Testcase found while fuzzing mozilla-central rev 420e18a75314.
==25827==ERROR: AddressSanitizer: stack-overflow on address 0x7fff7f1ffff8 (pc 0x55786b6e45f1 bp 0x000000000053 sp 0x7fff7f200000 T0)
#0 0x55786b6e45f0 in __asan::GetCurrentThread() /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:404
#1 0x55786b68e0af in __tls_get_addr /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:5108:3
#2 0x7f9648f3b042 in _$LT$core..cell..Cell$LT$T$GT$$GT$::get::h3d7388ced6d8decf /rustc/91856ed52c58aa5ba66a015354d1cc69e9779bdf/src/libcore/cell.rs:249:16
#3 0x7f9648f3b042 in _$LT$std..thread..local..fast..Key$LT$T$GT$$GT$::get::h9a4f441257a47656 /rustc/91856ed52c58aa5ba66a015354d1cc69e9779bdf/src/libstd/thread/local.rs:375
#4 0x7f9648f3b042 in style::sharing::SHARING_CACHE_KEY::__getit::h39eb9af1526d9223 /builds/worker/workspace/build/src/<::std::thread::local::__thread_local_inner macros>:23
#5 0x7f9648f3b042 in _$LT$std..thread..local..LocalKey$LT$T$GT$$GT$::try_with::h245fabef33f11428 /rustc/91856ed52c58aa5ba66a015354d1cc69e9779bdf/src/libstd/thread/local.rs:297
#6 0x7f9648f3b042 in _$LT$std..thread..local..LocalKey$LT$T$GT$$GT$::with::he5f0be01b5c3942a /rustc/91856ed52c58aa5ba66a015354d1cc69e9779bdf/src/libstd/thread/local.rs:246
#7 0x7f9648f3b042 in _$LT$style..sharing..StyleSharingCache$LT$E$GT$$GT$::new::ha71dd31374b7d3d5 /builds/worker/workspace/build/src/servo/components/style/sharing/mod.rs:541
#8 0x7f9649001941 in _$LT$style..context..ThreadLocalStyleContext$LT$E$GT$$GT$::new::h8e0fc5583d2364df /builds/worker/workspace/build/src/servo/components/style/context.rs:783:27
#9 0x7f9649001941 in Servo_ResolveStyleLazily /builds/worker/workspace/build/src/servo/ports/geckolib/glue.rs:4914
#10 0x7f964282efd3 in mozilla::ServoStyleSet::ResolveStyleLazily(mozilla::dom::Element&, mozilla::PseudoStyleType, mozilla::StyleRuleInclusion) /builds/worker/workspace/build/src/layout/style/ServoStyleSet.cpp:1094:10
#11 0x7f964286b5d3 in nsComputedDOMStyle::DoGetComputedStyleNoFlush(mozilla::dom::Element*, nsAtom*, mozilla::PresShell*, nsComputedDOMStyle::StyleType) /builds/worker/workspace/build/src/layout/style/nsComputedDOMStyle.cpp:573:17
#12 0x7f96424454b6 in GetComputedStyleNoFlush /builds/worker/workspace/build/src/layout/style/nsComputedDOMStyle.h:95:12
#13 0x7f96424454b6 in mozilla::EditorBase::IsPreformatted(nsINode*) /builds/worker/workspace/build/src/editor/libeditor/EditorBase.cpp:3718
#14 0x7f96426eeafe in mozilla::WSRunObject::GetRuns() /builds/worker/workspace/build/src/editor/libeditor/WSRunObject.cpp:880:10
#15 0x7f96424a441c in mozilla::WSRunObject::WSRunObject(mozilla::HTMLEditor*, nsINode*, int) /builds/worker/workspace/build/src/editor/libeditor/WSRunObject.h:173:9
#16 0x7f964251b664 in mozilla::HTMLEditRules::CheckForInvisibleBR(mozilla::dom::Element&, mozilla::HTMLEditRules::BRLocation, int) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:6477:15
#17 0x7f96425109c3 in mozilla::HTMLEditRules::TryToJoinBlocksWithTransaction(nsIContent&, nsIContent&) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:3339:9
#18 0x7f96424bda93 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2748:32
#19 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#20 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#21 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#22 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#23 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#24 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#25 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#26 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#27 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#28 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#29 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#30 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#31 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#32 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#33 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#34 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#35 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#36 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#37 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#38 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#39 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#40 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#41 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#42 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#43 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#44 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#45 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#46 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#47 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#48 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#49 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#50 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
...truncated...
Bug 1547897 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Testcase found while fuzzing mozilla-central rev 420e18a75314.
