Found while fuzzing 20240608-3d3c5f739ff3 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Marking s-s since this does not appear to be caught by frame poisoning.

==171994==ERROR: AddressSanitizer: use-after-poison on address 0x52500030d2ab at pc 0x78353c45967c bp 0x7ffea20eb190 sp 0x7ffea20eb188
READ of size 8 at 0x52500030d2ab thread T0 (Isolated Web Co)
    #0 0x78353c45967b in GetDescendantLeadings /builds/worker/checkouts/gecko/layout/generic/nsRubyBaseContainerFrame.h:60:12
    #1 0x78353c45967b in nsRubyFrame::ReflowSegment(nsPresContext*, mozilla::ReflowInput const&, int, int, nsRubyBaseContainerFrame*, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsRubyFrame.cpp:276:52
    #2 0x78353c4576b3 in nsRubyFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsRubyFrame.cpp:132:5
    #3 0x78353c41959a in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:895:13
    #4 0x78353c4173b2 in nsInlineFrame::ReflowInlineFrame(nsPresContext*, mozilla::ReflowInput const&, nsInlineFrame::InlineReflowInput&, nsIFrame*, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsInlineFrame.cpp:666:15
    #5 0x78353c415c7c in nsInlineFrame::ReflowFrames(nsPresContext*, mozilla::ReflowInput const&, nsInlineFrame::InlineReflowInput&, mozilla::ReflowOutput&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsInlineFrame.cpp:540:7
    #6 0x78353c4150c1 in nsInlineFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsInlineFrame.cpp:356:3
    #7 0x78353c45b1d1 in nsRubyTextFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsRubyTextFrame.cpp:70:23
    #8 0x78353c41959a in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:895:13
    #9 0x78353c452596 in nsRubyBaseContainerFrame::ReflowSpans(nsRubyBaseContainerFrame::RubyReflowInput const&) /builds/worker/checkouts/gecko/layout/generic/nsRubyBaseContainerFrame.cpp:813:17
    #10 0x78353c45070c in nsRubyBaseContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsRubyBaseContainerFrame.cpp:381:25
    #11 0x78353c41959a in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:895:13
    #12 0x78353c4583ec in nsRubyFrame::ReflowSegment(nsPresContext*, mozilla::ReflowInput const&, int, int, nsRubyBaseContainerFrame*, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsRubyFrame.cpp:188:29
    #13 0x78353c4576b3 in nsRubyFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsRubyFrame.cpp:132:5
    #14 0x78353c41959a in nsLineLayout::ReflowFrame(nsIFrame*, nsReflowStatus&, mozilla::ReflowOutput*, bool&) /builds/worker/checkouts/gecko/layout/generic/nsLineLayout.cpp:895:13
    #15 0x78353c22e48d in nsBlockFrame::ReflowInlineFrame(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsIFrame*, LineReflowStatus*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:5057:15
    #16 0x78353c22c815 in nsBlockFrame::DoReflowInlineFrames(mozilla::BlockReflowState&, nsLineLayout&, nsLineList_iterator, nsFlowAreaRect&, int&, nsFloatManager::SavedState*, bool*, LineReflowStatus*, bool) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4859:5
    #17 0x78353c225b21 in nsBlockFrame::ReflowInlineFrames(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:4717:9
    #18 0x78353c21fde0 in nsBlockFrame::ReflowLine(mozilla::BlockReflowState&, nsLineList_iterator, bool*) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3685:24
    #19 0x78353c21533b in nsBlockFrame::ReflowDirtyLines(mozilla::BlockReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:3191:29
    #20 0x78353c20f15c in nsBlockFrame::TrialReflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsBlockFrame::TrialReflowState&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1885:35
    #21 0x78353c20c25a in nsBlockFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:1528:9
    #22 0x78353c26ad77 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:889:14
    #23 0x78353c249e8d in nsCanvasFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:717:7
    #24 0x78353c26ad77 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:889:14
    #25 0x78353c193d0f in mozilla::ScrollContainerFrame::ReflowScrolledFrame(mozilla::ScrollReflowInput&, bool, bool, mozilla::ReflowOutput*) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:916:3
    #26 0x78353c195fb9 in mozilla::ScrollContainerFrame::ReflowContents(mozilla::ScrollReflowInput&, mozilla::ReflowOutput const&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1051:3
    #27 0x78353c19abaa in mozilla::ScrollContainerFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ScrollContainerFrame.cpp:1519:3
    #28 0x78353c27c258 in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, int, int, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:930:14
    #29 0x78353c1fc2bf in mozilla::ViewportFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:356:7
    #30 0x78353bfa6ffc in mozilla::PresShell::DoReflow(nsIFrame*, bool, mozilla::OverflowChangedTracker*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:9833:11
    #31 0x78353bfe9a37 in mozilla::PresShell::ProcessReflowCommands(bool) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10006:22
    #32 0x78353bfb96f5 in DoFlushLayout /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:10053:10
    #33 0x78353bfb96f5 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4366:9
    #34 0x78353bf41c40 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1455:5
    #35 0x78353bf41c40 in nsRefreshDriver::FlushLayoutOnPendingDocsAndFixUpFocus() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2229:31
    #36 0x78353bf3f2d4 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2716:3
    #37 0x78353bf52537 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:13
    #38 0x78353bf52537 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:346:7
    #39 0x78353bf5224a in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:362:5
    #40 0x78353bf51ec1 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:952:5
    #41 0x78353bf50ee7 in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:862:5
    #42 0x78353bf4fb49 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:759:5
    #43 0x78353bf4f188 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:593:14
    #44 0x78353bf4edc5 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:550:9
    #45 0x78353a7e116b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
    #46 0x78353acf2194 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:222:78
    #47 0x78353ab205bf in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8154:32
    #48 0x783532148125 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1820:25
    #49 0x783532143f1f in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1739:9
    #50 0x783532144ff1 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1530:3
    #51 0x783532146543 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1630:14
    #52 0x783530859e4a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:580:16
    #53 0x78353084597d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:907:26
    #54 0x783530842f58 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:730:15
    #55 0x783530843576 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:516:36
    #56 0x783530861071 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:234:37
    #57 0x783530861071 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #58 0x7835308836dd in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1204:16
    #59 0x78353088e9c8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
    #60 0x783532150a9e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #61 0x783531f9d8e4 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #62 0x783531f9d8e4 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #63 0x783531f9d8e4 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #64 0x78353b827329 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
    #65 0x78353b9daf2a in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:469:33
    #66 0x78353d8d6f3d in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:712:20
    #67 0x783531f9d8e4 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #68 0x783531f9d8e4 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #69 0x783531f9d8e4 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #70 0x78353d8d6525 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:647:34
    #71 0x6291db903670 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #72 0x6291db903670 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:378:18
    #73 0x783553429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #74 0x783553429e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #75 0x6291db82acd8 in _start (/home/user/workspace/browsers/m-c-20240613215041-fuzzing-asan-opt/firefox+0xd6cd8) (BuildId: a6741a29c60a2872392781df3f56a04e3b6c8e67)

