1980789 - Local ASan run reports SEGV from dom::ScrollTimeline::GetCurrentTimeAsDuration()

Status: RESOLVED DUPLICATE of bug 1878215

(Core :: CSS Parsing and Computation, defect)

Description

[Andrew Creskey [:acreskey]]

I was running this ASan build locally, loading 1000 websites and ASan halted on the following undefined SEGV coming from styles and scroll container:

==13755==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x000133666e64 bp 0x00016bb30fb0 sp 0x00016bb30f90 T10)
==13755==The signal is caused by a WRITE memory access.
==13755==Hint: address points to the zero page.
==13755==WARNING: failed to spawn external symbolizer (errno: 9)
==13755==WARNING: failed to spawn external symbolizer (errno: 9)
==13755==WARNING: failed to spawn external symbolizer (errno: 9)
==13755==WARNING: failed to spawn external symbolizer (errno: 9)
==13755==WARNING: failed to spawn external symbolizer (errno: 9)
==13755==WARNING: Failed to use and restart external symbolizer!
    #0 0x000133666e64 in mozilla::dom::Document::GetDocShell() const+0x140 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x5282e64)
    #1 0x000139124b80 in mozilla::dom::BrowserChild::GetFrom(mozilla::PresShell*)+0x48 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0xad40b80)
    #2 0x00013a977eb0 in mozilla::ScrollContainerFrame::GetScrolledRect() const+0x4b0 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0xc593eb0)
    #3 0x00013a985aec in mozilla::ScrollContainerFrame::GetAvailableScrollingDirections() const+0xb8 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0xc5a1aec)
    #4 0x000133163d44 in mozilla::dom::ScrollTimeline::GetCurrentTimeAsDuration() const+0x24c (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x4d7fd44)
    #5 0x00013312c55c in mozilla::dom::Animation::AtProgressTimelineBoundary() const+0xe8 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x4d4855c)
    #6 0x000133126914 in mozilla::dom::KeyframeEffect::ComposeStyle(mozilla::StyleAnimationValueMap&, mozilla::InvertibleAnimatedPropertyIDSet const&, mozilla::dom::EndpointBehavior)+0xd4 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x4d42914)
    #7 0x000133126548 in mozilla::dom::Animation::ComposeStyle(mozilla::StyleAnimationValueMap&, mozilla::InvertibleAnimatedPropertyIDSet const&, mozilla::dom::EndpointBehavior)+0x14c (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x4d42548)
    #8 0x0001331442e0 in mozilla::ComposeSortedEffects(nsTArray<mozilla::dom::KeyframeEffect*> const&, mozilla::EffectSet const*, mozilla::EffectCompositor::CascadeLevel, mozilla::StyleAnimationValueMap*, mozilla::dom::EndpointBehavior)+0x108 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x4d602e0)
    #9 0x000133143d48 in mozilla::EffectCompositor::GetServoAnimationRule(mozilla::dom::Element const*, mozilla::PseudoStyleRequest const&, mozilla::EffectCompositor::CascadeLevel, mozilla::StyleAnimationValueMap*)+0x504 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x4d5fd48)
    #10 0x00013a619d34 in Gecko_GetAnimationRule+0x218 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0xc235d34)
    #11 0x0001415feff8 in style::gecko::wrapper::get_animation_rule::he7ad9b532b8996f4+0x54 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x1321aff8)
    #12 0x000141117fec in style::style_resolver::StyleResolverForElement$LT$E$GT$::match_primary::h8821ca54b7babffb+0x2cc (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x12d33fec)
    #13 0x000141119190 in style::style_resolver::StyleResolverForElement$LT$E$GT$::resolve_primary_style::h06ad1e77b853b33f+0x4c (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x12d35190)
    #14 0x00014111813c in style::style_resolver::StyleResolverForElement$LT$E$GT$::resolve_style::h4bfc67de66a542ef+0x48 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x12d3413c)
    #15 0x0001411531a4 in style::parallel::style_trees::h2a05594834f0974e+0x1c10 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x12d6f1a4)
    #16 0x00014117a8f0 in _$LT$rayon_core..job..HeapJob$LT$BODY$GT$$u20$as$u20$rayon_core..job..Job$GT$::execute::h07dd1d44e07bcae7+0x1bc (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x12d968f0)
    #17 0x0001418eb33c in rayon_core::registry::WorkerThread::wait_until_cold::h1bd3e67a171334fa+0xac (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x1350733c)
    #18 0x0001418e7cd0 in rayon_core::registry::ThreadBuilder::run::ha13d926116f0e350+0x3f0 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x13503cd0)
    #19 0x0001412a4b20 in std::sys::backtrace::__rust_begin_short_backtrace::h5546462ad072c65d+0x40 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x12ec0b20)
    #20 0x0001412b26e8 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::hf57bd294c626aa6d+0xc8 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x12ece6e8)
    #21 0x000141a3a444 in std::sys::pal::unix::thread::Thread::new::thread_start::h6d53b1b0c047a3b9+0x30 (/Applications/Nightly_asan.app/Contents/MacOS/XUL:arm64+0x13656444)
    #22 0x000105af01e4 in asan_thread_start(void*)+0x48 (/opt/homebrew/Cellar/llvm/20.1.8/lib/clang/20/lib/darwin/libclang_rt.asan_osx_dynamic.dylib:arm64+0x501e4)
    #23 0x00018ea97fa4 in _pthread_start+0x90 (/usr/lib/system/libsystem_pthread.dylib:arm64+0x6fa4)
    #24 0x244e00018ea92d9c  (<unknown module>)

Full ASan file attached.

The 1000 sites were being navigated with this web addon that was put together while investigating Bug 1980171.

The list of sites is here
I haven't figured out which site triggers the overflow, but I'll attach partial MOZ_LOGs for clues and if I can refine this I'll add it.

This bug may well be in the wrong component.

Comment 1

[Andrew Creskey [:acreskey]]

Attachment: asan_log.13755

Comment 2

[Andrew Creskey [:acreskey]]

Attachment: partial_moz_log.txt

The last 10MB of moz_logs, timestamp,nsHttp:3,Navigation:4 recorded for this session.

Comment 3

[Andrew McCreight [:mccr8]]

Looks like a null deref.

Comment 4

[Tyson Smith [:tsmith]]

Duplicate of bug 1878215?

Comment 5

[Boris Chiou [:boris]]

(In reply to Tyson Smith [:tsmith] from comment #4)

Duplicate of bug 1878215?

Yes. Pretty similar. Not sure why we ge the bad address because it's not a debug build (so we cannot rely on the MOZ_ASSERT to check if they are 100% identical). However, I think once we fix bug 1878215, this should be probably fixed as well.
(Note: Bug 1878215 is a bug that we shouldn't use ScrollContainerFrame::GetScrolledRect() during styling which is out of main thread)

Comment 6

[Tyson Smith [:tsmith]]

(In reply to Boris Chiou [:boris] from comment #5)

Yes. Pretty similar. Not sure why we ge the bad address because it's not a debug build

I assume you mean 0x000000000001? That is a work around for UBSan (which is enabled in most ASan builds) https://searchfox.org/mozilla-central/rev/5446303cba9b19b9e88937be62936a96086dcf32/mfbt/Assertions.h#291