1844429 - Hit MOZ_CRASH(ElementAt(aIndex = 4294967295, aLength = 0)) at /mfbt/Assertions.cpp:51

Status: NEW

(Core :: Layout: Grid, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 196cda3a1052 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 196cda3a1052 --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(ElementAt(aIndex = 4294967295, aLength = 0)) at /mfbt/Assertions.cpp:51

    =================================================================
    ==788112==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x5605f2f722cf bp 0x7ffdca289230 sp 0x7ffdca289230 T0)
    ==788112==The signal is caused by a WRITE memory access.
    ==788112==Hint: address points to the zero page.
        #0 0x5605f2f722cf in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:281:3
        #1 0x5605f2f722cf in mozilla::detail::InvalidArrayIndex_CRASH(unsigned long, unsigned long) /mfbt/Assertions.cpp:50:3
        #2 0x7f46f37d9d4a in nsGridContainerFrame::MasonryLayout(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsGridContainerFrame::SizingConstraint, mozilla::ReflowOutput&, nsReflowStatus&, nsGridContainerFrame::Fragmentainer*, nsSize const&) /layout/generic/nsGridContainerFrame.cpp
        #3 0x7f46f37deafa in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsSize const&, mozilla::ReflowOutput&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8466:18
        #4 0x7f46f37e20b1 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8740:11
        #5 0x7f46f3604fb7 in nsAbsoluteContainingBlock::ReflowAbsoluteFrame(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, nsIFrame*, nsReflowStatus&, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:817:14
        #6 0x7f46f3601d54 in nsAbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, nsAbsoluteContainingBlock::AbsPosReflowFlags, mozilla::OverflowAreas*) /layout/generic/nsAbsoluteContainingBlock.cpp:221:7
        #7 0x7f46f37dfb37 in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsSize const&, mozilla::ReflowOutput&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8540:37
        #8 0x7f46f37e20b1 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8740:11
        #9 0x7f46f366af02 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:893:14
        #10 0x7f46f37cc919 in nsGridContainerFrame::ReflowInFlowChild(nsIFrame*, nsGridContainerFrame::GridItemInfo const*, nsSize, mozilla::Maybe<int> const&, nsGridContainerFrame::Fragmentainer const*, nsGridContainerFrame::GridReflowInput const&, mozilla::LogicalRect const&, mozilla::ReflowOutput&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:7397:3
        #11 0x7f46f37d7f00 in nsGridContainerFrame::MasonryLayout(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsGridContainerFrame::SizingConstraint, mozilla::ReflowOutput&, nsReflowStatus&, nsGridContainerFrame::Fragmentainer*, nsSize const&) /layout/generic/nsGridContainerFrame.cpp:8345:11
        #12 0x7f46f37deafa in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsSize const&, mozilla::ReflowOutput&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8466:18
        #13 0x7f46f37e20b1 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8740:11
        #14 0x7f46f366af02 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:893:14
        #15 0x7f46f3669228 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsCanvasFrame.cpp:761:7
        #16 0x7f46f366af02 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:893:14
        #17 0x7f46f3725754 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /layout/generic/nsGfxScrollFrame.cpp:938:3
        #18 0x7f46f37285ed in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /layout/generic/nsGfxScrollFrame.cpp:1071:3
        #19 0x7f46f3733615 in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGfxScrollFrame.cpp:1508:3
        #20 0x7f46f360051d in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:933:14
        #21 0x7f46f35ff30a in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ViewportFrame.cpp:385:7
        #22 0x7f46f3397abc in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /layout/base/PresShell.cpp:9618:11
        #23 0x7f46f33e8137 in mozilla::PresShell::ProcessReflowCommands(bool) /layout/base/PresShell.cpp:9796:22
        #24 0x7f46f33aecda in DoFlushLayout /layout/base/PresShell.cpp:9867:10
        #25 0x7f46f33aecda in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4348:11
        #26 0x7f46eb3dc604 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1464:5
        #27 0x7f46eb3dc604 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /dom/base/Document.cpp:10916:16
        #28 0x7f46e980ba93 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:742:14
