Open Bug 1932154 Opened 1 year ago Updated 1 year ago

Assertion failure: bEndRow < bSize (bogus aFragmentainer.mCanBreakAtEnd), at /layout/generic/nsGridContainerFrame.cpp:7926

Categories

(Core :: Layout: Grid, defect, P3)

Product:
Core
Component:
Layout: Grid
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox-esr128 --- wontfix
firefox132 --- wontfix
firefox133 --- wontfix
firefox134 --- wontfix
firefox135 --- fix-optional

People

(Reporter: jkratzer, Unassigned, NeedInfo)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: pernosco, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file)

Testcase
468 bytes, text/html
Details

Testcase found while fuzzing mozilla-central rev f2974c7f76c8 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build f2974c7f76c8 --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: bEndRow < bSize (bogus aFragmentainer.mCanBreakAtEnd), at /layout/generic/nsGridContainerFrame.cpp:7926

    ==57062==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x74d1adab9308 bp 0x7ffdcbddbc80 sp 0x7ffdcbddbb90 T57062)
    ==57062==The signal is caused by a WRITE memory access.
    ==57062==Hint: address points to the zero page.
        #0 0x74d1adab9308 in nsGridContainerFrame::ReflowInFragmentainer(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, mozilla::ReflowOutput&, nsReflowStatus&, nsGridContainerFrame::Fragmentainer&, nsSize const&) /layout/generic/nsGridContainerFrame.cpp:7926:7
        #1 0x74d1adabd796 in nsGridContainerFrame::ReflowChildren(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, nsSize const&, mozilla::ReflowOutput&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:8793:13
        #2 0x74d1adabecd1 in nsGridContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsGridContainerFrame.cpp:9051:11
        #3 0x74d1ada59b54 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:904:14
        #4 0x74d1ada4cdef in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsCanvasFrame.cpp:721:7
        #5 0x74d1ada64981 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:945:14
        #6 0x74d1adb2adaa in nsPageContentFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsPageContentFrame.cpp:74:5
        #7 0x74d1ada64981 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:945:14
        #8 0x74d1adb2d501 in nsPageFrame::ReflowPageContent(nsPresContext*, mozilla::ReflowInput const&) /layout/generic/nsPageFrame.cpp:198:3
        #9 0x74d1adb2e09e in nsPageFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsPageFrame.cpp:220:13
        #10 0x74d1ada59b54 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:904:14
        #11 0x74d1ad9d6df4 in mozilla::PrintedSheetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/PrintedSheetFrame.cpp:170:5
        #12 0x74d1ada64981 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:945:14
        #13 0x74d1adb326b5 in nsPageSequenceFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsPageSequenceFrame.cpp:368:5
        #14 0x74d1ada59b54 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:904:14
        #15 0x74d1ada4cdef in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsCanvasFrame.cpp:721:7
        #16 0x74d1ada64981 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:945:14
        #17 0x74d1ada1be90 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ViewportFrame.cpp:358:7
        #18 0x74d1ad8ee404 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /layout/base/PresShell.cpp:10041:11
        #19 0x74d1ad91746f in mozilla::PresShell::ProcessReflowCommands(bool) /layout/base/PresShell.cpp:10211:22
        #20 0x74d1ad8f808f in DoFlushLayout /layout/base/PresShell.cpp:10258:10
        #21 0x74d1ad8f808f in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4449:9
        #22 0x74d1add42302 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1447:5
        #23 0x74d1add42302 in nsPrintJob::ReflowPrintObject(mozilla::UniquePtr<nsPrintObject, mozilla::DefaultDelete<nsPrintObject>> const&) /layout/printing/nsPrintJob.cpp:1422:14
        #24 0x74d1add416b7 in nsPrintJob::ReflowDocList(mozilla::UniquePtr<nsPrintObject, mozilla::DefaultDelete<nsPrintObject>> const&) /layout/printing/nsPrintJob.cpp:960:3
        #25 0x74d1add3e85f in nsPrintJob::InitPrintDocConstruction(bool) /layout/printing/nsPrintJob.cpp:1001:5
        #26 0x74d1add3d810 in nsPrintJob::DoCommonPrint(bool, nsIPrintSettings*, nsIWebProgressListener*, mozilla::dom::Document&) /layout/printing/nsPrintJob.cpp:447:3
        #27 0x74d1add3ea35 in CommonPrint /layout/printing/nsPrintJob.cpp:335:17
        #28 0x74d1add3ea35 in nsPrintJob::Print(mozilla::dom::Document&, nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*) /layout/printing/nsPrintJob.cpp:457:10
        #29 0x74d1ad97b0a0 in nsDocumentViewer::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*) /layout/base/nsDocumentViewer.cpp:2939:27
        #30 0x74d1a999ca17 in nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, RefPtr<mozilla::dom::BrowsingContext>*, mozilla::ErrorResult&) /dom/base/nsGlobalWindowOuter.cpp:5205:24
        #31 0x74d1acd1428d in mozilla::dom::BrowserChild::CommonPrint(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, mozilla::embedding::PrintData const&, RefPtr<mozilla::dom::BrowsingContext>*) /dom/ipc/BrowserChild.cpp:2653:18
        #32 0x74d1acd1460a in mozilla::dom::BrowserChild::RecvPrint(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, mozilla::embedding::PrintData const&, bool, std::function<void (mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&)>&&) /dom/ipc/BrowserChild.cpp:2672:17
        #33 0x74d1ace4684d in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBrowserChild.cpp:7951:80
        #34 0x74d1aceb4610 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8794:32
