1910803 - Assertion failure: mListLink == aOther.mListLink (comparing iterators over different lists), at /builds/worker/workspace/obj-build/dist/include/nsLineBox.h:720

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240725-d2663ba77131 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid> --repeat 10

Assertion failure: mListLink == aOther.mListLink (comparing iterators over different lists), at /builds/worker/workspace/obj-build/dist/include/nsLineBox.h:720

#0 0x74487b4934bb in operator!= /builds/worker/workspace/obj-build/dist/include/nsLineBox.h:719:5
#1 0x74487b4934bb in mozilla::a11y::AreFramesOnDifferentLines(nsIFrame*, nsIFrame*) /builds/worker/checkouts/gecko/accessible/base/TextLeafRange.cpp:229:36
#2 0x74487b47b4d3 in IsLineBreakContinuation /builds/worker/checkouts/gecko/accessible/base/TextLeafRange.cpp:577:10
#3 0x74487b47b4d3 in mozilla::a11y::TextLeafPoint::FindNextLineStartSameLocalAcc(bool) const /builds/worker/checkouts/gecko/accessible/base/TextLeafRange.cpp:765:9
#4 0x74487b4acc08 in mozilla::a11y::LocalAccessible::BundleFieldsForCache(unsigned long, mozilla::a11y::CacheUpdateType) /builds/worker/checkouts/gecko/accessible/generic/LocalAccessible.cpp:3709:34
#5 0x74487b4d92cd in mozilla::a11y::DocAccessibleChild::SerializeAcc(mozilla::a11y::LocalAccessible*) /builds/worker/checkouts/gecko/accessible/ipc/DocAccessibleChild.cpp:64:15
#6 0x74487b4d9715 in mozilla::a11y::DocAccessibleChild::InsertIntoIpcTree(mozilla::a11y::LocalAccessible*, bool) /builds/worker/checkouts/gecko/accessible/ipc/DocAccessibleChild.cpp:97:24
#7 0x74487b4a7706 in mozilla::a11y::LocalAccessible::HandleAccEvent(mozilla::a11y::AccEvent*) /builds/worker/checkouts/gecko/accessible/generic/LocalAccessible.cpp:870:19
#8 0x74487b472be0 in nsEventShell::FireEvent(mozilla::a11y::AccEvent*) /builds/worker/checkouts/gecko/accessible/base/nsEventShell.cpp:46:15
#9 0x74487b472583 in mozilla::a11y::NotificationController::ProcessMutationEvents() /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:617:7
#10 0x74487b473a8d in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:993:3
#11 0x74487ae52aa5 in nsRefreshDriver::TickObserverArray(unsigned int, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2481:10
#12 0x74487ae4fadf in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2724:8
#13 0x74487ae58611 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:13
#14 0x74487ae58611 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:346:7
#15 0x74487ae58510 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:362:5
#16 0x74487ae583ad in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:952:5
#17 0x74487ae5769c in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:862:5
#18 0x74487ae56a29 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:593:14
#19 0x74487a2d1b3b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#20 0x74487a54d787 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:222:78
#21 0x74487a4823a0 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8172:32
#22 0x7448763267cf in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1820:25
#23 0x744876323522 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1739:9
#24 0x7448763241a2 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1530:3
#25 0x7448763252ef in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1630:14
#26 0x7448757ae8a7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:618:16
#27 0x7448757a4316 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:945:26
#28 0x7448757a2d27 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:768:15
#29 0x7448757a31a5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:554:36
#30 0x7448757b2279 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:271:37
#31 0x7448757b2279 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#32 0x7448757c5bfd in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1204:16
#33 0x7448757cc8ff in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#34 0x74487632c303 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5
#35 0x744876282f71 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#36 0x744876282f71 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#37 0x74487aacbce8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#38 0x74487ab84964 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33
#39 0x74487ba1c64b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:714:20
#40 0x74487632d1a6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#41 0x744876282f71 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#42 0x744876282f71 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#43 0x74487ba1bedb in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:649:34
#44 0x5a0ad5f1e17f in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#45 0x5a0ad5f1e17f in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:378:18
#46 0x744888a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#47 0x744888a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#48 0x5a0ad5ef3bb8 in _start (/home/user/workspace/browsers/m-c-20240730164742-fuzzing-debug/firefox-bin+0x58bb8) (BuildId: 696736f42c0ef67fd9e1335017affdd98fdc3008)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

prefs.js for bugmon

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240731034758-fe23e201d6cd.
The bug appears to have been introduced in the following build range:

Start: aea7eb6cb0058cd2f3e96760cdf445eb394f3b58 (20240527001707)
End: 808efd1651fac935c2f7cb4adc818364aac241ef (20240527062354)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=aea7eb6cb0058cd2f3e96760cdf445eb394f3b58&tochange=808efd1651fac935c2f7cb4adc818364aac241ef

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Setting Regressed by field after analyzing regression range found by bugmon in comment #2.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1897597

:Jamie, since you are the author of the regressor, bug 1897597, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 5

[James Teh [:Jamie]]

:jfkthame, I'm wondering if this might be a layout bug. As far as I can tell, we're doing everything we can in this function to ensure that we give layout what it wants:

1. We call GetContainingBlockForLine on both frames. We use both the block frame and the line frame returned therefrom.
2. If the returned blocks are different, we don't try to go any further. That should prevent a situation where we ask a block for a line it doesn't contain or try to compare lines in different blocks.
3. This is done in the a11y refresh tick, so layout should be in a safe state for us to poke it.
4. This is all done sync, so there shouldn't be a situation where layout mutates such that we have a dead frame or something like that.

Is there something else I need to do here to ensure this doesn't happen?

Comment 6

[Jonathan Kew [:jfkthame]]

I suspect what could be happening is that one of the frames is in the block's main in-flow line list (its mLines) and the other is in an overflow list. So then it's not valid to compare their LineIterators.

If that's a correct guess, then what you need to do is to check that the nsBlockInFlowLineIterators' current line-lists are the same before attempting to compare their GetLine():

-    return !found || it1.GetLine() != it2.GetLine();
+    return !found || it1.GetLineList() != it2.GetLineList() || it1.GetLine() != it2.GetLine();

Comment 7

[James Teh [:Jamie]]

Attachment: Bug 1910803: When checking if frames are on different lines in a11y, check if the frames are in different line lists before comparing their LineIterators.

For example, one of the frames could be in the block's main in-flow line list and the other could be in an overflow list.
When this happens, it's not valid to compare LineIterators, so we must compare the line lists first.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1897597

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e9a29a1009b6
When checking if frames are on different lines in a11y, check if the frames are in different line lists before comparing their LineIterators. r=morgan

Comment 10

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/e9a29a1009b6

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:Jamie, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox130 to wontfix.

For more information, please visit BugBot documentation.

Comment 12

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20240808093537-22f4cf67e8ad.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 13

[James Teh [:Jamie]]

This triggers an assertion, but not a crash and is thus not user visible.