1836831 - stack-overflow in [@ mozilla::SVGUtils::GetBBox]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230526-d49f009b89ad (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

The DOM fuzzers have been reporting this issue frequently.

==31323==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe84625d58 (pc 0x5578f3bf29fe bp 0x7ffe84626590 sp 0x7ffe84625d60 T0)
    #0 0x5578f3bf29fe in __asan_memset /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:26:3
    #1 0x7fe9bc55c5b8 in BaseRect /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/BaseRect.h:50:22
    #2 0x7fe9bc55c5b8 in nsRect /builds/worker/workspace/obj-build/dist/include/nsRect.h:38:14
    #3 0x7fe9bc55c5b8 in ComputeSVGReferenceRect /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9467:10
    #4 0x7fe9bc55c5b8 in nsLayoutUtils::ComputeGeometryBox(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9609:16
    #5 0x7fe9bc398684 in RayReferenceData /builds/worker/checkouts/gecko/layout/base/MotionPathUtils.cpp:54:7
    #6 0x7fe9bc398684 in GenerateOffsetPathData /builds/worker/checkouts/gecko/layout/base/MotionPathUtils.cpp:320:48
    #7 0x7fe9bc398684 in mozilla::MotionPathUtils::ResolveMotionPath(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&) /builds/worker/checkouts/gecko/layout/base/MotionPathUtils.cpp:342:28
    #8 0x7fe9bce23206 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6218:15
    #9 0x7fe9bcbd78bc in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1526:48
    #10 0x7fe9ba192de9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #11 0x7fe9ba15cedc in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:496:22
    #12 0x7fe9ba15cd97 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #13 0x7fe9bcbd9b44 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1088:35
    #14 0x7fe9bcb46606 in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #15 0x7fe9bcb4a371 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #16 0x7fe9bcbd17bf in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:913:12
    #17 0x7fe9bc55c6c2 in ComputeSVGReferenceRect /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9477:11
    #18 0x7fe9bc55c6c2 in nsLayoutUtils::ComputeGeometryBox(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9609:16
    #19 0x7fe9bc398684 in RayReferenceData /builds/worker/checkouts/gecko/layout/base/MotionPathUtils.cpp:54:7
    #20 0x7fe9bc398684 in GenerateOffsetPathData /builds/worker/checkouts/gecko/layout/base/MotionPathUtils.cpp:320:48
    #21 0x7fe9bc398684 in mozilla::MotionPathUtils::ResolveMotionPath(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&) /builds/worker/checkouts/gecko/layout/base/MotionPathUtils.cpp:342:28
    #22 0x7fe9bce23206 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6218:15
    #23 0x7fe9bcbd78bc in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1526:48
    #24 0x7fe9ba192de9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #25 0x7fe9ba15cedc in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:496:22
    #26 0x7fe9ba15cd97 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #27 0x7fe9bcbd9b44 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1088:35
    #28 0x7fe9bcb46606 in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #29 0x7fe9bcb4a371 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #30 0x7fe9bcbd17bf in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:913:12
    #31 0x7fe9bc55c6c2 in ComputeSVGReferenceRect /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9477:11
    #32 0x7fe9bc55c6c2 in nsLayoutUtils::ComputeGeometryBox(nsIFrame*, mozilla::StyleGeometryBox) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9609:16
    #33 0x7fe9bc398684 in RayReferenceData /builds/worker/checkouts/gecko/layout/base/MotionPathUtils.cpp:54:7
    #34 0x7fe9bc398684 in GenerateOffsetPathData /builds/worker/checkouts/gecko/layout/base/MotionPathUtils.cpp:320:48
    #35 0x7fe9bc398684 in mozilla::MotionPathUtils::ResolveMotionPath(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&) /builds/worker/checkouts/gecko/layout/base/MotionPathUtils.cpp:342:28
    #36 0x7fe9bce23206 in mozilla::nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(nsIFrame const*, nsStyleTransformMatrix::TransformReferenceBox&, float) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6218:15
    #37 0x7fe9bcbd78bc in mozilla::SVGUtils::GetTransformMatrixInUserSpace(nsIFrame const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1526:48
    #38 0x7fe9ba192de9 in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool)::$_0::operator()(mozilla::dom::SVGElement const*, bool) const /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:479:13
    #39 0x7fe9ba15cedc in mozilla::GetCTMInternal(mozilla::dom::SVGElement*, bool, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:496:22
    #40 0x7fe9ba15cd97 in mozilla::SVGContentUtils::GetCTM(mozilla::dom::SVGElement*, bool) /builds/worker/checkouts/gecko/dom/svg/SVGContentUtils.cpp:569:10
    #41 0x7fe9bcbd9b44 in mozilla::SVGUtils::GetNonScalingStrokeTransform(nsIFrame const*, mozilla::gfx::BaseMatrix<double>*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:1088:35
    #42 0x7fe9bcb46606 in mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp:383:7
    #43 0x7fe9bcb4a371 in non-virtual thunk to mozilla::SVGGeometryFrame::GetBBoxContribution(mozilla::gfx::BaseMatrix<float> const&, unsigned int) /builds/worker/checkouts/gecko/layout/svg/SVGGeometryFrame.cpp
    #44 0x7fe9bcbd17bf in mozilla::SVGUtils::GetBBox(nsIFrame*, unsigned int, mozilla::gfx::BaseMatrix<double> const*) /builds/worker/checkouts/gecko/layout/svg/SVGUtils.cpp:913:12
    #45 0x7fe9bc55c6c2 in ComputeSVGReferenceRect /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:9477:11
    ...

Comment 1

[Robert Longson [:longsonr]]

I suspect this is a regression from bug 1821450

Comment 2

[Boris Chiou [:boris]]

Yes. Once I commented out the line I added, this testcase works properly without crash or other issues. I will check what happened.

Comment 3

[Boris Chiou [:boris]]

S3 because this is behind a pref.

Comment 4

[Alice0775 White]

Regression window:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=e6d63c2a651d697b4c42866c552b92b1719f5b9e&tochange=29fa69db2655e35810d121a98dabb0a6e3af6d8d

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1821450

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230608152955-256876c3862b.
The bug appears to have been introduced in the following build range:

Start: c49edd998af9a5b4552a4468db2eaef267147bbd (20230525223416)
End: d49f009b89ad3ae1616d96cb1d2d9234ef3f6cda (20230526005832)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=c49edd998af9a5b4552a4468db2eaef267147bbd&tochange=d49f009b89ad3ae1616d96cb1d2d9234ef3f6cda

Comment 7

[Mayank Bansal]

Crash: https://crash-stats.mozilla.org/report/index/3afb757a-6afc-435d-8985-a40b80231129#tab-bugzilla

Comment 8

[Boris Chiou [:boris]]

I guess this is similar to https://phabricator.services.mozilla.com/D194712. We just need a special handle for aFrame->StyleSVGReset()->HasNonScalingStroke() because this test case also use vector-effect: non-scaling-stroke.

Comment 9

[Robert Longson [:longsonr]]

Attachment: Bug 1836831 - don't try to resolve ray with StrokeBox when non-scaling-stroke is in effect r=boris

Comment 10

[Robert Longson [:longsonr]]

https://treeherder.mozilla.org/jobs?repo=try&revision=f27da29d1ccf9196f93210bd5edb7409005b3045

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9f710d42c811
don't try to resolve ray with StrokeBox when non-scaling-stroke is in effect r=boris

Comment 12

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/9f710d42c811

Comment 13

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20231206165851-52f516546de7.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.