2013011 - AddressSanitizer: stack-overflow [@ MemcmpInterceptorCommon]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 08a9de1f821f (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build 08a9de1f821f --asan --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Detailed Crash Information

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260128094816-08a9de1f821f.
The bug appears to have been introduced in the following build range:

Start: 1a2bb6c3bf5d1545d6c2d8b36bc4867fa0363de5 (20260119110606)
End: 6bf16ff5cae339919373fddcf20a04121adb24fd (20260119122634)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1a2bb6c3bf5d1545d6c2d8b36bc4867fa0363de5&tochange=6bf16ff5cae339919373fddcf20a04121adb24fd

Comment 4

[Mayank Bansal]

Got a crash from the testcase on Nightly: https://crash-stats.mozilla.org/report/index/40d1a6c6-bc6d-4049-9738-7cae60260129

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

This bug has been marked as a regression. Setting status flag for Nightly to affected.

Comment 6

[Daniel Holbert [:dholbert]]

Testcase is using anchor positioning (bottom: anchor-size(--anchor-name_0);) and popover (cite.showPopover(...))

And the backtrace shows infinite recursion in FindScrollCompensatedAnchorShift.

That function was added by bug 1950251 which is in the regression range; flagging as regression from that. emilio, could you take a look when you get a chance?

Comment 7

[Daniel Holbert [:dholbert]]

(Tentatively triaging as S3, given that stack-exhaustion doesn't have security implications and given that we haven't yet hit this in the wild.)

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1950251

Comment 9

[David Shin[:dshin]]

(Drive-by)

cite.showPopover({"source": cite})

Hm, at a glance, spec doesn't handle setting itself as the source.

Comment 10

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 11

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 12

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 2013011 - Check implicit anchor validity. r=jari,#anchor-pos

The invoker can be anywhere in the dom, have to confirm that it's an
acceptable anchor. I think pseudo elements should always pass this
check but worth doing regardless.

This also fixes bug 2013896, while at it, gotta add a test for that, if
this doesn't cause any progression.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/93dfeeec2fac
https://hg.mozilla.org/integration/autoland/rev/8e3abd8074e7
Check implicit anchor validity. r=layout-anchor-positioning-reviewers,layout-reviewers,dshin

Comment 14

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/57621 for changes under testing/web-platform/tests

Comment 15

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/8e3abd8074e7

Comment 16

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 17

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260207085912-a644f3faa9ba.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.