1342438 - Assertion failure: pos.isValid(), at /home/worker/workspace/build/src/netwerk/base/nsStandardURL.cpp:1224

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Testcase found by fuzzing debug build of mozilla-central 20170222-7abeac2f2d66.

Assertion failure: pos.isValid(), at /home/worker/workspace/build/src/netwerk/base/nsStandardURL.cpp:1224

ASAN:DEADLYSIGNAL
=================================================================
==24879==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f72984ee4e1 bp 0x7fffb8043d50 sp 0x7fffb8043ca0 T0)
    #0 0x7f72984ee4e0 in mozilla::net::nsStandardURL::ShiftFromRef(int) /home/worker/workspace/build/src/netwerk/base/nsStandardURL.cpp:1224:1
    #1 0x7f72984ff165 in mozilla::net::nsStandardURL::SetQuery(nsACString_internal const&) /home/worker/workspace/build/src/netwerk/base/nsStandardURL.cpp:2916:9
    #2 0x7f729a29d77d in mozilla::dom::Link::SetSearch(nsAString_internal const&) /home/worker/workspace/build/src/dom/base/Link.cpp:337:9
    #3 0x7f729bf5e66f in mozilla::dom::HTMLAnchorElement::SetSearch(nsAString_internal const&) /home/worker/workspace/build/src/dom/html/HTMLAnchorElement.cpp:323:1
    #4 0x7f729b799a36 in mozilla::dom::HTMLAnchorElementBinding::set_search(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLAnchorElement*, JSJitSetterCallArgs) /home/worker/workspace/build/src/obj-firefox/dom/bindings/HTMLAnchorElementBinding.cpp:1490:3
    #5 0x7f729ba7f6cb in mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2919:8
    #6 0x7f72a001821a in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /home/worker/workspace/build/src/js/src/jscntxtinlines.h:281:15
    #7 0x7f72a0017c20 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:463:16
    #8 0x7f72a0018bae in InternalCall(JSContext*, js::AnyInvokeArgs const&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:508:12
    #9 0x7f72a0018dd1 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:527:10
    #10 0x7f72a001a310 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:654:12
    #11 0x7f72a0ca4bd2 in SetExistingProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyResult>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2436:10
    #12 0x7f72a0ca4267 in js::NativeSetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::QualifiedBool, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2471:20
    #13 0x7f729ffa7f6f in js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/vm/NativeObject.h:1452:12
    #14 0x7f72a0038598 in SetPropertyOperation(JSContext*, JSOp, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::Handle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:259:12
    #15 0x7f72a000d098 in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2753:10

Comment 1

[Jason Kratzer [:jkratzer]]

Requires user_pref("dom.url.encode_decode_hash", false);

Comment 2

[Valentin Gosu [:valentin] (he/him)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=52ddf96b56de

Comment 3

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1342438 - Remove url .hash encoding/decoding prefs

These prefs have been added close to two years ago:
dom.url.encode_decode_hash and dom.url.getters_decode_hash
The main reason for their existence was in case we encounter any web-compat issues. At this point the extra code is mostly useless, and flipping the pref may lead to crashes.

Review commit: https://reviewboard.mozilla.org/r/118330/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/118330/

Comment 4

[Daniel Stenberg [:bagder]]

Comment on attachment 8845115 [details]
Bug 1342438 - Remove url .hash encoding/decoding prefs

https://reviewboard.mozilla.org/r/118330/#review120398

Good riddance!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5bd635e6e535
Remove url .hash encoding/decoding prefs r=bagder

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/5bd635e6e535