Found while fuzzing m-c 20211217-ba22a155be2e (--enable-address-sanitizer --enable-fuzzing)
This was found by enabling the `float-cast-overflow` check in UBSan. This type of issue can create inconsistencies across platforms, architectures and optimization levels.
To enable this check add the following to your mozconfig:
```
ac_add_options --enable-undefined-sanitizer="float-cast-overflow"
```
To reproduce with the attached test case use the following commands:
```
$ pip install grizzly-framework
$ python -m grizzly.replay <ubsan-build>/firefox ./testcase.html --xvfb
```
```
src/objdir-ff-ubsan/dist/include/nsCoord.h:130:18: runtime error: -3.41666e+09 is outside the range of representable values of type 'int'
#0 0x7fcece987c31 in nsLayoutUtils::TransformRect(nsIFrame const*, nsIFrame const*, nsRect&) src/layout/base/nsLayoutUtils.cpp
#1 0x7fcece98813e in nsLayoutUtils::ClampRectToScrollFrames(nsIFrame*, nsRect const&) src/layout/base/nsLayoutUtils.cpp:2385:5
#2 0x7fcece84e327 in mozilla::AccessibleCaret::SetPosition(nsIFrame*, int) src/layout/base/AccessibleCaret.cpp:248:7
#3 0x7fcece855f24 in mozilla::AccessibleCaretManager::UpdateCaretsForSelectionMode(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&)::$_1::operator()(mozilla::AccessibleCaret*, nsIFrame*, int) const src/layout/base/AccessibleCaretManager.cpp:330:44
#4 0x7fcece855f24 in mozilla::AccessibleCaretManager::UpdateCaretsForSelectionMode(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&) src/layout/base/AccessibleCaretManager.cpp:349:7
#5 0x7fcece8550aa in mozilla::AccessibleCaretManager::UpdateCarets(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&) src/layout/base/AccessibleCaretManager.cpp:210:7
#6 0x7fcece854d98 in mozilla::AccessibleCaretManager::OnSelectionChanged(mozilla::dom::Document*, mozilla::dom::Selection*, short) src/layout/base/AccessibleCaretManager.cpp:171:3
#7 0x7fcece8e574d in mozilla::AccessibleCaretEventHub::NoActionState::OnSelectionChanged(mozilla::AccessibleCaretEventHub*, mozilla::dom::Document*, mozilla::dom::Selection*, short) src/layout/base/AccessibleCaretEventHub.cpp:87:25
#8 0x7fcece853634 in mozilla::AccessibleCaretEventHub::OnSelectionChange(mozilla::dom::Document*, mozilla::dom::Selection*, short) src/layout/base/AccessibleCaretEventHub.cpp:664:11
#9 0x7fcec978c953 in mozilla::dom::Selection::NotifySelectionListeners() src/dom/base/Selection.cpp:3169:10
#10 0x7fceceb229b7 in nsFrameSelection::NotifySelectionListeners(mozilla::SelectionType) src/layout/generic/nsFrameSelection.cpp:2170:16
#11 0x7fceceb24ff5 in nsFrameSelection::EndBatchChanges(short) src/layout/generic/nsFrameSelection.cpp:2161:5
#12 0x7fcec979919c in mozilla::dom::Selection::EndBatchChanges(short) src/dom/base/Selection.cpp:3197:21
#13 0x7fcec979b151 in mozilla::dom::SelectionBatcher::~SelectionBatcher() src/objdir-ff-ubsan/dist/include/mozilla/dom/Selection.h:958:19
#14 0x7fcec9794240 in mozilla::dom::Selection::SetStartAndEndInternal(mozilla::dom::Selection::InLimiter, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, nsDirection, mozilla::ErrorResult&) src/dom/base/Selection.cpp:3490:1
#15 0x7fcec9793cb0 in mozilla::dom::Selection::SelectAllChildren(nsINode&, mozilla::ErrorResult&) src/dom/base/Selection.cpp:2675:3
#16 0x7fcece969f19 in nsDocumentViewer::SelectAll() src/layout/base/nsDocumentViewer.cpp:2454:14
#17 0x7fcec9914097 in nsClipboardSelectAllNoneCommands::DoClipboardCommand(char const*, nsIContentViewerEdit*, nsICommandParams*) src/dom/base/nsGlobalWindowCommands.cpp
#18 0x7fcec991373c in nsSelectionCommand::DoCommand(char const*, nsISupports*) src/dom/base/nsGlobalWindowCommands.cpp:654:10
#19 0x7fcecbd2ea99 in nsControllerCommandTable::DoCommand(char const*, nsISupports*) src/dom/commandhandler/nsControllerCommandTable.cpp:138:26
#20 0x7fcecbd2e82d in nsBaseCommandController::DoCommand(char const*) src/dom/commandhandler/nsBaseCommandController.cpp:114:24
#21 0x7fcecbd3203c in nsCommandManager::DoCommand(char const*, nsICommandParams*, mozIDOMWindowProxy*) src/dom/commandhandler/nsCommandManager.cpp:193:22
#22 0x7fcec955ddf5 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) src/dom/base/Document.cpp:5399:25
#23 0x7fcecafd7430 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) src/objdir-ff-ubsan/dom/bindings/DocumentBinding.cpp:3772:36
#24 0x7fcecb4f938e in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3306:13
#25 0x7fced33acd51 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:388:13
#26 0x7fced33acd51 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:475:12
#27 0x7fced33ae467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
