2053288 - crash near null in [@ GetFirstLeaf]

Tyson Smith [:tsmith] (PTO -> Sept/8)

Reporter

Description

•

1 month ago

Attached file testcase.html — Details

Found while fuzzing m-c 20260703-841554ad3dc3 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

==382227==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000006d (pc 0x7a5f7d6a0aeb bp 0x7ffd957051b0 sp 0x7ffd95705120 T0)
==382227==The signal is caused by a READ memory access.
==382227==Hint: address points to the zero page.
    #0 0x7a5f7d6a0aeb in IsLetterFrame /builds/worker/workspace/obj-build/dist/include/mozilla/FrameTypeList.h:8:1
    #1 0x7a5f7d6a0aeb in GetFirstLeaf /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsBidiPresUtils.cpp:1540:29
    #2 0x7a5f7d6a0aeb in nsBidiPresUtils::GetFrameBidiData(nsIFrame*) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsBidiPresUtils.cpp:1546:10
    #3 0x7a5f7d6a0533 in nsBidiPresUtils::ReorderFrames(nsIFrame*, int, mozilla::WritingMode, nsSize const&, int) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsBidiPresUtils.cpp:1522:21
    #4 0x7a5f7daaec06 in nsLineLayout::TextAlignLine(nsLineBox*, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsLineLayout.cpp:3609:5
    #5 0x7a5f7d896f34 in nsBlockFrame::PlaceLine(mozilla::BlockReflowState&, nsLineLayout&, GenericLineListIterator<nsLineLink, false>, nsFloatManager::SavedState*, nsFlowAreaRect&, int&, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:5875:15
    #6 0x7a5f7d89457f in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, GenericLineListIterator<nsLineLink, false>, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:5349:12
    #7 0x7a5f7d88d600 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:5076:9
    #8 0x7a5f7d887435 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4030:24
    #9 0x7a5f7d87debb in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:3821:31
    #10 0x7a5f7d874f4b in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2103:35
    #11 0x7a5f7d87224d in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1726:9
    #12 0x7a5f7d8e8d5a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:713:14
    #13 0x7a5f7d8b4525 in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:698:7
    #14 0x7a5f7d8b87fb in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1266:5
    #15 0x7a5f7d891d00 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, mozilla::CollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:289:11
    #16 0x7a5f7d889f97 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4716:11
    #17 0x7a5f7d88755e in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4027:5
    #18 0x7a5f7d87beba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:3530:29
    #19 0x7a5f7d874f4b in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2103:35
    #20 0x7a5f7d87224d in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1726:9
    #21 0x7a5f7d891d00 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, mozilla::CollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:289:11
    #22 0x7a5f7d889f97 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4716:11
    #23 0x7a5f7d88755e in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4027:5
    #24 0x7a5f7d87beba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:3530:29
    #25 0x7a5f7d874f4b in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2103:35
    #26 0x7a5f7d87224d in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1726:9
    #27 0x7a5f7d8e8d5a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:713:14
    #28 0x7a5f7d8b4525 in nsColumnSetFrame::ReflowColumns(mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&, nsColumnSetFrame::ReflowConfig const&, bool) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:698:7
    #29 0x7a5f7d8b87fb in nsColumnSetFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsColumnSetFrame.cpp:1266:5
    #30 0x7a5f7d891d00 in nsBlockReflowContext::ReflowBlock(mozilla::LogicalRect const&, bool, mozilla::CollapsingMargin&, int, nsLineBox*, mozilla::ReflowInput&, nsReflowStatus&, mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockReflowContext.cpp:289:11
    #31 0x7a5f7d889f97 in nsBlockFrame::ReflowBlockFrame(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4716:11
    #32 0x7a5f7d88755e in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, GenericLineListIterator<nsLineLink, false>, bool*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:4027:5
    #33 0x7a5f7d87beba in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:3530:29
    #34 0x7a5f7d874f4b in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:2103:35
    #35 0x7a5f7d87224d in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsBlockFrame.cpp:1726:9
    #36 0x7a5f7d8e8d5a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:713:14
    #37 0x7a5f7d8af800 in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsCanvasFrame.cpp:514:7
    #38 0x7a5f7d8e8d5a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:713:14