        #35 0x74d1a88027bf in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1726:25
        #36 0x74d1a87ff742 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1653:9
        #37 0x74d1a88003c2 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1444:3
        #38 0x74d1a880150f in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1544:14
        #39 0x74d1a7c55ea7 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:618:16
        #40 0x74d1a7c4b709 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:945:26
        #41 0x74d1a7c4a147 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:768:15
        #42 0x74d1a7c4a5c5 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:554:36
        #43 0x74d1a7c598e9 in operator() /xpcom/threads/TaskController.cpp:271:37
        #44 0x74d1a7c598e9 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #45 0x74d1a7c6d1ab in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1159:16
        #46 0x74d1a7c73e8f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #47 0x74d1a999f44c in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, RefPtr<mozilla::dom::BrowsingContext>*, mozilla::ErrorResult&)::$_1>(nsTSubstring<char> const&, nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, RefPtr<mozilla::dom::BrowsingContext>*, mozilla::ErrorResult&)::$_1&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
        #48 0x74d1a999caa2 in nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, RefPtr<mozilla::dom::BrowsingContext>*, mozilla::ErrorResult&) /dom/base/nsGlobalWindowOuter.cpp:5227:5
        #49 0x74d1a999b07f in nsGlobalWindowOuter::PrintOuter(mozilla::ErrorResult&) /dom/base/nsGlobalWindowOuter.cpp:4984:3
        #50 0x74d1a9955ca9 in nsGlobalWindowInner::Print(mozilla::ErrorResult&) /dom/base/nsGlobalWindowInner.cpp:3752:3
        #51 0x74d1ad97334f in nsDocumentViewer::LoadComplete(nsresult) /layout/base/nsDocumentViewer.cpp:1133:16
        #52 0x74d1addd8e05 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /docshell/base/nsDocShell.cpp:6205:13
        #53 0x74d1addd8171 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp:5595:7
        #54 0x74d1addd9ea6 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp
        #55 0x74d1a8afce29 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /uriloader/base/nsDocLoader.cpp:1425:3
        #56 0x74d1a8afc512 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:961:14
        #57 0x74d1a8afa8ac in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:783:9
        #58 0x74d1a8afbac4 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:666:5
        #59 0x74d1ade10eaf in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:13743:23
        #60 0x74d1a7e8716f in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:642:22
        #61 0x74d1a7e8848e in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:536:10
        #62 0x74d1a9b4471c in mozilla::dom::Document::DoUnblockOnload() /dom/base/Document.cpp:12087:18
        #63 0x74d1a9b2a639 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8445:3
        #64 0x74d1a9be1739 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #65 0x74d1a9be1739 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #66 0x74d1a9be1739 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #67 0x74d1a9be1739 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #68 0x74d1a9be1739 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #69 0x74d1a9be1739 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #70 0x74d1a9be1739 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #71 0x74d1a7c55ea7 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:618:16
        #72 0x74d1a7c4b709 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:945:26
        #73 0x74d1a7c4a147 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:768:15
        #74 0x74d1a7c4a5c5 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:554:36
        #75 0x74d1a7c59886 in operator() /xpcom/threads/TaskController.cpp:268:37
        #76 0x74d1a7c59886 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #77 0x74d1a7c6d1ab in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1159:16
        #78 0x74d1a7c73e8f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #79 0x74d1a8808345 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #80 0x74d1a8759f31 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #81 0x74d1a8759f31 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #82 0x74d1ad52c938 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #83 0x74d1ad5df4d8 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:469:33
        #84 0x74d1ae4c4f7b in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:651:20
        #85 0x74d1a8809196 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #86 0x74d1a8759f31 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #87 0x74d1a8759f31 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #88 0x74d1ae4c439a in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:586:34
        #89 0x623d12f0cede in main /browser/app/nsBrowserApp.cpp:397:22
        #90 0x74d1b77e71c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #91 0x74d1b77e728a in __libc_start_main csu/../csu/libc-start.c:360:3
        #92 0x623d12ee2c18 in _start (/home/jkratzer/builds/m-c-20241119094105-fuzzing-debug/firefox-bin+0x5ac18) (BuildId: aff0f8909cad614bb9a0a3383d10d9046c1e2e14)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/generic/nsGridContainerFrame.cpp:7926:7 in nsGridContainerFrame::ReflowInFragmentainer(nsGridContainerFrame::GridReflowInput&, mozilla::LogicalRect const&, mozilla::ReflowOutput&, nsReflowStatus&, nsGridContainerFrame::Fragmentainer&, nsSize const&)
    ==57062==ABORTING
Attached file Testcase —

Looks like an integer overflow during fragmentation looking at the CSS?

Severity: -- → S3
Priority: -- → P3
Attachment #9438565 - Attachment mime type: text/plain → text/html

Verified bug as reproducible on mozilla-central 20241119155316-667cbcfd6806.
The bug appears to have been introduced in the following build range:

Start: 00f949eecc1be917553e235f582aeb7e1e1146fd (20240112193829)
End: e9c1463b56151bf940fe442f91aeabc8a811573d (20240112222441)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=00f949eecc1be917553e235f582aeb7e1e1146fd&tochange=e9c1463b56151bf940fe442f91aeabc8a811573d

Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Keywords: pernosco-wanted → pernosco

A pernosco session for this bug can be found here.

Regressed by: 1874336

Set release status flags based on info from the regressing bug 1874336

:TYLin, since you are the author of the regressor, bug 1874336, could you take a look?

For more information, please visit BugBot documentation.

status-firefox132: --- → affected
status-firefox133: --- → affected
status-firefox134: --- → affected
status-firefox-esr128: --- → affected
Flags: needinfo?(aethanyc)

Set release status flags based on info from the regressing bug 1874336

status-firefox135: --- → affected

Testcase crashes using the initial build (mozilla-central 20241119094105-f2974c7f76c8) but not with tip (mozilla-central 20250214095524-ffddf6c98dc7.)

Unable to bisect testcase (End build crashes!):

Start: f2974c7f76c8ce2d1333b781fa7f6c71b5c8bba0 (20241119094105)
End: ffddf6c98dc7cfec5eb11ceb7d16e9160165dfee (20250214095524)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: