1402486 - InvalidArrayIndex_CRASH in [@ mozilla::dom::SVGTextContentElement::GetEndPositionOfChar]

Status: RESOLVED DUPLICATE of bug 1402109

(Core :: SVG, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: test_case.html

==21334==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000550926 bp 0x7fffc24c3c70 sp 0x7fffc24c3b00 T0)
==21334==The signal is caused by a WRITE memory access.
==21334==Hint: address points to the zero page.
    #0 0x550925 in MOZ_CrashPrintf  /src/mfbt/Assertions.cpp:63:3
    #1 0x7f964c11f44f in InvalidArrayIndex_CRASH(unsigned long, unsigned long)  /src/xpcom/ds/nsTArray.cpp:26:3
    #2 0x7f965340fa37 in ElementAt  /src/obj-firefox/dist/include/nsTArray.h:1048:7
    #3 0x7f965340fa37 in operator[]  /src/obj-firefox/dist/include/nsTArray.h:1086
    #4 0x7f965340fa37 in SVGTextFrame::GetEndPositionOfChar(nsIContent*, unsigned int, mozilla::nsISVGPoint**)  /src/layout/svg/SVGTextFrame.cpp:4355
    #5 0x7f9651b82ffe in mozilla::dom::SVGTextContentElement::GetEndPositionOfChar(unsigned int, mozilla::ErrorResult&)  /src/dom/svg/SVGTextContentElement.cpp:181:19
    #6 0x7f964fa517d5 in mozilla::dom::SVGTextContentElementBinding::getEndPositionOfChar(JSContext*, JS::Handle<JSObject*>, mozilla::dom::SVGTextContentElement*, JSJitMethodCallArgs const&)  /src/obj-firefox/dom/bindings/SVGTextContentElementBinding.cpp:235:58
    #7 0x7f9650874160 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*)  /src/dom/bindings/BindingUtils.cpp:3055:13
    #8 0x7f9656ee83c4 in CallJSNative  /src/js/src/jscntxtinlines.h:293:15
    #9 0x7f9656ee83c4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)  /src/js/src/vm/Interpreter.cpp:495
    #10 0x7f9656ed2226 in CallFromStack  /src/js/src/vm/Interpreter.cpp:546:12
    #11 0x7f9656ed2226 in Interpret(JSContext*, js::RunState&)  /src/js/src/vm/Interpreter.cpp:3084
    #12 0x7f9656eb95eb in js::RunScript(JSContext*, js::RunState&)  /src/js/src/vm/Interpreter.cpp:435:12
    #13 0x7f9656ee855c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)  /src/js/src/vm/Interpreter.cpp:513:15
    #14 0x7f9656ee8eb2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)  /src/js/src/vm/Interpreter.cpp:559:10
    #15 0x7f965793ed9b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)  /src/js/src/jsapi.cpp:2965:12
    #16 0x7f96502a9135 in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)  /src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:260:37
    #17 0x7f9650c7fb85 in Call<nsISupports *>  /src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:362:12
    #18 0x7f9650c7fb85 in mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*)  /src/dom/events/JSEventHandler.cpp:215
    #19 0x7f9650c49159 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*)  /src/dom/events/EventListenerManager.cpp:1112:51
    #20 0x7f9650c4b220 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*)  /src/dom/events/EventListenerManager.cpp:1283:20
    #21 0x7f9650c2b011 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)  /src/dom/events/EventDispatcher.cpp:462:16
    #22 0x7f9650c2e4e2 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)  /src/dom/events/EventDispatcher.cpp:822:9
    #23 0x7f9652f0c11e in nsDocumentViewer::LoadComplete(nsresult)  /src/layout/base/nsDocumentViewer.cpp:1081:7
    #24 0x7f9655eb7e31 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)  /src/docshell/base/nsDocShell.cpp:7749:21
    #25 0x7f9655eb3e54 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)  /src/docshell/base/nsDocShell.cpp:7547:7
    #26 0x7f9655ebb7ff in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)  /src/docshell/base/nsDocShell.cpp:7444:13