    #39 0x7a5f7d8039dc in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:981:3
    #40 0x7a5f7d8051d2 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1091:3
    #41 0x7a5f7d809949 in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1544:3
    #42 0x7a5f7d8e93a3 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/nsContainerFrame.cpp:749:14
    #43 0x7a5f7d866efc in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/workspace/obj-build/layout/generic/./../../../../checkouts/gecko/layout/generic/ViewportFrame.cpp:422:7
    #44 0x7a5f7d61d692 in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:10711:11
    #45 0x7a5f7d65e657 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:10841:22
    #46 0x7a5f7d630430 in DoFlushLayout /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:10883:10
    #47 0x7a5f7d630430 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:4553:9
    #48 0x7a5f7597a33a in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1545:5
    #49 0x7a5f7597a33a in mozilla::dom::Document::DetermineProximityToViewportAndNotifyResizeObservers() /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Document.cpp:19285:11
    #50 0x7a5f7d5acce1 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2540:14
    #51 0x7a5f7d5acce1 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1309:7
    #52 0x7a5f7d5acce1 in RunRenderingPhaseLegacy<(lambda at /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1288:35)> /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1281:3
    #53 0x7a5f7d5acce1 in void nsRefreshDriver::RunRenderingPhase<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_11>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_11&&, bool (*)(mozilla::dom::Document const&)) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1288:3
    #54 0x7a5f7d5a201c in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2536:3
    #55 0x7a5f7d5b87f6 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:365:13
    #56 0x7a5f7d5b87f6 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:343:7
    #57 0x7a5f7d5b85ba in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:359:5
    #58 0x7a5f7d5b8231 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:946:5
    #59 0x7a5f7d5b70d9 in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:856:5
    #60 0x7a5f7d5b5328 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:587:14
    #61 0x7a5f7bbe4c1b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:64:15
    #62 0x7a5f7c0b8be9 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/dom/ipc/./../../ipc/ipdl/PVsyncChild.cpp:241:78
    #63 0x7a5f72b1c5aa in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../ipdl/PBackgroundChild.cpp:4955:32
    #64 0x7a5f72a6e715 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1797:25
    #65 0x7a5f72a6ac0e in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1723:9
    #66 0x7a5f72a6ba27 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1512:3
    #67 0x7a5f72a6cf43 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1614:14
    #68 0x7a5f72815aaa in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:719:16
    #69 0x7a5f727f6519 in mozilla::TaskController::RunTask(mozilla::Task*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:210:19
    #70 0x7a5f727fd9bd in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1358:20
    #71 0x7a5f727fb498 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1181:15
    #72 0x7a5f727fbab6 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:655:36
    #73 0x7a5f728142a4 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:350:37
    #74 0x7a5f728142a4 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:536:5
    #75 0x7a5f7283903c in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1179:16
    #76 0x7a5f72843639 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:472:10
    #77 0x7a5f72a78623 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:105:5
    #78 0x7a5f7294fcf4 in RunInternal /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:371:10
    #79 0x7a5f7294fcf4 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
    #80 0x7a5f7294fcf4 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
    #81 0x7a5f7cd6e2a6 in nsBaseAppShell::Run() /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/nsBaseAppShell.cpp:151:27
    #82 0x7a5f7cf76c8b in nsAppShell::Run() /builds/worker/workspace/obj-build/widget/gtk/./../../../../checkouts/gecko/widget/gtk/nsAppShell.cpp:575:33
    #83 0x7a5f7f0ebe1d in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:20
    #84 0x7a5f7294fcf4 in RunInternal /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:371:10
    #85 0x7a5f7294fcf4 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
    #86 0x7a5f7294fcf4 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
    #87 0x7a5f7f0eacb1 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:594:34
    #88 0x57db59e1813a in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:466:22

