0x7f6a06e12358 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:369:10
        #36 0x7f6a06e12261 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #37 0x7f6a06e12261 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #38 0x7f6a0b545208 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #39 0x7f6a0d79a05b in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:738:20
        #40 0x7f6a06ef1149 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #41 0x7f6a06e12358 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:369:10
        #42 0x7f6a06e12261 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #43 0x7f6a06e12261 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #44 0x7f6a0d799ba8 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:673:34
        #45 0x5638233fdf20 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #46 0x5638233fdf20 in main /browser/app/nsBrowserApp.cpp:353:18
        #47 0x7f6a19a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #48 0x7f6a19a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #49 0x5638233d4588 in _start (/home/jkratzer/builds/m-c-20230405093623-fuzzing-debug/firefox-bin+0x5b588) (BuildId: 66f0bbf8e15e90c4e7e7b1ce424089abfb3c351e)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/generic/nsContainerFrame.cpp:1782:5 in nsContainerFrame::NormalizeChildLists()
    ==39339==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Emily McDonough [:alaskanemily]]

Hey :dholbert can you take a look at this?

For what it's worth, I can't reproduce this with a several-day-old nightly debug build.

Comment 3

[Daniel Holbert [:dholbert]]

Looks like this is a regression from bug 1743890. TYLin, could you take a look?

(Specifically, this aborts with the reported assertion:

python3 -m fuzzfetch --build 2023-04-01  --debug --fuzzing -n firefox
python3 -m grizzly.replay ./firefox/firefox testcase.html 

...whereas the datestamp for the day before does not:

python3 -m fuzzfetch --build 2023-03-31  --debug --fuzzing -n firefox
python3 -m grizzly.replay ./firefox/firefox testcase.html

Comment 4

[Daniel Holbert [:dholbert]]

For what it's worth, I can't reproduce this with a several-day-old nightly debug build.

Note: in a regular build, the testcase throws a JS exception partway through (before aborting) due to using InspectorUtils, which seems to be a privileged API: https://searchfox.org/mozilla-central/rev/da8f8e5fd1cc02a9be7ce26b7d3f91deb18159bf/dom/chrome-webidl/InspectorUtils.webidl

Jason, would you mind generating a pernosco session for this issue?

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1743890

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230405212330-46a27404e36d.
The bug appears to have been introduced in the following build range:

Start: b528ceb6d1767d43a9ccce5c78c620cae8a30a24 (20230331154743)
End: 7776b8a21884544f62a889797508cd9dbeca6b56 (20230331180508)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=b528ceb6d1767d43a9ccce5c78c620cae8a30a24&tochange=7776b8a21884544f62a889797508cd9dbeca6b56

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 7

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 8

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Jason, would you mind generating a pernosco session for this issue?

Tyson told me that we can use pernosco-wanted to generate pernosco session on bugs with bugmon keyword, and it works :)

Comment 9

[Jason Kratzer [:jkratzer]]

Whoops. I added it before I read the last comment.

Comment 10

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1826635 - Fix a comment in ReflowChildren(). r?dholbert

SumOfChildrenBlockSizeProperty() was moved into PerFragmentFlexData in
Bug 1804997 Part 4 [1], and later it was renamed in Bug 1743890 Part 4 [2].

[1] https://hg.mozilla.org/mozilla-central/rev/0404d371c42f3e73b56678fe52a89f4f788ea9b5
[2] https://hg.mozilla.org/mozilla-central/rev/6064a73fc99f012a7400393bdc2ade89fbdf30f8

Comment 11

[Ting-Yu Lin [:TYLin] (PDT, UTC-7)]

Attachment: Bug 1826635 - Don't push flex item if available block-size is unconstrained. r?dholbert

Depends on D174992

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0888416e51aa
Fix a comment in ReflowChildren(). r=dholbert
https://hg.mozilla.org/integration/autoland/rev/b5103e911d59
Don't push flex item if available block-size is unconstrained. r=dholbert

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/39441 for changes under testing/web-platform/tests

Comment 14

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/0888416e51aa
https://hg.mozilla.org/mozilla-central/rev/b5103e911d59

Comment 15

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230409095525-b5103e911d59.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 16

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot