2052336 - crash near null in [@ mozilla::AbsoluteContainingBlock::PrepareAbsoluteFrames]

Status: VERIFIED FIXED

(Core :: Layout: Positioned, defect)

Description

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: testcase.html

Found while fuzzing m-c 20260625-e3ade567c585 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

==303030==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x7697553b7a4c bp 0x7fff329d8690 sp 0x7fff329d85c0 T0)
==303030==The signal is caused by a READ memory access.
==303030==Hint: address points to the zero page.
    #0 0x7697553b7a4c in begin /builds/worker/checkouts/gecko/layout/generic/nsFrameList.h:408:44
    #1 0x7697553b7a4c in DrainPushedChildList /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/AbsoluteContainingBlock.cpp:159:42
    #2 0x7697553b7a4c in mozilla::AbsoluteContainingBlock::PrepareAbsoluteFrames(nsContainerFrame*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/AbsoluteContainingBlock.cpp:227:16
    #3 0x769755480381 in nsBlockFrame::ReflowAbsoluteFramesInInlineFrame(nsInlineFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1444:25
    #4 0x76975547fefc in nsBlockFrame::WalkInlineDescendantsToReflowAbsoluteFrames(nsIFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1416:46
    #5 0x76975547f3d7 in nsBlockFrame::ReflowAbsoluteDescendantsInInlineFrame(nsPresContext*, mozilla::ReflowInput const&, mozilla::ReflowOutput&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1356:30
    #6 0x769755482a38 in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1830:5
    #7 0x7697554a1330 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, mozilla::CollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:289:11
    #8 0x7697554995c7 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4662:11
    #9 0x769755496b8e in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:3973:5
    #10 0x76975548b4ea in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:3476:29
    #11 0x76975548457b in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2049:35
    #12 0x76975548187d in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1672:9
    #13 0x7697553be318 in mozilla::AbsoluteContainingBlock::ReflowAbsoluteFrame(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, mozilla::AbsoluteContainingBlock::ContainingBlockRects const&, mozilla::EnumSet<mozilla::AbsPosReflowFlag, unsigned char>, nsIFrame*, nsReflowStatus&, mozilla::OverflowAreas*, mozilla::AbsoluteContainingBlock::ContainingBlockRects const*, mozilla::AnchorPosResolutionCache*, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/AbsoluteContainingBlock.cpp:1832:16
    #14 0x7697553b8de3 in mozilla::AbsoluteContainingBlock::Reflow(nsContainerFrame*, nsPresContext*, mozilla::ReflowInput const&, nsReflowStatus&, nsRect const&, mozilla::EnumSet<mozilla::AbsPosReflowFlag, unsigned char>, mozilla::OverflowAreas*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/AbsoluteContainingBlock.cpp:736:9
    #15 0x769755476d23 in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ViewportFrame.cpp:474:35
    #16 0x76975522d7c2 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:10700:11
    #17 0x76975526e6b7 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:10830:22
    #18 0x769755240560 in DoFlushLayout /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:10872:10
    #19 0x769755240560 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:4552:9
    #20 0x76974d58c27a in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1545:5
    #21 0x76974d58c27a in mozilla::dom::Document::DetermineProximityToViewportAndNotifyResizeObservers() /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Document.cpp:19284:11
    #22 0x7697551bd0c1 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2540:14
    #23 0x7697551bd0c1 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1309:7
    #24 0x7697551bd0c1 in RunRenderingPhaseLegacy<(lambda at /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1288:35)> /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1281:3
    #25 0x7697551bd0c1 in void nsRefreshDriver::RunRenderingPhase<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_11>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_11&&, bool (*)(mozilla::dom::Document const&)) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1288:3
    #26 0x7697551b23fc in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2536:3
    #27 0x7697551c8bd6 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:365:13
    #28 0x7697551c8bd6 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:343:7
    #29 0x7697551c899a in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:359:5
    #30 0x7697551c8611 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:946:5
    #31 0x7697551c74b9 in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:856:5
    #32 0x7697551c5708 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:587:14
    #33 0x7697537f6d9b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:64:15
    #34 0x769753cca7f9 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/dom/ipc/./../../ipc/ipdl/PVsyncChild.cpp:241:78
    #35 0x76974a72cffa in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../ipdl/PBackgroundChild.cpp:4955:32
    #36 0x76974a67f165 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1797:25
    #37 0x76974a67b65e in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1723:9
    #38 0x76974a67c477 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1512:3
    #39 0x76974a67d993 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1614:14
    #40 0x76974a4264ca in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:719:16
    #41 0x76974a406f39 in mozilla::TaskController::RunTask(mozilla::Task*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:210:19
    #42 0x76974a40e3dd in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1358:20
    #43 0x76974a40beb8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1181:15
    #44 0x76974a40c4d6 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:655:36
    #45 0x76974a424ca1 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:347:37
    #46 0x76974a424ca1 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:536:5
    #47 0x76974a449a5c in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1179:16
    #48 0x76974a454059 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:472:10
    #49 0x76974a68907e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:83:21
    #50 0x76974a560744 in RunInternal /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:371:10
    #51 0x76974a560744 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
    #52 0x76974a560744 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
    #53 0x769754980076 in nsBaseAppShell::Run() /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/nsBaseAppShell.cpp:151:27
    #54 0x769754b88a5b in nsAppShell::Run() /builds/worker/workspace/obj-build/widget/gtk/./../../../../checkouts/gecko/widget/gtk/nsAppShell.cpp:575:33
    #55 0x769756cdf10d in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:20
    #56 0x76974a560744 in RunInternal /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:371:10
    #57 0x76974a560744 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
    #58 0x76974a560744 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
    #59 0x769756cddfa1 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:594:34
    #60 0x58d605bb40fa in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:466:22

Comment 1

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

I can take a look. The callstack contains functions I added recently in bug 489100.

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260702212026-c9b51eea20db.
The bug appears to have been introduced in the following build range:

Start: 418af9fb17f971b40e2d816e54b06bf59c990c19 (20251231205302)
End: 56e83f74c8564154c1eb62936681db79149fa5ee (20260101012700)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=418af9fb17f971b40e2d816e54b06bf59c990c19&tochange=56e83f74c8564154c1eb62936681db79149fa5ee

Comment 3

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Loading the testcase in debug build hits

MOZ_ASSERT_UNREACHABLE("We should've reframed the containing block!");

in RestyleManager.cpp.

MozRegression on debug builds finds bug 1994346 that introduced this bug.

Comment 4

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1994346

Comment 5

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Bug 2052336 - Dive into float to decide whether to reframe containing block in RestyleManager. r?#layout

When an inline element is an absolute containing block, its abspos children
might not be reachable via a placeholder within its subtree. For example, in the
crashtest inline-containing-block-dynamic-change-2.html, before the dynamic
change where <content> is still an absolute containing block, the frame tree
looks like:

<body>
<content> <-- The dynamic change will make it no longer an abs CB
<table> placeholder
abspos list of <content>:
<tbody>
float list of <body>:
<table>
...
<tbody> placeholder

The <tbody> is not reachable via scanning <content> subtree's placeholder
frames. So this patch scans the absolute list directly to find any abspos
children that will be impacted due to change of the containing block.

inline-containing-block-dynamic-change-2.html is a reduced version of the
original testcase (captured in inline-containing-block-dynamic-change-3.html).
It demonstrates the problem clearly, but it doesn't crash the release build.
Therefore this patch includes both crashtests.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0932993d8ff0
https://hg.mozilla.org/integration/autoland/rev/f274ba21198c
Dive into float to decide whether to reframe containing block in RestyleManager. r=layout-reviewers,firefox-style-system-reviewers,emilio

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/61185 for changes under testing/web-platform/tests

Comment 8

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/f274ba21198c

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260709160343-8edd37202070.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.