```
==25827==ERROR: AddressSanitizer: stack-overflow on address 0x7fff7f1ffff8 (pc 0x55786b6e45f1 bp 0x000000000053 sp 0x7fff7f200000 T0)
#0 0x55786b6e45f0 in __asan::GetCurrentThread() /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_thread.cc:404
#1 0x55786b68e0af in __tls_get_addr /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:5108:3
#2 0x7f9648f3b042 in _$LT$core..cell..Cell$LT$T$GT$$GT$::get::h3d7388ced6d8decf /rustc/91856ed52c58aa5ba66a015354d1cc69e9779bdf/src/libcore/cell.rs:249:16
#3 0x7f9648f3b042 in _$LT$std..thread..local..fast..Key$LT$T$GT$$GT$::get::h9a4f441257a47656 /rustc/91856ed52c58aa5ba66a015354d1cc69e9779bdf/src/libstd/thread/local.rs:375
#4 0x7f9648f3b042 in style::sharing::SHARING_CACHE_KEY::__getit::h39eb9af1526d9223 /builds/worker/workspace/build/src/<::std::thread::local::__thread_local_inner macros>:23
#5 0x7f9648f3b042 in _$LT$std..thread..local..LocalKey$LT$T$GT$$GT$::try_with::h245fabef33f11428 /rustc/91856ed52c58aa5ba66a015354d1cc69e9779bdf/src/libstd/thread/local.rs:297
#6 0x7f9648f3b042 in _$LT$std..thread..local..LocalKey$LT$T$GT$$GT$::with::he5f0be01b5c3942a /rustc/91856ed52c58aa5ba66a015354d1cc69e9779bdf/src/libstd/thread/local.rs:246
#7 0x7f9648f3b042 in _$LT$style..sharing..StyleSharingCache$LT$E$GT$$GT$::new::ha71dd31374b7d3d5 /builds/worker/workspace/build/src/servo/components/style/sharing/mod.rs:541
#8 0x7f9649001941 in _$LT$style..context..ThreadLocalStyleContext$LT$E$GT$$GT$::new::h8e0fc5583d2364df /builds/worker/workspace/build/src/servo/components/style/context.rs:783:27
#9 0x7f9649001941 in Servo_ResolveStyleLazily /builds/worker/workspace/build/src/servo/ports/geckolib/glue.rs:4914
#10 0x7f964282efd3 in mozilla::ServoStyleSet::ResolveStyleLazily(mozilla::dom::Element&, mozilla::PseudoStyleType, mozilla::StyleRuleInclusion) /builds/worker/workspace/build/src/layout/style/ServoStyleSet.cpp:1094:10
#11 0x7f964286b5d3 in nsComputedDOMStyle::DoGetComputedStyleNoFlush(mozilla::dom::Element*, nsAtom*, mozilla::PresShell*, nsComputedDOMStyle::StyleType) /builds/worker/workspace/build/src/layout/style/nsComputedDOMStyle.cpp:573:17
#12 0x7f96424454b6 in GetComputedStyleNoFlush /builds/worker/workspace/build/src/layout/style/nsComputedDOMStyle.h:95:12
#13 0x7f96424454b6 in mozilla::EditorBase::IsPreformatted(nsINode*) /builds/worker/workspace/build/src/editor/libeditor/EditorBase.cpp:3718
#14 0x7f96426eeafe in mozilla::WSRunObject::GetRuns() /builds/worker/workspace/build/src/editor/libeditor/WSRunObject.cpp:880:10
#15 0x7f96424a441c in mozilla::WSRunObject::WSRunObject(mozilla::HTMLEditor*, nsINode*, int) /builds/worker/workspace/build/src/editor/libeditor/WSRunObject.h:173:9
#16 0x7f964251b664 in mozilla::HTMLEditRules::CheckForInvisibleBR(mozilla::dom::Element&, mozilla::HTMLEditRules::BRLocation, int) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:6477:15
#17 0x7f96425109c3 in mozilla::HTMLEditRules::TryToJoinBlocksWithTransaction(nsIContent&, nsIContent&) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:3339:9
#18 0x7f96424bda93 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2748:32
#19 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#20 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#21 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#22 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#23 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#24 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#25 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#26 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#27 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#28 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#29 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#30 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#31 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#32 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#33 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#34 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#35 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#36 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#37 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#38 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#39 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#40 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#41 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#42 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#43 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#44 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#45 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#46 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#47 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#48 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#49 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
#50 0x7f96424c48a0 in mozilla::HTMLEditRules::WillDeleteSelection(short, short, bool*, bool*) /builds/worker/workspace/build/src/editor/libeditor/HTMLEditRules.cpp:2771:14
...truncated...
```