    #27 0x7f964dbac820 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)  /src/uriloader/base/nsDocLoader.cpp:1320:3
    #28 0x7f964dbab8dc in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)  /src/uriloader/base/nsDocLoader.cpp:861:14
    #29 0x7f964dba8896 in nsDocLoader::DocLoaderIsEmpty(bool)  /src/uriloader/base/nsDocLoader.cpp:750:9
    #30 0x7f964dbaa6d5 in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult)  /src/uriloader/base/nsDocLoader.cpp:632:5
    #31 0x7f964dbab33c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult)  /src/uriloader/base/nsDocLoader.cpp:488:14
    #32 0x7f964c3adf4d in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)  /src/netwerk/base/nsLoadGroup.cpp:629:28
    #33 0x7f964ed7bb6d in nsDocument::DoUnblockOnload()  /src/dom/base/nsDocument.cpp:9202:18
    #34 0x7f964ed7b731 in nsDocument::UnblockOnload(bool)  /src/dom/base/nsDocument.cpp:9124:9
    #35 0x7f964ed54a49 in nsDocument::DispatchContentLoadedEvents()  /src/dom/base/nsDocument.cpp:5599:3
    #36 0x7f964edf5772 in applyImpl<nsDocument, void (nsDocument::*)()>  /src/obj-firefox/dist/include/nsThreadUtils.h:1142:12
    #37 0x7f964edf5772 in apply<nsDocument, void (nsDocument::*)()>  /src/obj-firefox/dist/include/nsThreadUtils.h:1148
    #38 0x7f964edf5772 in mozilla::detail::RunnableMethodImpl<nsDocument*, void (nsDocument::*)(), true, (mozilla::RunnableKind)0>::Run()  /src/obj-firefox/dist/include/nsThreadUtils.h:1192
    #39 0x7f964c20033c in nsThread::ProcessNextEvent(bool, bool*)  /src/xpcom/threads/nsThread.cpp:1039:14
    #40 0x7f964c20615c in NS_ProcessNextEvent(nsIThread*, bool)  /src/xpcom/threads/nsThreadUtils.cpp:521:10
    #41 0x7f964cfab061 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)  /src/ipc/glue/MessagePump.cpp:97:21
    #42 0x7f964cf0cf2b in RunInternal  /src/ipc/chromium/src/base/message_loop.cc:326:10
    #43 0x7f964cf0cf2b in RunHandler  /src/ipc/chromium/src/base/message_loop.cc:319
    #44 0x7f964cf0cf2b in MessageLoop::Run()  /src/ipc/chromium/src/base/message_loop.cc:299
    #45 0x7f96526bd4df in nsBaseAppShell::Run()  /src/widget/nsBaseAppShell.cpp:158:27
    #46 0x7f965681d3c1 in nsAppStartup::Run()  /src/toolkit/components/startup/nsAppStartup.cpp:288:30
    #47 0x7f96569fdf0b in XREMain::XRE_mainRun()  /src/toolkit/xre/nsAppRunner.cpp:4701:22
    #48 0x7f96569ffb08 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)  /src/toolkit/xre/nsAppRunner.cpp:4865:8
    #49 0x7f9656a00f3b in XRE_main(int, char**, mozilla::BootstrapConfig const&)  /src/toolkit/xre/nsAppRunner.cpp:4960:21
    #50 0x4ebea3 in do_main  /src/browser/app/nsBrowserApp.cpp:236:22
    #51 0x4ebea3 in main  /src/browser/app/nsBrowserApp.cpp:309
    #52 0x7f9669b7882f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
    #53 0x41d9f8 in _start (firefox+0x41d9f8)

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Opt builds started crashing after bug 1342951 landed.
INFO: Last good revision: a86e0e1c7c6318e9664af75c05bcb3ea79687cf4
INFO: First bad revision: 309140f65fc5820fa8ccab5f238d8d5c48283f82
INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a86e0e1c7c6318e9664af75c05bcb3ea79687cf4&tochange=309140f65fc5820fa8ccab5f238d8d5c48283f82

Also present in debug builds:
Assertion failure: false (should have already reflowed the kid), at /builds/worker/workspace/build/src/layout/svg/SVGTextFrame.cpp:5171

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Bug 1403583 is going to fix this on 57 by backing out the regressing patch.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Verified fixed for Fx57 by bug 1403583.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2cb08034cac4
Add crashtest. r=me

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/2cb08034cac4