Found while fuzzing m-c 20230713-211b29e869ca (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

==21997==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f23f759a9f2 bp 0x7ffe52a8a710 sp 0x7ffe52a8a320 T0)
==21997==The signal is caused by a READ memory access.
==21997==Hint: address points to the zero page.
    #0 0x7f23f759a9f2 in mozilla::nsDisplayBlendMode::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5126:30
    #1 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #2 0x7f23f759bcdb in mozilla::nsDisplayBlendContainer::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5188:18
    #3 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #4 0x7f23f75b409c in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits>> const&) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6894:20
    #5 0x7f23f75b2519 in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6861:3
    #6 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #7 0x7f23f759a850 in mozilla::nsDisplayBlendMode::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5116:18
    #8 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #9 0x7f23f759bcdb in mozilla::nsDisplayBlendContainer::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5188:18
    #10 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #11 0x7f23f759a850 in mozilla::nsDisplayBlendMode::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5116:18
    #12 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #13 0x7f23f759bcdb in mozilla::nsDisplayBlendContainer::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5188:18
    #14 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #15 0x7f23f75b409c in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits>> const&) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6894:20
    #16 0x7f23f75b2519 in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6861:3
    #17 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #18 0x7f23f759a850 in mozilla::nsDisplayBlendMode::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5116:18
    #19 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #20 0x7f23f759bcdb in mozilla::nsDisplayBlendContainer::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5188:18
    #21 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #22 0x7f23f75b409c in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits>> const&) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6894:20
    #23 0x7f23f75b2519 in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6861:3
    #24 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #25 0x7f23f759a850 in mozilla::nsDisplayBlendMode::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5116:18
    #26 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #27 0x7f23f75b409c in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits>> const&) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6894:20
    #28 0x7f23f75b2519 in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6861:3
    #29 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #30 0x7f23f75b409c in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, mozilla::Maybe<mozilla::gfx::PolygonTyped<mozilla::gfx::UnknownUnits>> const&) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6894:20
    #31 0x7f23f75b2519 in mozilla::nsDisplayTransform::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6861:3
    #32 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #33 0x7f23f759bcdb in mozilla::nsDisplayBlendContainer::Paint(mozilla::nsDisplayListBuilder*, gfxContext*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5188:18
    #34 0x7f23f74ef8a0 in mozilla::nsDisplayList::Paint(mozilla::nsDisplayListBuilder*, gfxContext*, int) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2240:11
    #35 0x7f23f7567881 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2308:5
    #36 0x7f23f6c93af3 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:3428:9
    #37 0x7f23f70bb7e9 in nsPageSequenceFrame::PrintNextSheet() /builds/worker/checkouts/gecko/layout/generic/nsPageSequenceFrame.cpp:699:3
    #38 0x7f23f762ab4a in nsPrintJob::PrintSheet(nsPrintObject*, bool&) /builds/worker/checkouts/gecko/layout/printing/nsPrintJob.cpp:1843:31
    #39 0x7f23f762a1b1 in nsPagePrintTimer::Run() /builds/worker/checkouts/gecko/layout/printing/nsPagePrintTimer.cpp:92:43
    #40 0x7f23ead0695a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
    #41 0x7f23eacf0fc8 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:880:26
    #42 0x7f23eaced997 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:704:15
    #43 0x7f23eacee279 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
    #44 0x7f23ead0e434 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:221:37
    #45 0x7f23ead0e434 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #46 0x7f23ead38a13 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
    #47 0x7f23ead46734 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
    #48 0x7f23ee8566c4 in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, mozilla::ErrorResult&)::$_1>(nsTSubstring<char> const&, nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, mozilla::ErrorResult&)::$_1&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
    #49 0x7f23ee850ede in nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5186:5
    #50 0x7f23ee84e8b2 in nsGlobalWindowOuter::PrintOuter(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:4985:3
    #51 0x7f23ee7d1b4c in nsGlobalWindowInner::Print(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:3740:3
    #52 0x7f23f097b546 in mozilla::dom::Window_Binding::print(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:3551:24
    #53 0x7f23f15f76d1 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3327:13
    #54 0x7f23fc474033 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
    #55 0x7f23fc474033 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:12
    #56 0x7f23fc498bc1 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
    #57 0x7f23fc498bc1 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:652:10
    #58 0x7f23fc498bc1 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3395:16
    #59 0x7f23fc472dab in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:400:10
    #60 0x7f23fc472dab in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:458:13
    #61 0x7f23fc4741ec in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:612:13
    #62 0x7f23fc476166 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
    #63 0x7f23fc476166 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
    #64 0x7f23fc5cb90b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
    #65 0x7f23f0691b45 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:828:8
    #66 0x7f23eecd3e2b in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:733:12
    #67 0x7f23eecd3e2b in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:746:12
    #68 0x7f23eecd3e2b in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) /builds/worker/checkouts/gecko/dom/base/IdleRequest.cpp:58:13
    #69 0x7f23ee798915 in nsGlobalWindowInner::RunIdleRequest(mozilla::dom::IdleRequest*, double, bool) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:727:12
    #70 0x7f23ee7968f3 in nsGlobalWindowInner::ExecuteIdleRequest(mozilla::TimeStamp) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:755:3
    #71 0x7f23ee796263 in IdleRequestExecutor::Run() /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:596:13
    #72 0x7f23ead0695a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
    #73 0x7f23eacf0fc8 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:880:26
    #74 0x7f23eacedd7d in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:746:15
    #75 0x7f23eacee279 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
    #76 0x7f23ead0e401 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
    #77 0x7f23ead0e401 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #78 0x7f23ead38a13 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
    #79 0x7f23ead46734 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
    #80 0x7f23ec93654e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #81 0x7f23ec761e6a in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #82 0x7f23ec761e6a in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #83 0x7f23ec761e6a in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #84 0x7f23f6164409 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
    #85 0x7f23fbd1aaab in nsAppStartup::Run() /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:295:30
    #86 0x7f23fc01d1bf in XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5661:22
    #87 0x7f23fc01f374 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5862:8
    #88 0x7f23fc020571 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5918:21
    #89 0x559331a89683 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:227:22
    #90 0x559331a89683 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:445:16
    #91 0x7f2411a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #92 0x7f2411a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #93 0x5593319b3078 in _start (/home/user/workspace/browsers/m-c-20230714094120-fuzzing-asan-opt/firefox+0x105078) (BuildId: cb19754cfe218b6dcefcb321f9dcee015c05fd4d)

Couldn't reproduce. Maybe needs some of the non-default fuzzer prefs?

Unable to reproduce bug 1843605 using build mozilla-central 20230713091748-211b29e869ca. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

needinto Tyson for when back from pto. Either a prefs file or a pernosco would help make progress here.

Ah ha yes, I missed the prefs file.

browser.tabs.remote.autostart=false is the key here.

Still wasn't able to reproduce with the prefs.js file.

If browser.tabs.remote.autostart=false is indeed required then priority of this is probably really low.

Verified bug as reproducible on mozilla-central 20230725211415-d527a0783112.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: b2f38ca819abdcc61dcd6451707cac2f5861b9e3 (20220727093731)
End: 211b29e869cab1e9d99577edd8b6fa2fed823f77 (20230713091748)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

A pernosco session for this bug can be found here.

We get to here
https://searchfox.org/mozilla-central/rev/b6b8ff043e944a5e32ea63208d3ba7cb6b16191d/gfx/cairo/cairo/src/cairo-ft-font.c#960
and sf.x_scale is a very large number, so that probably causes the FT_Set_Char_Size call to fail. That error gets propagated all the way up to make the draw target not valid. There is a scale 53 in the testcase, so that's probably why we get the large value.

Feels weird to call this "bisected" when bisection failed, fwiw!