Closed Bug 1861716 Opened 1 year ago Closed 1 year ago

Assertion failure: lineLayout->GetCurrentICoord() == 0 (border/padding of rtc should have been suppressed), at /layout/generic/nsRubyBaseContainerFrame.cpp:823

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
121 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox119 --- unaffected
firefox120 --- unaffected
firefox121 --- verified

People

(Reporter: jkratzer, Assigned: jfkthame)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files)

Testcase
157 bytes, text/plain
Details
Bug 1861716 - Ensure we don't try to apply text-indent within ruby text container frame. r=#layout
48 bytes, text/x-phabricator-request
Details | Review

Testcase found while fuzzing mozilla-central rev 99f1297a102b (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 99f1297a102b --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: lineLayout->GetCurrentICoord() == 0 (border/padding of rtc should have been suppressed), at /layout/generic/nsRubyBaseContainerFrame.cpp:823

    ==165537==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f86fa54bf05 bp 0x7ffcb4c601a0 sp 0x7ffcb4c60160 T165537)
    ==165537==The signal is caused by a WRITE memory access.
    ==165537==Hint: address points to the zero page.
        #0 0x7f86fa54bf05 in nsRubyBaseContainerFrame::ReflowSpans(nsRubyBaseContainerFrame::RubyReflowInput const&) /layout/generic/nsRubyBaseContainerFrame.cpp:822:5
        #1 0x7f86fa54b24d in nsRubyBaseContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsRubyBaseContainerFrame.cpp:392:25
        #2 0x7f86fa535dc5 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /layout/generic/nsLineLayout.cpp:889:13
        #3 0x7f86fa54e91c in nsRubyFrame::ReflowSegment(nsPresContext*, mozilla::ReflowInput const&, int, int, nsRubyBaseContainerFrame*, nsReflowStatus&) /layout/generic/nsRubyFrame.cpp:197:29
        #4 0x7f86fa54e38f in nsRubyFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsRubyFrame.cpp:141:5
        #5 0x7f86fa535dc5 in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /layout/generic/nsLineLayout.cpp:889:13
        #6 0x7f86fa41e85f in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /layout/generic/nsBlockFrame.cpp:4998:15
        #7 0x7f86fa41da59 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /layout/generic/nsBlockFrame.cpp:4800:5
        #8 0x7f86fa419969 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /layout/generic/nsBlockFrame.cpp:4674:9
        #9 0x7f86fa415d44 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /layout/generic/nsBlockFrame.cpp:3646:5
        #10 0x7f86fa410773 in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /layout/generic/nsBlockFrame.cpp:3156:9
        #11 0x7f86fa40c43b in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /layout/generic/nsBlockFrame.cpp:1906:3
        #12 0x7f86fa40a423 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsBlockFrame.cpp:1552:9
        #13 0x7f86fa43061e in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:889:14
        #14 0x7f86fa42fa7d in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsCanvasFrame.cpp:760:7
        #15 0x7f86fa43061e in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:889:14
        #16 0x7f86fa4801b5 in nsHTMLScrollFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /layout/generic/nsGfxScrollFrame.cpp:938:3
        #17 0x7f86fa480fde in nsHTMLScrollFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /layout/generic/nsGfxScrollFrame.cpp:1071:3
        #18 0x7f86fa485c8c in nsHTMLScrollFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGfxScrollFrame.cpp:1508:3
        #19 0x7f86fa3fe37a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:930:14
        #20 0x7f86fa3fdb12 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ViewportFrame.cpp:386:7
        #21 0x7f86fa2e6c94 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /layout/base/PresShell.cpp:9607:11
        #22 0x7f86fa30fa6f in mozilla::PresShell::ProcessReflowCommands(bool) /layout/base/PresShell.cpp:9780:22
        #23 0x7f86fa2f0e18 in DoFlushLayout /layout/base/PresShell.cpp:9851:10
        #24 0x7f86fa2f0e18 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4305:11
        #25 0x7f86f65ef30f in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1472:5
        #26 0x7f86f65ef30f in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /dom/base/Document.cpp:10896:16
        #27 0x7f86f59ef1be in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:740:14
        #28 0x7f86f59f0691 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:678:5
        #29 0x7f86fb9afc2f in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:13811:23
        #30 0x7f86f4c165ef in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:631:22
        #31 0x7f86f4c17b30 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:535:10
        #32 0x7f86f65f425c in mozilla::dom::Document::DoUnblockOnload() /dom/base/Document.cpp:11681:18
        #33 0x7f86f65da306 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8131:3
        #34 0x7f86f668ce09 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1164:18
        #35 0x7f86f668ce09 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #36 0x7f86f668ce09 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #37 0x7f86f668ce09 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #38 0x7f86f668ce09 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #39 0x7f86f668ce09 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
        #40 0x7f86f668ce09 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1213:13
        #41 0x7f86f49d7287 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:549:16
        #42 0x7f86f49cee53 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:876:26
        #43 0x7f86f49cd697 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:699:15
        #44 0x7f86f49cdaf5 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:485:36
        #45 0x7f86f49daf96 in operator() /xpcom/threads/TaskController.cpp:211:37
        #46 0x7f86f49daf96 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #47 0x7f86f49f19a2 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1198:16
        #48 0x7f86f49f8a8d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #49 0x7f86f56b0095 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #50 0x7f86f55ca081 in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #51 0x7f86f55ca081 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #52 0x7f86f9eff628 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #53 0x7f86fc13a25b in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:721:20
        #54 0x7f86f56b0f76 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #55 0x7f86f55ca081 in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #56 0x7f86f55ca081 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #57 0x7f86fc139ac2 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:656:34
        #58 0x559c58290276 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #59 0x559c58290276 in main /browser/app/nsBrowserApp.cpp:375:18
        #60 0x7f8708d4fd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #61 0x7f8708d4fe3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #62 0x559c58265fa8 in _start (/home/jkratzer/builds/m-c-20231026091345-fuzzing-debug/firefox-bin+0x58fa8) (BuildId: a197a6135aa1b0734093d05a414912dab9da9678)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/generic/nsRubyBaseContainerFrame.cpp:822:5 in nsRubyBaseContainerFrame::ReflowSpans(nsRubyBaseContainerFrame::RubyReflowInput const&)
    ==165537==ABORTING
Attached file Testcase —

