Closed Bug 2086675 Opened 17 days ago Closed 16 days ago

crash near null in [@ nsCSSFrameConstructor::ConstructBlock]

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
161 Branch
Tracking Flags:
Tracking Status
firefox-esr115 160+ verified
firefox-esr153 160+ verified
firefox159 --- unaffected
firefox160 --- verified
firefox161 --- verified

People

(Reporter: tsmith, Assigned: dshin)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(1 file, 4 external files)

testcase.html
235 bytes, text/html
Details
Attached file testcase.html —

Found while fuzzing m-c 20261027-d9007e19b8a4 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

==37255==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000005d (pc 0x7bffdb149a9f bp 0x7fffffff7690 sp 0x7fffffff7580 T0)
==37255==The signal is caused by a READ memory access.
==37255==Hint: address points to the zero page.
    #0 0x7bffdb149a9f in HasAnyStateBits /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h:2663:59
    #1 0x7bffdb149a9f in nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameList&, nsIFrame*) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:10087:21
    #2 0x7bffdb15134c in nsCSSFrameConstructor::ConstructNonScrollableBlock(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4363:3
    #3 0x7bffdb1531ad in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:3684:16
    #4 0x7bffdb159f4c in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:5320:3
    #5 0x7bffdb13ff27 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8928:5
    #6 0x7bffdb1417ab in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameList&, bool, nsIFrame*) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:9231:3
    #7 0x7bffdb149b8b in nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameList&, nsIFrame*) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:10094:3
    #8 0x7bffdb14da34 in nsCSSFrameConstructor::ConstructScrollableBlockWithScrollContainer(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&, nsContainerFrame*&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4348:3
    #9 0x7bffdb15142c in nsCSSFrameConstructor::ConstructScrollableBlock(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4320:3
    #10 0x7bffdb1531ad in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:3684:16
    #11 0x7bffdb159f4c in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:5320:3
    #12 0x7bffdb13ff27 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8928:5
    #13 0x7bffdb15f3a4 in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:6496:3
    #14 0x7bffdaedd413 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/RestyleManager.cpp:1755:25
    #15 0x7bffdaee74ae in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/RestyleManager.cpp:3325:7
    #16 0x7bffdaee87ee in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/workspace/obj-build/layout/style/./../../../../checkouts/gecko/layout/style/RestyleManager.cpp:3424:3
    #17 0x7bffdb0b959d in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:4663:37
    #18 0x7bffd30dc544 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1565:5
    #19 0x7bffd30dc544 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/Document.cpp:12128:16
    #20 0x7bffd641da8b in mozilla::dom::HTMLDialogElement::FocusDialog() /builds/worker/workspace/obj-build/dom/html/./../../../../checkouts/gecko/dom/html/HTMLDialogElement.cpp:588:10
    #21 0x7bffd641e5ee in mozilla::dom::HTMLDialogElement::ShowModal(mozilla::dom::Element*, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/html/./../../../../checkouts/gecko/dom/html/HTMLDialogElement.cpp:513:3
    #22 0x7bffd380b357 in ShowModal /builds/worker/workspace/obj-build/dist/include/mozilla/dom/HTMLDialogElement.h:100:12
    #23 0x7bffd380b357 in mozilla::dom::HTMLDialogElement_Binding::showModal(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./HTMLDialogElementBinding.cpp:332:24
    #24 0x7bffd51e4bfd in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./../../../../checkouts/gecko/dom/bindings/BindingUtils.cpp:3218:13
    #25 0x7bffdec5b38a in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:539:13
    #26 0x7bffdec5b38a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:637:12
    #27 0x7bffdec78003 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:704:10
    #28 0x7bffdec78003 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:709:10
    #29 0x7bffdec78003 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3292:16
    #30 0x7bffdec5a284 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:422:10
    #31 0x7bffdec5a284 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    #32 0x7bffdec5b50a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:669:13
    #33 0x7bffdec5cf78 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:704:10
    #34 0x7bffdec5cf78 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:736:8
    #35 0x7bffdefa8af5 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/CallAndConstruct.cpp:118:10
    #36 0x7bffd47dcd01 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./WindowBinding.cpp:459:8
    #37 0x7bffd3255681 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:395:12
    #38 0x7bffd3255681 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:408:12
    #39 0x7bffd3255681 in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) /builds/worker/workspace/obj-build/dom/base/./../../../../checkouts/gecko/dom/base/IdleRequest.cpp:68:13
    ...
Flags: in-testsuite?

Debug builds report: Assertion failure: mRealFixedList.mContainingBlock (No root frame?), at checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:931

Hits https://searchfox.org/firefox-main/rev/ff3b300c151f45f09f300284659f24f5d95b0f25/layout/base/nsCSSFrameConstructor.cpp#931

Regressed by bug 2081939. I think we probably want to keep mRealFixedList as the root frame here... Or at least we should also set mTopLayerAbsoluteList to null if there's no abspos CB...

But I think they should generally both be non-null, and null them out only for the repeating case (though it probably doesn't matter because bug 1981732).

Keywords: regression
See Also: → 1981732
Assignee: nobody → dshin
Flags: needinfo?(dshin)

Verified bug as reproducible on mozilla-central 20261028213039-034aba04d78b.
The bug appears to have been introduced in the following build range:

Start: 36a2b6a4b0c8e4252788a8cf7f4190093dc62721 (20261027191214)
End: 5eca1c5aa46f9c05717bd6205db8160959f21fc3 (20261027193000)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=36a2b6a4b0c8e4252788a8cf7f4190093dc62721&tochange=5eca1c5aa46f9c05717bd6205db8160959f21fc3

Whiteboard: [bugmon:bisected,confirmed]
Pushed by dshin@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/a27c3a89f3c9 https://hg.mozilla.org/integration/autoland/rev/e34439b8dba6 Unset fixed containing blocks explicitly for repeating table headers only. r=layout-reviewers,emilio

https://hg.mozilla.org/mozilla-central/rev/e34439b8dba6

Status: NEW → RESOLVED
Closed: 16 days ago
status-firefox161: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 161 Branch

The patch landed in nightly and beta is affected, along with ESR.

:dshin, please make an uplift decision for beta and ESR:

  • For beta, nominate the patch for beta uplift approval if the fix should be included in this release, or set status-firefox160 to wontfix if the fix can wait for the next release.
  • For ESR, nominate the patch for the appropriate ESR uplift approval if the fix should be included in ESR, or set the ESR status flag(s) to wontfix if an uplift isn't needed. Each affected ESR release needs a decision.

Uplift requests can be submitted from Lando: D337717.

See Requesting an Uplift for documentation on how to request an uplift.

For more information, please visit BugBot documentation.

Flags: needinfo?(dshin)
Attachment #9671088 - Flags: approval-mozilla-beta?

firefox-beta Uplift Approval Request

  • User impact if declined/Reason for urgency: Relatively short path to crash
  • Code covered by automated testing?: yes
  • Fix verified in Nightly?: yes
  • Needs manual QE testing?: yes
  • Steps to reproduce for manual QE testing: Confirmed via mozregression --launch 2026-10-29 -B debug with the fuzz testcase, as well as cases in Bug 2081939.
  • Risk associated with taking this patch: low
  • Explanation of risk level: Tightening the special casing
  • String changes made/needed?: No
  • Is Android affected?: yes
Flags: qe-verify+
Attachment #9671095 - Flags: approval-mozilla-esr153?

firefox-esr153 Uplift Approval Request

  • User impact if declined/Reason for urgency: Relatively short path to crash
  • Code covered by automated testing?: yes
  • Fix verified in Nightly?: yes
  • Needs manual QE testing?: yes
  • Steps to reproduce for manual QE testing: Confirmed via mozregression --launch 2026-10-29 -B debug with the fuzz testcase, as well as cases in Bug 2081939.
  • Risk associated with taking this patch: low
  • Explanation of risk level: Tightening the special casing
  • String changes made/needed?: No
  • Is Android affected?: yes
Attachment #9671088 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9671115 - Flags: approval-mozilla-esr115?

firefox-esr115 Uplift Approval Request

  • User impact if declined/Reason for urgency: Relatively short path to crash
  • Code covered by automated testing?: yes
  • Fix verified in Nightly?: yes
  • Needs manual QE testing?: yes
  • Steps to reproduce for manual QE testing: Confirmed via mozregression --launch 2026-10-29 -B debug with the fuzz testcase, as well as cases in Bug 2081939.
  • Risk associated with taking this patch: low
  • Explanation of risk level: Tightening the special casing
  • String changes made/needed?: No
  • Is Android affected?: yes
Attachment #9671095 - Flags: approval-mozilla-esr153? → approval-mozilla-esr153+

Verified bug as fixed on rev mozilla-central 20261029094000-eef421b1b07d.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox161: fixed → verified
Keywords: bugmon
QA Whiteboard: [uplift][qa-ver-needed-c161/b160]
Attachment #9671115 - Flags: approval-mozilla-esr115? → approval-mozilla-esr115+

I was able to reproduce the tab crash with Firefox 161.0a1 (20261027212543) on Windows 11 by loading the attached testcase.html and on Ubuntu 26 using Grizzly replay while fuzzing m-c 20261027-d9007e19b8a4.

Loading testcase.html no longer triggers the crash in Firefox 161.0a1 (20261029212358), 160.0b3 (20261029131612), or 153.7.0esr (20261029210736) across Windows 11, macOS 27, and Ubuntu 26. Additionally, testcase.html was verified on ASAN builds 160.0b3 (20261030090331) and 161.0a1 (20261030090406) on Windows 11 and was also verified using steps from comment 0 on Ubuntu 26 and No results detected messages were reported inside the terminal.

The test cases from bug 2081939 were also verified. Note that on Ubuntu 26, exp.html still triggers a tab crash (see bug 2087482).

QA Whiteboard: [uplift][qa-ver-needed-c161/b160] → [uplift][qa-ver-done-c161/b160]
status-firefox160: fixed → verified
status-firefox-esr153: fixed → verified
Flags: qe-verify+

Clearing the uplift needinfo request since this bug is closed and no Firefox version is marked as affected anymore.

For more information, please visit BugBot documentation.

Flags: needinfo?(dshin)

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/64713 for changes under testing/web-platform/tests

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

Upstream PR merged by moz-wptsync-bot

Verified fixed with 115.45.0esr on Windows 11, macOS 26. No tab crash after loading poc.html, exp.html and testcase.html.
On Ubuntu 26 no tab crash can be seen with poc.html and testcase.html and the crash with exp.html is tracked in bug 2082289.

status-firefox-esr115: fixed → verified
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: