Jason Kratzer [:jkratzer] Reporter
	Description • 6 years ago

Testcase found while fuzzing mozilla central rev ea869706644d.

Due to intermittent nature of the bug, testcase is not fully reduced.  Further, it requires a local web server in order to trigger.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007feff64c0800
rsi = 0x00007ff0285888b0   rdi = 0x00007ff028587680
rbp = 0x00007ff006098590   rsp = 0x00007ff0060984a0
r8 = 0x00007ff0285888b0    r9 = 0x00007ff006099700
r10 = 0x00000000ffffffee   r11 = 0x0000000000000000
r12 = 0x00007ff006098950   r13 = 0x00007feffb024b84
r14 = 0x00007ff006098a18   r15 = 0x00007feffde65aa8
rip = 0x00007ff017bd5b76
OS|Linux|0.0.0 Linux 4.15.0-33-generic #36-Ubuntu SMP Wed Aug 15 16:00:05 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|26
26|0|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>, mozilla::layers::ForEachNode(Node, const PreAction&) [with Iterator = mozilla::layers::ForwardIterator; Node = mozilla::layers::Layer*; PreAction = mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>]::<lambda(mozilla::layers::Layer*)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/AsyncCompositionManager.cpp:ea869706644d3b2354b2438c77671d6e43df5e99|744|0x2b
26|1|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>, mozilla::layers::ForEachNode(Node, const PreAction&) [with Iterator = mozilla::layers::ForwardIterator; Node = mozilla::layers::Layer*; PreAction = mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>]::<lambda(mozilla::layers::Layer*)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:ea869706644d3b2354b2438c77671d6e43df5e99|142|0x19
26|2|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>, mozilla::layers::ForEachNode(Node, const PreAction&) [with Iterator = mozilla::layers::ForwardIterator; Node = mozilla::layers::Layer*; PreAction = mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>]::<lambda(mozilla::layers::Layer*)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:ea869706644d3b2354b2438c77671d6e43df5e99|142|0x19
26|3|libxul.so|mozilla::layers::ForEachNode<mozilla::layers::ForwardIterator, mozilla::layers::Layer*, mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>, mozilla::layers::ForEachNode(Node, const PreAction&) [with Iterator = mozilla::layers::ForwardIterator; Node = mozilla::layers::Layer*; PreAction = mozilla::layers::SampleAnimations(mozilla::layers::Layer*, mozilla::layers::CompositorAnimationStorage*, mozilla::TimeStamp, mozilla::TimeStamp)::<lambda(mozilla::layers::Layer*)>]::<lambda(mozilla::layers::Layer*)> >|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:ea869706644d3b2354b2438c77671d6e43df5e99|142|0x19
26|4|libxul.so|mozilla::layers::AsyncCompositionManager::TransformShadowTree(mozilla::TimeStamp, mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>, mozilla::layers::CompositorBridgeParentBase::TransformsToSkip)|hg:hg.mozilla.org/mozilla-central:gfx/layers/TreeTraversal.h:ea869706644d3b2354b2438c77671d6e43df5e99|165|0x8
26|5|libxul.so|mozilla::layers::CompositorBridgeParent::CompositeToTarget(mozilla::gfx::DrawTarget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorBridgeParent.cpp:ea869706644d3b2354b2438c77671d6e43df5e99|1047|0x1a
26|6|libxul.so|mozilla::layers::CompositorVsyncScheduler::Composite(mozilla::TimeStamp)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorVsyncScheduler.cpp:ea869706644d3b2354b2438c77671d6e43df5e99|245|0x6
26|7|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp), true, (mozilla::RunnableKind)1, mozilla::TimeStamp>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:ea869706644d3b2354b2438c77671d6e43df5e99|1168|0x18
26|8|libxul.so|MessageLoop::RunTask(already_AddRefed<nsIRunnable>)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ea869706644d3b2354b2438c77671d6e43df5e99|451|0x6
26|9|libxul.so|MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ea869706644d3b2354b2438c77671d6e43df5e99|459|0x17
26|10|libxul.so|MessageLoop::DoWork()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ea869706644d3b2354b2438c77671d6e43df5e99|534|0x5
26|11|libxul.so|base::MessagePumpDefault::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_pump_default.cc:ea869706644d3b2354b2438c77671d6e43df5e99|38|0x9
26|12|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ea869706644d3b2354b2438c77671d6e43df5e99|325|0x17
26|13|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ea869706644d3b2354b2438c77671d6e43df5e99|318|0x8
26|14|libxul.so|base::Thread::ThreadMain()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/thread.cc:ea869706644d3b2354b2438c77671d6e43df5e99|181|0x8
26|15|libxul.so|ThreadFunc|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/platform_thread_posix.cc:ea869706644d3b2354b2438c77671d6e43df5e99|44|0xa
26|16|libpthread-2.27.so||||0x76db
26|17|libc-2.27.so||||0x12188f

	Hiroyuki Ikezoe (:hiro)
	Comment 2 • 6 years ago

Great test case! Thanks!  This is the test case for bug 1459775.

I will check what the test case does (the test case is the most complicated test case I've ever seen.).

	Hiroyuki Ikezoe (:hiro)
	Comment 3 • 6 years ago

This might be different from bug 1459775 since the assertion is somewhat related to iterationComposite, as far as I know, we don't yet use iterationComposite in browser code.