#28 0x7fced339719b in js::CallFromStack(JSContext*, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:539:10
#29 0x7fced339719b in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3243:16
#30 0x7fced337a0c3 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:357:13
#31 0x7fced33ace56 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:507:13
#32 0x7fced33ae467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
#33 0x7fced33ae66d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:552:8
#34 0x7fced365f705 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/vm/CallAndConstruct.cpp:117:10
#35 0x7fcecb0bd0a8 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/objdir-ff-ubsan/dom/bindings/EventHandlerBinding.cpp:283:37
#36 0x7fcecbe8ac7d in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/objdir-ff-ubsan/dist/include/mozilla/dom/EventHandlerBinding.h:365:12
#37 0x7fcecbe73f2f in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:201:12
#38 0x7fcecbe423b5 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1309:22
#39 0x7fcecbe435ed in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1500:17
#40 0x7fcecbe8d4b3 in mozilla::EventListenerManager::HandleEvent(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.h:395:5
#41 0x7fcecbe806a7 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:348:17
#42 0x7fcecbe3257c in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:550:16
#43 0x7fcecbe35b7a in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1085:11
#44 0x7fcece961ab7 in nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1085:7
#45 0x7fced238666e in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:6309:20
#46 0x7fced2385993 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:5698:7
#47 0x7fced238792f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
#48 0x7fcec8230b6e in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1376:3
#49 0x7fcec822fa6b in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:974:14
#50 0x7fcec822c7fa in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) src/uriloader/base/nsDocLoader.cpp:793:9
#51 0x7fcec822e75e in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:676:5
#52 0x7fced23c0b5d in nsDocShell::OnStopRequest(nsIRequest*, nsresult) src/docshell/base/nsDocShell.cpp:13571:23
#53 0x7fcec5e1edd7 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) src/netwerk/base/nsLoadGroup.cpp:614:22
#54 0x7fcec5e21a54 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:518:10
#55 0x7fcec9018915 in imgRequestProxy::RemoveFromLoadGroup() src/image/imgRequestProxy.cpp:372:15
#56 0x7fcec9020f71 in imgRequestProxy::OnLoadComplete(bool) src/image/imgRequestProxy.cpp:1005:7
#57 0x7fcec8fdbb5e in void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)::operator()(mozilla::image::IProgressObserver*) const src/image/ProgressTracker.cpp:351:13
#58 0x7fcec8fdbb5e in void mozilla::image::ImageObserverNotifier<mozilla::image::ObserverTable const*>::operator()<void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)>(mozilla::image::ObserverTable const*) src/image/ProgressTracker.cpp:281:9
#59 0x7fcec8fd9af9 in void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:350:5
#60 0x7fcec8f7c842 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1::operator()(mozilla::image::ObserverTable const*) const src/image/ProgressTracker.cpp:369:5
#61 0x7fcec8f7c842 in decltype(fp(static_cast<mozilla::image::ObserverTable const*>(nullptr))) mozilla::image::CopyOnWrite<mozilla::image::ObserverTable>::Read<mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1>(mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1) const src/image/CopyOnWrite.h:155:12
#62 0x7fcec8f7c842 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:368:14
#63 0x7fcec8fb9146 in mozilla::image::VectorImage::OnSVGDocumentLoaded() src/image/VectorImage.cpp:1496:23
#64 0x7fcec8fbe090 in mozilla::image::SVGLoadEventListener::HandleEvent(mozilla::dom::Event*) src/image/VectorImage.cpp:214:13
#65 0x7fcecbe423b5 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1309:22
#66 0x7fcecbe435ed in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1500:17
#67 0x7fcecbe8d4b3 in mozilla::EventListenerManager::HandleEvent(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.h:395:5
#68 0x7fcecbe806a7 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:348:17
#69 0x7fcecbe3257c in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:550:16
#70 0x7fcecbe35b7a in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1085:11
#71 0x7fcecbe3a9b7 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) src/dom/events/EventDispatcher.cpp
#72 0x7fcec9955b3c in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:1355:17
#73 0x7fcecbe4f8e5 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) src/dom/events/EventTarget.cpp:180:13
#74 0x7fcecbdc4060 in mozilla::AsyncEventDispatcher::Run() src/dom/events/AsyncEventDispatcher.cpp:69:12
#75 0x7fcec5abe596 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:468:16
#76 0x7fcec5a7f669 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:771:26
#77 0x7fcec5a7cabe in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:607:15
#78 0x7fcec5a7d2e4 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:391:36
#79 0x7fcec5ab05c9 in mozilla::TaskController::InitializeInternal()::$_0::operator()() const src/xpcom/threads/TaskController.cpp:124:37
#80 0x7fcec5ab05c9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() src/xpcom/threads/nsThreadUtils.h:531:5
#81 0x7fcec5a9bd38 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1183:16
#82 0x7fcec5aa51d6 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:467:10
#83 0x7fcec7044ad2 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
#84 0x7fcec7046252 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:268:30
#85 0x7fcec6ea4235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
#86 0x7fcec6ea4235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
#87 0x7fcec6ea4235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
#88 0x7fcece2af59d in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#89 0x7fced3093cbb in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:864:20
#90 0x7fcec7046231 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
#91 0x7fcec6ea4235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
#92 0x7fcec6ea4235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
#93 0x7fcec6ea4235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
#94 0x7fced3092e63 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:701:34
#95 0x7fced30a7050 in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/Bootstrap.cpp:67:12
#96 0x55f38578507a in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#97 0x55f385785451 in main src/browser/app/nsBrowserApp.cpp:327:18
#98 0x7fceeeec0bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#99 0x55f3856d4138 in _start (src/objdir-ff-ubsan/dist/bin/firefox+0xe5138)
```
Bug 1746989 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Found while fuzzing m-c 20211217-ba22a155be2e (--enable-undefined-sanitizer --enable-fuzzing)
This was found by enabling the `float-cast-overflow` check in UBSan. This type of issue can create inconsistencies across platforms, architectures and optimization levels.
To enable this check add the following to your mozconfig:
```
ac_add_options --enable-undefined-sanitizer="float-cast-overflow"
```
To reproduce with the attached test case use the following commands:
```
$ pip install grizzly-framework
$ python -m grizzly.replay <ubsan-build>/firefox testcase.html --xvfb
```
```
src/objdir-ff-ubsan/dist/include/nsCoord.h:130:18: runtime error: -3.41666e+09 is outside the range of representable values of type 'int'
#0 0x7fcece987c31 in nsLayoutUtils::TransformRect(nsIFrame const*, nsIFrame const*, nsRect&) src/layout/base/nsLayoutUtils.cpp
#1 0x7fcece98813e in nsLayoutUtils::ClampRectToScrollFrames(nsIFrame*, nsRect const&) src/layout/base/nsLayoutUtils.cpp:2385:5
#2 0x7fcece84e327 in mozilla::AccessibleCaret::SetPosition(nsIFrame*, int) src/layout/base/AccessibleCaret.cpp:248:7
#3 0x7fcece855f24 in mozilla::AccessibleCaretManager::UpdateCaretsForSelectionMode(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&)::$_1::operator()(mozilla::AccessibleCaret*, nsIFrame*, int) const src/layout/base/AccessibleCaretManager.cpp:330:44
#4 0x7fcece855f24 in mozilla::AccessibleCaretManager::UpdateCaretsForSelectionMode(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&) src/layout/base/AccessibleCaretManager.cpp:349:7
#5 0x7fcece8550aa in mozilla::AccessibleCaretManager::UpdateCarets(mozilla::EnumSet<mozilla::AccessibleCaretManager::UpdateCaretsHint, unsigned char> const&) src/layout/base/AccessibleCaretManager.cpp:210:7
#6 0x7fcece854d98 in mozilla::AccessibleCaretManager::OnSelectionChanged(mozilla::dom::Document*, mozilla::dom::Selection*, short) src/layout/base/AccessibleCaretManager.cpp:171:3
#7 0x7fcece8e574d in mozilla::AccessibleCaretEventHub::NoActionState::OnSelectionChanged(mozilla::AccessibleCaretEventHub*, mozilla::dom::Document*, mozilla::dom::Selection*, short) src/layout/base/AccessibleCaretEventHub.cpp:87:25
#8 0x7fcece853634 in mozilla::AccessibleCaretEventHub::OnSelectionChange(mozilla::dom::Document*, mozilla::dom::Selection*, short) src/layout/base/AccessibleCaretEventHub.cpp:664:11
#9 0x7fcec978c953 in mozilla::dom::Selection::NotifySelectionListeners() src/dom/base/Selection.cpp:3169:10
#10 0x7fceceb229b7 in nsFrameSelection::NotifySelectionListeners(mozilla::SelectionType) src/layout/generic/nsFrameSelection.cpp:2170:16
#11 0x7fceceb24ff5 in nsFrameSelection::EndBatchChanges(short) src/layout/generic/nsFrameSelection.cpp:2161:5
#12 0x7fcec979919c in mozilla::dom::Selection::EndBatchChanges(short) src/dom/base/Selection.cpp:3197:21
#13 0x7fcec979b151 in mozilla::dom::SelectionBatcher::~SelectionBatcher() src/objdir-ff-ubsan/dist/include/mozilla/dom/Selection.h:958:19
#14 0x7fcec9794240 in mozilla::dom::Selection::SetStartAndEndInternal(mozilla::dom::Selection::InLimiter, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, mozilla::RangeBoundaryBase<nsINode*, nsIContent*> const&, nsDirection, mozilla::ErrorResult&) src/dom/base/Selection.cpp:3490:1
#15 0x7fcec9793cb0 in mozilla::dom::Selection::SelectAllChildren(nsINode&, mozilla::ErrorResult&) src/dom/base/Selection.cpp:2675:3
#16 0x7fcece969f19 in nsDocumentViewer::SelectAll() src/layout/base/nsDocumentViewer.cpp:2454:14
#17 0x7fcec9914097 in nsClipboardSelectAllNoneCommands::DoClipboardCommand(char const*, nsIContentViewerEdit*, nsICommandParams*) src/dom/base/nsGlobalWindowCommands.cpp
#18 0x7fcec991373c in nsSelectionCommand::DoCommand(char const*, nsISupports*) src/dom/base/nsGlobalWindowCommands.cpp:654:10
#19 0x7fcecbd2ea99 in nsControllerCommandTable::DoCommand(char const*, nsISupports*) src/dom/commandhandler/nsControllerCommandTable.cpp:138:26
#20 0x7fcecbd2e82d in nsBaseCommandController::DoCommand(char const*) src/dom/commandhandler/nsBaseCommandController.cpp:114:24
#21 0x7fcecbd3203c in nsCommandManager::DoCommand(char const*, nsICommandParams*, mozIDOMWindowProxy*) src/dom/commandhandler/nsCommandManager.cpp:193:22
#22 0x7fcec955ddf5 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) src/dom/base/Document.cpp:5399:25
#23 0x7fcecafd7430 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) src/objdir-ff-ubsan/dom/bindings/DocumentBinding.cpp:3772:36
#24 0x7fcecb4f938e in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3306:13
#25 0x7fced33acd51 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:388:13
#26 0x7fced33acd51 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:475:12
#27 0x7fced33ae467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
#28 0x7fced339719b in js::CallFromStack(JSContext*, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:539:10
#29 0x7fced339719b in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3243:16
#30 0x7fced337a0c3 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:357:13
#31 0x7fced33ace56 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:507:13
#32 0x7fced33ae467 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:535:10
#33 0x7fced33ae66d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:552:8
#34 0x7fced365f705 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/vm/CallAndConstruct.cpp:117:10
#35 0x7fcecb0bd0a8 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/objdir-ff-ubsan/dom/bindings/EventHandlerBinding.cpp:283:37
#36 0x7fcecbe8ac7d in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/objdir-ff-ubsan/dist/include/mozilla/dom/EventHandlerBinding.h:365:12
#37 0x7fcecbe73f2f in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:201:12
#38 0x7fcecbe423b5 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1309:22
#39 0x7fcecbe435ed in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1500:17
#40 0x7fcecbe8d4b3 in mozilla::EventListenerManager::HandleEvent(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.h:395:5
#41 0x7fcecbe806a7 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:348:17
#42 0x7fcecbe3257c in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:550:16
#43 0x7fcecbe35b7a in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1085:11
#44 0x7fcece961ab7 in nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1085:7
#45 0x7fced238666e in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:6309:20
#46 0x7fced2385993 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:5698:7
#47 0x7fced238792f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
#48 0x7fcec8230b6e in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1376:3
#49 0x7fcec822fa6b in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:974:14
#50 0x7fcec822c7fa in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) src/uriloader/base/nsDocLoader.cpp:793:9
#51 0x7fcec822e75e in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:676:5
#52 0x7fced23c0b5d in nsDocShell::OnStopRequest(nsIRequest*, nsresult) src/docshell/base/nsDocShell.cpp:13571:23
#53 0x7fcec5e1edd7 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) src/netwerk/base/nsLoadGroup.cpp:614:22
#54 0x7fcec5e21a54 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:518:10
#55 0x7fcec9018915 in imgRequestProxy::RemoveFromLoadGroup() src/image/imgRequestProxy.cpp:372:15
#56 0x7fcec9020f71 in imgRequestProxy::OnLoadComplete(bool) src/image/imgRequestProxy.cpp:1005:7
#57 0x7fcec8fdbb5e in void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)::operator()(mozilla::image::IProgressObserver*) const src/image/ProgressTracker.cpp:351:13
#58 0x7fcec8fdbb5e in void mozilla::image::ImageObserverNotifier<mozilla::image::ObserverTable const*>::operator()<void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)>(mozilla::image::ObserverTable const*) src/image/ProgressTracker.cpp:281:9
#59 0x7fcec8fd9af9 in void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:350:5
#60 0x7fcec8f7c842 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1::operator()(mozilla::image::ObserverTable const*) const src/image/ProgressTracker.cpp:369:5
#61 0x7fcec8f7c842 in decltype(fp(static_cast<mozilla::image::ObserverTable const*>(nullptr))) mozilla::image::CopyOnWrite<mozilla::image::ObserverTable>::Read<mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1>(mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::$_1) const src/image/CopyOnWrite.h:155:12
#62 0x7fcec8f7c842 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:368:14
#63 0x7fcec8fb9146 in mozilla::image::VectorImage::OnSVGDocumentLoaded() src/image/VectorImage.cpp:1496:23
#64 0x7fcec8fbe090 in mozilla::image::SVGLoadEventListener::HandleEvent(mozilla::dom::Event*) src/image/VectorImage.cpp:214:13
#65 0x7fcecbe423b5 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1309:22
#66 0x7fcecbe435ed in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1500:17
#67 0x7fcecbe8d4b3 in mozilla::EventListenerManager::HandleEvent(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.h:395:5
#68 0x7fcecbe806a7 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:348:17
#69 0x7fcecbe3257c in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:550:16
#70 0x7fcecbe35b7a in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1085:11
#71 0x7fcecbe3a9b7 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) src/dom/events/EventDispatcher.cpp
#72 0x7fcec9955b3c in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:1355:17
#73 0x7fcecbe4f8e5 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) src/dom/events/EventTarget.cpp:180:13
#74 0x7fcecbdc4060 in mozilla::AsyncEventDispatcher::Run() src/dom/events/AsyncEventDispatcher.cpp:69:12
#75 0x7fcec5abe596 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:468:16
#76 0x7fcec5a7f669 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:771:26
#77 0x7fcec5a7cabe in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:607:15
#78 0x7fcec5a7d2e4 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:391:36
#79 0x7fcec5ab05c9 in mozilla::TaskController::InitializeInternal()::$_0::operator()() const src/xpcom/threads/TaskController.cpp:124:37
#80 0x7fcec5ab05c9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() src/xpcom/threads/nsThreadUtils.h:531:5
#81 0x7fcec5a9bd38 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1183:16
#82 0x7fcec5aa51d6 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:467:10
#83 0x7fcec7044ad2 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
#84 0x7fcec7046252 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:268:30
#85 0x7fcec6ea4235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
#86 0x7fcec6ea4235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
#87 0x7fcec6ea4235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
#88 0x7fcece2af59d in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#89 0x7fced3093cbb in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:864:20
#90 0x7fcec7046231 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
#91 0x7fcec6ea4235 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
#92 0x7fcec6ea4235 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:324:3
#93 0x7fcec6ea4235 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
#94 0x7fced3092e63 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:701:34
#95 0x7fced30a7050 in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/Bootstrap.cpp:67:12
#96 0x55f38578507a in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#97 0x55f385785451 in main src/browser/app/nsBrowserApp.cpp:327:18
#98 0x7fceeeec0bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#99 0x55f3856d4138 in _start (src/objdir-ff-ubsan/dist/bin/firefox+0xe5138)
```