Verified bug as reproducible on mozilla-central 20231027211343-ec7d4cb306bc.
The bug appears to have been introduced in the following build range:

Start: f2961f6ece1fcfc72f7072a840013b0d4e7d5a71 (20231023140905)
End: f222bdcd6517e233cb62a3164afd50fd17a55e62 (20231023154805)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=f2961f6ece1fcfc72f7072a840013b0d4e7d5a71&tochange=f222bdcd6517e233cb62a3164afd50fd17a55e62

Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Jonathan, is it possible that this bug is regressed by bug 784648?

Flags: needinfo?(jfkthame)

(In reply to Ting-Yu Lin [:TYLin] (UTC-8) from comment #3)

Jonathan, is it possible that this bug is regressed by bug 784648?

Yeah, given the reported regression range that seems likely. Leaving needinfo flag until I've had more of a look....

Flags: needinfo?(jfkthame)
Regressed by: 784648
Assignee: nobody → jfkthame
Status: NEW → ASSIGNED

Set release status flags based on info from the regressing bug 784648

status-firefox119: --- → unaffected
status-firefox120: --- → unaffected
status-firefox121: --- → affected
status-firefox-esr115: --- → unaffected
Pushed by jkew@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/26a58e0274b4 Ensure we don't try to apply text-indent within ruby text container frame. r=TYLin
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/42862 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/26a58e0274b4

Status: ASSIGNED → RESOLVED
Closed: 1 year ago
status-firefox121: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 121 Branch
Upstream PR merged by moz-wptsync-bot

Verified bug as fixed on rev mozilla-central 20231101034446-251055c46bfc.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox121: fixed → verified
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: