Open Bug 1932279 Opened 1 year ago Updated 1 year ago

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: avail space rect with zero height!), at /layout/generic/BlockReflowState.h:198

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Platform:
x86_64
Linux
Type:
defect

Tracking

()

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file)

Testcase
552 bytes, text/plain
Details

Testcase found while fuzzing mozilla-central rev 3af3ec0d3d58 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 3af3ec0d3d58 --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: avail space rect with zero height!), at /layout/generic/BlockReflowState.h:198

    ==164720==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x786f6f4bfdc1 bp 0x7ffe67565850 sp 0x7ffe67565820 T164720)
    ==164720==The signal is caused by a WRITE memory access.
    ==164720==Hint: address points to the zero page.
        #0 0x786f6f4bfdc1 in mozilla::BlockReflowState::AdvanceToNextBand(mozilla::LogicalRect const&, int*) const /layout/generic/BlockReflowState.h:198:7
        #1 0x786f6f4bed0d in mozilla::BlockReflowState::ClearFloats(int, mozilla::StyleClear, nsIFrame*) /layout/generic/BlockReflowState.cpp:1056:12
        #2 0x786f6f5232f8 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /layout/generic/nsBlockFrame.cpp:4312:24
        #3 0x786f6f52152d in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /layout/generic/nsBlockFrame.cpp:3841:5
        #4 0x786f6f51aa0f in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /layout/generic/nsBlockFrame.cpp:3348:29
        #5 0x786f6f516da2 in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /layout/generic/nsBlockFrame.cpp:1944:35
        #6 0x786f6f51510b in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsBlockFrame.cpp:1580:9
        #7 0x786f6f547e14 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:904:14
        #8 0x786f6f545f51 in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /layout/generic/nsColumnSetFrame.cpp:707:7
        #9 0x786f6f5495dd in nsColumnSetFrame::FindBestBalanceBSize(mozilla::ReflowInput const&, nsPresContext*, nsColumnSetFrame::ReflowConfig&, nsColumnSetFrame::ColumnBalanceData, mozilla::ReflowOutput&, bool, nsReflowStatus&) /layout/generic/nsColumnSetFrame.cpp:1198:5
        #10 0x786f6f5499bb in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsColumnSetFrame.cpp:1258:5
        #11 0x786f6f527d40 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, mozilla::CollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /layout/generic/nsBlockReflowContext.cpp:290:11
        #12 0x786f6f523cf4 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /layout/generic/nsBlockFrame.cpp:4512:11
        #13 0x786f6f52152d in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /layout/generic/nsBlockFrame.cpp:3841:5
        #14 0x786f6f51aa0f in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /layout/generic/nsBlockFrame.cpp:3348:29
        #15 0x786f6f516da2 in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /layout/generic/nsBlockFrame.cpp:1944:35
        #16 0x786f6f51510b in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsBlockFrame.cpp:1580:9
        #17 0x786f6f547e14 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:904:14
        #18 0x786f6f53b0af in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/nsCanvasFrame.cpp:721:7
        #19 0x786f6f547e14 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:904:14
        #20 0x786f6f4dde1f in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /layout/generic/ScrollContainerFrame.cpp:914:3
        #21 0x786f6f4de450 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /layout/generic/ScrollContainerFrame.cpp:1030:3
        #22 0x786f6f4e08fd in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ScrollContainerFrame.cpp:1490:3
        #23 0x786f6f552c41 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /layout/generic/nsContainerFrame.cpp:945:14
        #24 0x786f6f50a150 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /layout/generic/ViewportFrame.cpp:358:7
        #25 0x786f6f3dc5a4 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /layout/base/PresShell.cpp:10041:11
        #26 0x786f6f40560f in mozilla::PresShell::ProcessReflowCommands(bool) /layout/base/PresShell.cpp:10211:22
        #27 0x786f6f4a56b7 in nsPresContext::UpdateContainerQueryStyles() /layout/base/nsPresContext.cpp:1129:16
        #28 0x786f6f413e49 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /layout/base/RestyleManager.cpp:3337:18
        #29 0x786f6f3e6e35 in mozilla::RestyleManager::ProcessPendingRestyles() /layout/base/RestyleManager.cpp:3381:3
        #30 0x786f6f3e6186 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /layout/base/PresShell.cpp:4439:37
        #31 0x786f6b6360db in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1456:5
        #32 0x786f6b6360db in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /dom/base/Document.cpp:11298:16
        #33 0x786f6a5f137d in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:728:14
        #34 0x786f6a5f27c4 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:666:5
        #35 0x786f6f8ff52f in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:13740:23
        #36 0x786f6997f14f in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:642:22
        #37 0x786f6998046e in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:536:10
        #38 0x786f6b63b39c in mozilla::dom::Document::DoUnblockOnload() /dom/base/Document.cpp:12092:18
        #39 0x786f6b6212a9 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8450:3
        #40 0x786f6b6d8169 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #41 0x786f6b6d8169 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #42 0x786f6b6d8169 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #43 0x786f6b6d8169 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #44 0x786f6b6d8169 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #45 0x786f6b6d8169 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #46 0x786f6b6d8169 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #47 0x786f6974df07 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:618:16
        #48 0x786f69743769 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:945:26
        #49 0x786f697421a7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:768:15
        #50 0x786f69742625 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:554:36
        #51 0x786f697518e6 in operator() /xpcom/threads/TaskController.cpp:268:37
        #52 0x786f697518e6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #53 0x786f6976520b in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1159:16
        #54 0x786f6976beef in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #55 0x786f6a2ff1a5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #56 0x786f6a251f71 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #57 0x786f6a251f71 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #58 0x786f6f01ab58 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #59 0x786f6f0cd6f8 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:469:33
        #60 0x786f6ffb34eb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:646:20
        #61 0x786f6a2ffff6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #62 0x786f6a251f71 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #63 0x786f6a251f71 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #64 0x786f6ffb291a in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:584:34
        #65 0x576d99c4bede in main /browser/app/nsBrowserApp.cpp:397:22
        #66 0x786f792d31c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #67 0x786f792d328a in __libc_start_main csu/../csu/libc-start.c:360:3
        #68 0x576d99c21c18 in _start (/home/jkratzer/builds/m-c-20241119214442-fuzzing-debug/firefox-bin+0x5ac18) (BuildId: 6c93bcaf672c0f606f2e84854ca6b02cf9416924)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /layout/generic/BlockReflowState.h:198:7 in mozilla::BlockReflowState::AdvanceToNextBand(mozilla::LogicalRect const&, int*) const
    ==164720==ABORTING
Attached file Testcase —

Verified bug as reproducible on mozilla-central 20241120044454-0313ecc4bd47.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: ef0b50d89a7f6107932087c2c1adc2f6fd9ab06a (20231122034940)
End: 3af3ec0d3d589a0cc5313c9f3139e73db0a5a91d (20241119214442)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

The severity field is not set for this bug.
:boris, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(boris.chiou)

Looks like this is a combination of vertical writing mode and super large padding. I can reproduce this locally on mac today.

Severity: -- → S3
Flags: needinfo?(boris.chiou)

Testcase crashes using the initial build (mozilla-central 20241119214442-3af3ec0d3d58) but not with tip (mozilla-central 20250221165821-2cf34b3c9e61.)

Unable to bisect testcase (Testcase reproduces on start build!):

Start: dba8ff89abb9be706021b6ff359c87e58dda45ce (20240224093754)
End: 3af3ec0d3d589a0cc5313c9f3139e73db0a5a91d (20241119214442)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: