1361065 - Assertion failure: !mDoneCreating || mType != NS_FORM_INPUT_RANGE || !GetValidityState(VALIDITY_STATE_RANGE_UNDERFLOW) (HTML5 spec does not allow underflow for type=range) @ [/home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:1513]

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 20170430-5278e2a35fc8.

Assertion failure: !mDoneCreating || mType != NS_FORM_INPUT_RANGE || !GetValidityState(VALIDITY_STATE_RANGE_UNDERFLOW) (HTML5 spec does not allow underflow for type=range), at /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:1513

ASAN:DEADLYSIGNAL
=================================================================
==28580==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f2e95a3ca10 bp 0x7ffe646184b0 sp 0x7ffe64618000 T0)
==28580==The signal is caused by a WRITE memory access.
==28580==Hint: address points to the zero page.
    #0 0x7f2e95a3ca0f in mozilla::dom::HTMLInputElement::AfterSetAttr(int, nsIAtom*, nsAttrValue const*, bool) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:1493:7
    #1 0x7f2e93cb084e in mozilla::dom::Element::SetAttrAndNotify(int, nsIAtom*, nsIAtom*, nsAttrValue const&, nsAttrValue&, unsigned char, bool, bool, bool, nsIDocument*, mozAutoDocUpdate const&) /home/worker/workspace/build/src/dom/base/Element.cpp:2498:10
    #2 0x7f2e93caff56 in mozilla::dom::Element::SetAttr(int, nsIAtom*, nsIAtom*, nsAString const&, bool) /home/worker/workspace/build/src/dom/base/Element.cpp:2375:10
    #3 0x7f2e95b383f9 in nsGenericHTMLElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString const&, bool) /home/worker/workspace/build/src/dom/html/nsGenericHTMLElement.cpp:829:34
    #4 0x7f2e93ca2d71 in mozilla::dom::Element::SetAttr(nsIAtom*, nsAString const&, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Element.h:1265:14
    #5 0x7f2e95344bed in mozilla::dom::HTMLInputElementBinding::set_min(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLInputElement*, JSJitSetterCallArgs) /home/worker/workspace/build/src/obj-firefox/dom/bindings/HTMLInputElementBinding.cpp:1528:9
    #6 0x7f2e95538e7c in mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2922:8
    #7 0x7f2e99b62681 in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /home/worker/workspace/build/src/js/src/jscntxtinlines.h:291:15
    #8 0x7f2e99b6222d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:470:16
    #9 0x7f2e99b630d5 in InternalCall(JSContext*, js::AnyInvokeArgs const&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:515:12
    #10 0x7f2e99b632ec in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:534:10
    #11 0x7f2e99b647e3 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:663:12
    #12 0x7f2e9a848879 in SetExistingProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyResult>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2432:10
    #13 0x7f2e9a847eaf in js::NativeSetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::QualifiedBool, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2467:20
    #14 0x7f2e99aecfd9 in js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/vm/NativeObject.h:1459:12
    #15 0x7f2e99b826dc in SetPropertyOperation(JSContext*, JSOp, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::Handle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:244:12

Comment 1

[Bob Clary [:bc] (inactive)]

Bughunter found this reproducible fatal assertion on http://www.ceskatelevize.cz/ct24#live on Windows and Linux on Beta/57 and Nightly/58.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Jason, did you mean to attach a testcase? Unfortunately, I can't reproduce on the site from comment 1.

Comment 3

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Attached testcase.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Reproduces as far back as a year, which is the furthest back mozregression can go. Still reproduces on trunk with or without Stylo enabled.

Comment 5

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Move_fix-optionals

Comment 6

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/UQCvnGgxINFWsFDWYIahVA/index.html