Bugmon [:jkratzer for issues]

Comment 1

•

1 month ago

Verified bug as reproducible on mozilla-central 20260707211043-969c51e9686e.
The bug appears to have been introduced in the following build range:

Start: 142b1e30652d0136adaf7260c9f7f7e8e4ce8a9a (20260703022354)
End: 841554ad3dc3140da3d2d52c70548dbc67db0c92 (20260703062852)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=142b1e30652d0136adaf7260c9f7f7e8e4ce8a9a&tochange=841554ad3dc3140da3d2d52c70548dbc67db0c92

Keywords: regression

Whiteboard: [bugmon:bisected,confirmed]

Donal Meehan [:dmeehan]

Updated

•

1 month ago

status-firefox152: --- → unaffected

status-firefox153: --- → unaffected

status-firefox-esr115: --- → unaffected

status-firefox-esr140: --- → unaffected

Regressed by: 2038072

BugBot [:suhaib / :marco]

Comment 2

•

1 month ago

:TYLin, since you are the author of the regressor, bug 2038072, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Flags: needinfo?(aethanyc)

Ting-Yu Lin [:TYLin] (PST, UTC-7)

Assignee

Comment 3

•

1 month ago

I can take a look.

Keywords: pernosco-wanted

Ting-Yu Lin [:TYLin] (PST, UTC-7)

Assignee

Updated

•

1 month ago

Severity: -- → S3

Flags: needinfo?(aethanyc)

Ting-Yu Lin [:TYLin] (PST, UTC-7)

Assignee

Updated

•

1 month ago

Assignee: nobody → aethanyc

Status: NEW → ASSIGNED

Bugmon [:jkratzer for issues]

Comment 4

•

1 month ago

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Keywords: pernosco-wanted → pernosco

Ting-Yu Lin [:TYLin] (PST, UTC-7)

Assignee

Updated

•

1 month ago

Comment 5

•

1 month ago

Attached file Bug 2053288 - Prepare absolute frames before deleting inline's next-in-flows. r?#layout — Details

Bug 2038072 added the support to allow abspos frames, whose containing block is
an inline frame, to live under a later inline continuation. This bug cannot
happen when layout.abspos.fragment-aware-inline-cb.enabled = false.

In an incremental reflow scenario, an inline frame can already be split into
several continuations. However, if an inline frame becomes complete (e.g. during
a measuring reflow), we want to pull the absolute children's first-in-flows from
the inline frame's next-in-flows' absolute child lists before those
next-in-flows get destroyed. Otherwise, there might be dangling placeholders
without out-of-flows.

Pulsebot

Comment 6

•

1 month ago

Pushed by aethanyc@gmail.com: https://github.com/mozilla-firefox/firefox/commit/8b966872e24f https://hg.mozilla.org/integration/autoland/rev/95f6c9ecabd4 Prepare absolute frames before deleting inline's next-in-flows. r=layout-reviewers,dholbert

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Comment 7

•

1 month ago

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/61228 for changes under testing/web-platform/tests

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Updated

•

1 month ago

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

Cosmin Sabou [:CosminS]

Comment 8

•

1 month ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/95f6c9ecabd4

Status: ASSIGNED → RESOLVED

Closed: 1 month ago

status-firefox154: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → 154 Branch

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Comment 9

•

1 month ago

Upstream PR merged by moz-wptsync-bot

Bugmon [:jkratzer for issues]

Comment 10

•

1 month ago

Verified bug as fixed on rev mozilla-central 20260712113206-839d2838abd9.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED

status-firefox154: fixed → verified

Keywords: bugmon

BugBot [:suhaib / :marco]

Comment 11

•

1 month ago

Set release status flags based on info from the regressing bug 2038072

status-firefox-esr153: --- → unaffected

testcase.html 1 month ago Tyson Smith [:tsmith] (PTO -> Sept/8) 377 bytes, text/html		Details
Bug 2053288 - Prepare absolute frames before deleting inline's next-in-flows. r?#layout 1 month ago Ting-Yu Lin [:TYLin] (PST, UTC-7) 48 bytes, text/x-phabricator-request		Details \| Review

Bugzilla

crash near null in [@ GetFirstLeaf]

Categories

(Core :: Layout: Text and Fonts, defect)

Tracking

()

People

(Reporter: tsmith, Assigned: TYLin)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Updated

Comment 2

Comment 3

Updated

Updated

Comment 4

Updated

Comment 5

Comment 6

Comment 7

Updated

Comment 8

Comment 9

Comment 10

Comment 11

Attachment

General

Description

File Name

Content Type