Verified bug as reproducible on mozilla-central 20240613225703-32dddfc0818f.
The bug appears to have been introduced in the following build range:

Start: 369d5331352d27705546143e21e194b8cd88b5be (20240604094831)
End: 179b4068029ab78efe95cf160bf4d13026349a4d (20240604104127)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=369d5331352d27705546143e21e194b8cd88b5be&tochange=179b4068029ab78efe95cf160bf4d13026349a4d

Bug 1850834 from the pushlog in Comment 1 looks like a possible regressor. Please correct if needed.

Does bug 1902156 fix this by any chance?

(In reply to Emilio Cobos Álvarez (:emilio) from comment #3)

Does bug 1902156 fix this by any chance?

Does not seem to. I can reproduce the issue with m-c 20240615-71d0793fa963.

Ruby layout requires the first box inside an nsRubyFrame to be an
nsRubyBaseContainerFrame, even when empty, so we can't eagerly remove
it.

Comment on attachment 9408276 [details]
Bug 1902540 - Don't remove first rbc child if still needed. r=dholbert,#layout

Security Approval Request

• How easily could an exploit be constructed based on the patch?: somewhat, if you know what you're doing?
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: beta
• If not all supported branches, which bug introduced the flaw?: Bug 1850834
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: Applies cleanly
• How likely is this patch to cause regressions; how much testing does it need?: not very likely
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Jason it looks like bugmon failed to collected a Pernosco session.

Note: The fuzzers have now also reported a test case that triggers:

==148843==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5250007fc903 at pc 0x7087ad310d3c bp 0x7fff09c0ec50 sp 0x7fff09c0ec48
READ of size 8 at 0x5250007fc903 thread T0 (Isolated Web Co)
    #0 0x7087ad310d3b in GetDescendantLeadings /gecko/layout/generic/nsRubyBaseContainerFrame.h:60:12
    #1 0x7087ad310d3b in nsRubyFrame::ReflowSegment(nsPresContext*, mozilla::ReflowInput const&, int, int, nsRubyBaseContainerFrame*, nsReflowStatus&) /gecko/layout/generic/nsRubyFrame.cpp:276:52
    ...

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

A pernosco session for this bug can be found here.

Comment on attachment 9408276 [details]
Bug 1902540 - Don't remove first rbc child if still needed. r=dholbert,#layout

sec-approval+ = dveditz Please prepare a Fx128 beta-branch patch and request beta uplift.

We can check the test in a couple of weeks after Fx 128 ships, say July 22 or later.

Comment on attachment 9408276 [details]
Bug 1902540 - Don't remove first rbc child if still needed. r=dholbert,#layout

Beta/Release Uplift Approval Request

• User impact if declined: Sec bug
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: comment 0 doesn't crash
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Relatively simple fix.
• String changes made/needed: none
• Is Android affected?: Yes

https://hg.mozilla.org/mozilla-central/rev/7c3284967e5d

Verified bug as fixed on rev mozilla-central 20240623094005-ae642c157034.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment on attachment 9408276 [details]
Bug 1902540 - Don't remove first rbc child if still needed. r=dholbert,#layout

Approved for 128.0b8

bugmon, when time permits could you take a look on Beta builds and verify this?

Brindusa, in the future if you need help with the bugmon bot, please NI me instead. The bugmon account is only used for automation.

Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

(In reply to Jason Kratzer [:jkratzer] from comment #20)

Brindusa, in the future if you need help with the bugmon bot, please NI me instead. The bugmon account is only used for automation.

Jason, thank you for verification.
Removing the qe-verify+ flag as bug was verified on fixed versions.

a month ago, dveditz placed a reminder on the bug using the whiteboard tag [reminder-test 2024-07-22] .

emilio, please refer to the original comment to better understand the reason for the reminder.

https://hg.mozilla.org/mozilla-central/rev/ac4a1f84adfa