1928713 - const _Tp &std::clamp(const _Tp &, const _Tp &, const _Tp &) [_Tp = int]: Assertion '!(__hi < __lo)' failed.

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20241031-2cc133b3c099 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

This was found by the extra checks enabled by bug 1270832.

/builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/stl_algo.h:3721: const _Tp &std::clamp(const _Tp &, const _Tp &, const _Tp &) [_Tp = int]: Assertion '!(__hi < __lo)' failed.

#0 0x7b2ae58969fc in __pthread_kill_implementation nptl/pthread_kill.c:44:76
#1 0x7b2ae58969fc in __pthread_kill_internal nptl/pthread_kill.c:78:10
#2 0x7b2ae58969fc in pthread_kill nptl/pthread_kill.c:89:10
#3 0x7b2ae5842475 in gsignal signal/../sysdeps/posix/raise.c:26:13
#4 0x7b2ae58287f2 in abort stdlib/abort.c:79:7
#5 0x7b2adb9b95ad in __replacement_assert /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/x86_64-linux-gnu/c++/8/bits/c++config.h:447:5
#6 0x7b2adb9b95ad in int const& std::clamp<int>(int const&, int const&, int const&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/stl_algo.h:3721:7
#7 0x7b2adb9b936c in nsLayoutUtils::GetFirstLinePosition(mozilla::WritingMode, nsIFrame const*, nsLayoutUtils::LinePosition*) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5548:30
#8 0x7b2adb9b8e66 in nsLayoutUtils::GetFirstLineBaseline(mozilla::WritingMode, nsIFrame const*, int*) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5484:8
#9 0x7b2adba9c571 in ResolvedAscent /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:411:24
#10 0x7b2adba9c571 in nsFlexContainerFrame::PopulateReflowOutput(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, mozilla::LogicalSize const&, mozilla::LogicalMargin const&, int, bool, int, nsReflowStatus const&, nsFlexContainerFrame::FlexboxAxisTracker const&, nsFlexContainerFrame::FlexLayoutResult&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:6094:25
#11 0x7b2adba98601 in nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:4782:3
#12 0x7b2adba73d94 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#13 0x7b2adba0c297 in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:914:3
#14 0x7b2adba0cd40 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1049:3
#15 0x7b2adba0f21d in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1509:3
#16 0x7b2adba73d94 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#17 0x7b2adba905e2 in nsFlexContainerFrame::MeasureBSizeForFlexItem(nsFlexContainerFrame::FlexItem&, mozilla::ReflowInput&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:2031:3
#18 0x7b2adba97313 in nsFlexContainerFrame::SizeItemInCrossAxis(mozilla::ReflowInput&, nsFlexContainerFrame::FlexItem&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:4525:7
#19 0x7b2adba99d53 in nsFlexContainerFrame::DoFlexLayout(mozilla::ReflowInput const&, int, int, nsFlexContainerFrame::FlexboxAxisTracker const&, int, int, nsTArray<nsFlexContainerFrame::StrutInfo>&, ComputedFlexContainerInfo*) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:5314:9
#20 0x7b2adba97c0a in nsFlexContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:4645:11
#21 0x7b2adba73d94 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#22 0x7b2adba66f0f in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:710:7
#23 0x7b2adba73d94 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:892:14
#24 0x7b2adba0c297 in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:914:3
#25 0x7b2adba0cd40 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1049:3
#26 0x7b2adba0f21d in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1509:3
#27 0x7b2adba7dbc1 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:933:14
#28 0x7b2adba389e0 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:358:7
#29 0x7b2adb90a494 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9986:11
#30 0x7b2adb93342f in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10156:22
#31 0x7b2adb91411f in DoFlushLayout /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10203:10
#32 0x7b2adb91411f in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4426:9
#33 0x7b2adb8d92de in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1456:5
#34 0x7b2adb8d92de in nsRefreshDriver::FlushLayoutOnPendingDocsAndFixUpFocus() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2195:31
#35 0x7b2adb8d81d9 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2772:3
#36 0x7b2adb8e13a1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:13
#37 0x7b2adb8e13a1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:346:7
#38 0x7b2adb8e12a0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:362:5
#39 0x7b2adb8e113d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:948:5
#40 0x7b2adb8e046c in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:858:5
#41 0x7b2adb8df7f9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:593:14
#42 0x7b2adad2767b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#43 0x7b2adafba2e7 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:235:78
#44 0x7b2ad68f3a7d in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:5428:32
#45 0x7b2ad688bfbf in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1726:25
#46 0x7b2ad6888f42 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1653:9
#47 0x7b2ad6889bc2 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1444:3
#48 0x7b2ad688ad0f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1544:14
#49 0x7b2ad5ced747 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:618:16
#50 0x7b2ad5ce2fa9 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:945:26
#51 0x7b2ad5ce19e7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:768:15
#52 0x7b2ad5ce1e65 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:554:36
#53 0x7b2ad5cf1126 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:268:37
#54 0x7b2ad5cf1126 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#55 0x7b2ad5d049db in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1155:16
#56 0x7b2ad5d0b6bf in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#57 0x7b2ad6891b45 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#58 0x7b2ad67e3f41 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#59 0x7b2ad67e3f41 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#60 0x7b2adb549e08 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#61 0x7b2adb5fb1d8 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33
#62 0x7b2adc4d72ab in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:651:20
#63 0x7b2ad6892996 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#64 0x7b2ad67e3f41 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#65 0x7b2ad67e3f41 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#66 0x7b2adc4d66ca in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:586:34
#67 0x58a42d490e9e in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20241103214544-c3c6d6835d49.
The bug appears to have been introduced in the following build range:

Start: 3b8b535b9bb0d8ab8cd08d970bc69f7cfe0f70b0 (20241031014759)
End: 2cc133b3c09973080c249c53419139bb94f2c3ae (20241031065618)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3b8b535b9bb0d8ab8cd08d970bc69f7cfe0f70b0&tochange=2cc133b3c09973080c249c53419139bb94f2c3ae

Comment 2

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1270832

:sergesanspaille, since you are the author of the regressor, bug 1270832, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[[:sergesanspaille]]

Attachment: Bug 1928713 - Take into account negative height when clamping FirstLinePosition r=emilio

This interestingly got caught by the combination of using standard
clamping routine and assertion in standard library.

Comment 4

[[:sergesanspaille]]

The bug wasn't exactly introduced by https://bugzilla.mozilla.org/show_bug.cgi?id=1270832 but rather exhibited by the combination of using a standard implementation for clamping, combined with the enabling of assertions in the standard library. It somehow showcases why using standard resources can be relevant :-)

I've submitted a patch though.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9ba69fa39b85
Take into account negative height when clamping FirstLinePosition r=emilio

Comment 6

[amarc]

https://hg.mozilla.org/mozilla-central/rev/9ba69fa39b85

Comment 7

[Bugmon [:jkratzer for issues]]

Bug marked as FIXED but still reproduces on mozilla-central 20241105161441-2cb6128d7dca. If you believe this to be incorrect, please remove the bugmon keyword to prevent further analysis.

Comment 8

[Jonathan Kew [:jfkthame]]

Comment 7 indicates this is still happening; presumably it's actually another clamp callsite that's now hitting a similar issue with negative (or overflowing) coords/sizes.

Comment 9

[Jason Kratzer [:jkratzer]]

Attachment: log_ffp_asan_1423936.log.1424152.txt

Comment 10

[Jason Kratzer [:jkratzer]]

See comment #9 for the most recent crash stack.

Comment 11

[Jonathan Kew [:jfkthame]]

Ah, that looks like the example that was just fixed in bug 1929445. Presumably the build involved in comment 9 didn't have that patch yet (it only just merged to central today).

Comment 12

[Tyson Smith [:tsmith]]

(In reply to Jonathan Kew [:jfkthame] from comment #11)

Ah, that looks like the example that was just fixed in bug 1929445. Presumably the build involved in comment 9 didn't have that patch yet (it only just merged to central today).

I can confirm this is no longer reproducible with m-c 20241113-7eaef5ce1448.

Comment 13

[Bugmon [:jkratzer for issues]]

Bug marked as FIXED but still reproduces on mozilla-central 20241105161441-2cb6128d7dca. If you believe this to be incorrect, please remove the bugmon keyword to prevent further analysis.

Comment 14

[Tyson Smith [:tsmith]]

Removing bugmon this time.