Open
Bug 1818791
Opened 1 year ago
Updated 1 year ago
crash near null in [@ nsLayoutUtils::FindNearestCommonAncestorFrame]
Categories
(Core :: Disability Access APIs, defect)
Core
Disability Access APIs
Tracking
()
NEW
Tracking | Status | |
---|---|---|
firefox112 | --- | affected |
People
(Reporter: tsmith, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: crash, testcase)
Attachments
(2 files)
Found while fuzzing m-c 20230215-883fd80a1c94 (--enable-address-sanitizer --enable-fuzzing)
To reproduce via Grizzly Replay:
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html
==325347==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x7f8a18c436cc bp 0x7ffe4d1100f0 sp 0x7ffe4d10f880 T0)
==325347==The signal is caused by a READ memory access.
==325347==Hint: address points to the zero page.
#0 0x7f8a18c436cc in nsLayoutUtils::FindNearestCommonAncestorFrame(nsIFrame const*, nsIFrame const*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h
#1 0x7f8a18c450e1 in nsLayoutUtils::TransformRect(nsIFrame const*, nsIFrame const*, nsRect&) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:2421:7
#2 0x7f8a1c867d21 in mozilla::a11y::HTMLAreaAccessible::ParentRelativeBounds() /builds/worker/checkouts/gecko/accessible/html/HTMLImageMapAccessible.cpp:207:3
#3 0x7f8a1c8160c6 in mozilla::a11y::LocalAccessible::BundleFieldsForCache(unsigned long, mozilla::a11y::CacheUpdateType) /builds/worker/checkouts/gecko/accessible/generic/LocalAccessible.cpp:3335:28
#4 0x7f8a1c813d7d in mozilla::a11y::DocAccessible::ProcessQueuedCacheUpdates() /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:1529:16
#5 0x7f8a1c7846fa in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:890:16
#6 0x7f8a18acaf5e in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2567:12
#7 0x7f8a18ad9ae6 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:373:13
#8 0x7f8a18ad9ae6 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:351:7
#9 0x7f8a18ad984e in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:5
#10 0x7f8a18ad95d5 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:911:5
#11 0x7f8a18ad886f in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:825:5
#12 0x7f8a18ad7aa2 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:746:5
#13 0x7f8a18ad729b in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:592:14
#14 0x7f8a18ad6e38 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:549:9
#15 0x7f8a1752bb8c in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#16 0x7f8a17a43c33 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:228:78
#17 0x7f8a1781b54c in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8784:32
#18 0x7f8a10e6c189 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#19 0x7f8a10e6919d in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#20 0x7f8a10e69d6e in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#21 0x7f8a10e6af9e in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#22 0x7f8a0f624809 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:541:16
#23 0x7f8a0f61ab9c in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:855:26
#24 0x7f8a0f617e18 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:686:15
#25 0x7f8a0f618540 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:464:36
#26 0x7f8a0f62ace1 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:188:37
#27 0x7f8a0f62ace1 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
#28 0x7f8a0f64f52e in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1225:16
#29 0x7f8a0f659aa4 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:477:10
#30 0x7f8a10e73d8e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#31 0x7f8a10cf2cd7 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#32 0x7f8a10cf2cd7 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#33 0x7f8a10cf2cd7 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#34 0x7f8a1849f709 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#35 0x7f8a1d4e73a8 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:742:20
#36 0x7f8a10cf2cd7 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#37 0x7f8a10cf2cd7 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#38 0x7f8a10cf2cd7 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#39 0x7f8a1d4e6b3f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:675:34
#40 0x559e4e970824 in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#41 0x559e4e970ce7 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:353:18
#42 0x7f8a32368d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#43 0x7f8a32368e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#44 0x559e4e8af2a8 in _start (/home/user/workspace/browsers/m-c-20230224092408-fuzzing-asan-opt/firefox+0x1122a8) (BuildId: bbf25bf221c1398aaadf0521432e1d23ff30f9fe)
Flags: in-testsuite?
Reporter | ||
Comment 1•1 year ago
|
||
prefs.js file for bugmon
Reporter | ||
Updated•1 year ago
|
Comment 2•1 year ago
|
||
Unable to reproduce bug 1818791 using build mozilla-central 20230215181635-883fd80a1c94. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Keywords: bugmon
Updated•1 year ago
|
Severity: -- → S3
You need to log in
before you can comment on or make changes to this bug.
Description
•