Assertion failure: ((bool)(__builtin_expect(!!(!NS_FAILED_impl(rv)), 1))), at /home/worker/workspace/build/src/editor/libeditor/EditorBase.cpp:4204

RESOLVED FIXED in Firefox 57

Status

()

defect
P3
normal
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: jkratzer, Assigned: ayg)

Tracking

(Blocks 1 bug, {assertion, testcase})

unspecified
mozilla57
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox56 wontfix, firefox57 fixed)

Details

Attachments

(1 attachment)

(Reporter)

Description

2 years ago
Posted file trigger.html
Testcase found while fuzzing mc-debug rev 20170807-47248637eafa.

Assertion failure: ((bool)(__builtin_expect(!!(!NS_FAILED_impl(rv)), 1))), at /home/worker/workspace/build/src/editor/libeditor/EditorBase.cpp:4204
#01: mozilla::HTMLEditor::InsertElementAtSelection at editor/libeditor/HTMLEditor.cpp:1570
#02: nsInsertTagCommand::DoCommandParams at editor/composer/nsComposerCommands.cpp:1437
#03: nsControllerCommandTable::DoCommandParams at dom/commandhandler/nsControllerCommandTable.cpp:162
#04: nsBaseCommandController::DoCommandWithParams at xpcom/base/nsCOMPtr.h:801
#05: nsCommandManager::DoCommand at dom/commandhandler/nsCommandManager.cpp:210
#06: nsHTMLDocument::ExecCommand at dom/bindings/ErrorResult.h:376
#07: mozilla::dom::HTMLDocumentBinding::execCommand at obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:877
#08: mozilla::dom::GenericBindingMethod at dom/bindings/BindingUtils.cpp:3055
#09: js::CallJSNative at js/src/jscntxtinlines.h:293
#10: js::InternalCallOrConstruct at js/src/vm/Interpreter.cpp:469
Flags: in-testsuite?
assertion issue, not crash
Priority: -- → P3
Regression range:
INFO: Last good revision: 636a1e09a0e4f3fac9ce4b893deeab4da5af9367
INFO: First bad revision: ddfcb1823adcf22da5d4ac3b600eda2a0d6aa0a5
INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=636a1e09a0e4f3fac9ce4b893deeab4da5af9367&tochange=ddfcb1823adcf22da5d4ac3b600eda2a0d6aa0a5

Fixed range:
INFO: First good revision: 0bda6393453ef6ca289a37aa723f87f91160c66f
INFO: Last bad revision: fb2e833fe98deb0f1aeaf3d3b0b8ade309eb5c8e
INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=fb2e833fe98deb0f1aeaf3d3b0b8ade309eb5c8e&tochange=0bda6393453ef6ca289a37aa723f87f91160c66f

NI myself to land the crashtest.
Assignee: nobody → ayg
Blocks: 1321623
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Depends on: 1359397
Flags: needinfo?(ryanvm)
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
Flags: needinfo?(ryanvm)
Flags: in-testsuite?
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.