Bug: ==8710==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6e7a39f31e bp 0x7ffeae0c1290 sp 0x7ffeae0c1120 T0)
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2020-10-30 09:38:19+00:00
Resolved: 2020-11-06 22:56:25+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0

Steps to reproduce:

fuzzing using Grizzly 

The test cases wasn't reduced yet, can some one please tell me how the Grizzly reducer work ? 


Actual results:

Version 	84.0a1
Build ID 	20201028092421
User Agent 	Mozilla/5.0 (X11; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
OS 	Linux 5.4.0-48-generic #52~18.04.1-Ubuntu SMP Thu Sep 10 12:50:22 UTC 2020 

=================================================================
==8710==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6e7a39f31e bp 0x7ffeae0c1290 sp 0x7ffeae0c1120 T0)
==8710==The signal is caused by a WRITE memory access.
==8710==Hint: address points to the zero page.
    #0 0x7f6e7a39f31e in nsIFrame::SynthesizeBaselineBOffsetFromContentBox(mozilla::WritingMode, mozilla::BaselineSharingGroup) const /builds/worker/checkouts/gecko/layout/generic/nsIFrameInlines.h:157:3
    #1 0x7f6e7a5f887f in nsTableRowFrame::GetRowBaseline(mozilla::WritingMode) /builds/worker/checkouts/gecko/layout/tables/nsTableRowFrame.cpp:402:29
    #2 0x7f6e7a5f887f in nsTableFrame::GetNaturalBaselineBOffset(mozilla::WritingMode, mozilla::BaselineSharingGroup, int*) const::$_1::operator()(nsTableRowGroupFrame*, nsTableRowFrame*) const /builds/worker/checkouts/gecko/layout/tables/nsTableFrame.cpp:3632:41
    #3 0x7f6e7a5f7f62 in nsTableFrame::GetNaturalBaselineBOffset(mozilla::WritingMode, mozilla::BaselineSharingGroup, int*) const /builds/worker/checkouts/gecko/layout/tables/nsTableFrame.cpp:3639:22
    #4 0x7f6e7a5f76a5 in nsTableFrame::GetLogicalBaseline(mozilla::WritingMode) const /builds/worker/checkouts/gecko/layout/tables/nsTableFrame.cpp:3612:8
    #5 0x7f6e7a63a37d in nsTableWrapperFrame::GetLogicalBaseline(mozilla::WritingMode) const /builds/worker/checkouts/gecko/layout/tables/nsTableWrapperFrame.cpp:45:15
    #6 0x7f6e79f65d62 in nsLayoutUtils::GetFirstLinePosition(mozilla::WritingMode, nsIFrame const*, nsLayoutUtils::LinePosition*) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5691:36
    #7 0x7f6e79f656cf in nsLayoutUtils::GetFirstLinePosition(mozilla::WritingMode, nsIFrame const*, nsLayoutUtils::LinePosition*) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5737:11
    #8 0x7f6e79f6516c in nsLayoutUtils::GetFirstLineBaseline(mozilla::WritingMode, nsIFrame const*, int*) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:5656:8
    #9 0x7f6e7a5abd2e in nsTableCellFrame::GetCellBaseline() const /builds/worker/checkouts/gecko/layout/tables/nsTableCellFrame.cpp:681:7
    #10 0x7f6e7a618452 in nsTableRowFrame::ReflowChildren(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsTableFrame&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/tables/nsTableRowFrame.cpp:861:51
    #11 0x7f6e7a61c419 in nsTableRowFrame::Reflow(nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, nsReflowStatus&) /builds/worker/checkouts/gecko/layout/tables/nsTableRowFrame.cpp:1019:3
    #12 0x7f6e7a10a59a in nsContainerFrame::ReflowChild(nsIFrame*, nsPresContext*, mozilla::ReflowOutput&, mozilla::ReflowInput const&, mozilla::WritingMode const&, mozilla::LogicalPoint const&, nsSize const&, nsIFrame::ReflowChildFlags, nsReflowStatus&, nsOverflowContinuationTracker*) /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:1081:14
    #13 0x7f6e7a626dfd in nsTableRowGroupFrame::ReflowChildren(nsPresContext*, mozilla::ReflowOutput&, mozilla::TableRowGroupReflowInput&, nsReflowStatus&, bool*) /builds/worker/checkouts/gecko/layout/tables/nsTableRowGroupFrame.cpp:408:7


Expected results:

no crash