        #29 0x7f46e980f35a in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:680:5
        #30 0x7f46f76c757a in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:13886:23
        #31 0x7f46e79b9223 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:631:22
        #32 0x7f46e79bc744 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:535:10
        #33 0x7f46eb37bbbe in DoUnblockOnload /dom/base/Document.cpp:11704:18
        #34 0x7f46eb37bbbe in mozilla::dom::Document::UnblockOnload(bool) /dom/base/Document.cpp:11642:9
        #35 0x7f46eb3b453d in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8150:3
        #36 0x7f46eb4ea46b in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1164:18
        #37 0x7f46eb4ea46b in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #38 0x7f46eb4ea46b in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #39 0x7f46eb4ea46b in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #40 0x7f46eb4ea46b in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #41 0x7f46eb4ea46b in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
        #42 0x7f46eb4ea46b in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1213:13
        #43 0x7f46e757d95a in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:555:16
        #44 0x7f46e7567fc8 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:880:26
        #45 0x7f46e7564997 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:704:15
        #46 0x7f46e7565279 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:491:36
        #47 0x7f46e7585401 in operator() /xpcom/threads/TaskController.cpp:218:37
        #48 0x7f46e7585401 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #49 0x7f46e75afa13 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1199:16
        #50 0x7f46e75bd734 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #51 0x7f46e91ad54e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #52 0x7f46e8fd8e6a in RunInternal /ipc/chromium/src/base/message_loop.cc:370:10
        #53 0x7f46e8fd8e6a in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #54 0x7f46e8fd8e6a in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #55 0x7f46f29db409 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #56 0x7f46f889e2ee in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:717:20
        #57 0x7f46e8fd8e6a in RunInternal /ipc/chromium/src/base/message_loop.cc:370:10
        #58 0x7f46e8fd8e6a in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #59 0x7f46e8fd8e6a in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #60 0x7f46f889d8ea in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:652:34
        #61 0x5605f2dcfa3e in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #62 0x5605f2dcfa3e in main /browser/app/nsBrowserApp.cpp:375:18
        #63 0x7f470e4d2d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #64 0x7f470e4d2e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #65 0x5605f2cf9078 in _start (/home/jkratzer/builds/m-c-20230714094120-fuzzing-asan-opt/firefox+0x105078) (BuildId: cb19754cfe218b6dcefcb321f9dcee015c05fd4d)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:281:3 in MOZ_Crash
    ==788112==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230720035647-7d1e4a896dd8.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 78a43d5ba28e7c42c8380465a793dfa1eb6bf9f2 (20220721034738)
End: 196cda3a105202c8969a926a0637db0e0014c07d (20230714094120)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 3

[Daniel Holbert [:dholbert]]

The testcase uses masonry (and the crash itself is inside the MasonryLayout() function). That's an off-by-default experimental grid feature. Given that, I think we can safely call this S3.

Comment 4

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20230714094120-196cda3a1052) but not with tip (mozilla-central 20230818212320-e2305368eaae.)

The bug appears to have been fixed in the following build range:

Start: b5a2c9e3703b740b3dd3859a2083f66866f798ce (20230814150504)
End: 5b1987d52ae19ebe1b311fec0f664563b5bf198d (20230814165404)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=b5a2c9e3703b740b3dd3859a2083f66866f798ce&tochange=5b1987d52ae19ebe1b311fec0f664563b5bf198d

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 5

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

The original testcase no longer reproduces. However, the issue still occurs. I've attached a new testcase that reproduces the issue described in comment 0.

Comment 6

[Mayank Bansal]

crash from the attached html : https://crash-stats.mozilla.org/report/index/4ef8b518-3a0f-448c-9f13-420340240420