Open Bug 1422409 Opened 2 years ago Updated 1 year ago

AddressSanitizer: SEGV dom/base/nsDocument.cpp:7798 in nsIDocument::GetURL(nsTString<char16_t>&) const

Categories

(Core :: DOM: Core & HTML, defect, P3)

defect

Tracking

()

People

(Reporter: rforbes, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: testcase)

Attachments

(3 files)

testcase found by fuzzing on mozilla-central rev f5f03ee9e6ab

==40867==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000a0 (pc 0x7fc533d36750 bp 0x7ffcb632bc70 sp 0x7ffcb632bb60 T0)
==40867==The signal is caused by a READ memory access.
==40867==Hint: address points to the zero page.
    #0 0x7fc533d3674f in nsIDocument::GetURL(nsTString<char16_t>&) const /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:7798
    #1 0x7fc533a1d485 in nsGlobalWindowOuter::CloseOuter(bool) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:5984:23
    #2 0x7fc533a1de91 in Close /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:6032:3
    #3 0x7fc533a1de91 in non-virtual thunk to nsGlobalWindowOuter::Close() /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp
    #4 0x7fc53b9f2569 in MaybeCloseWindowHelper::Notify(nsITimer*) /builds/worker/workspace/build/src/docshell/base/nsDSURIContentListener.cpp:78:19
    #5 0x7fc530bdea1c in nsTimerImpl::Fire(int) /builds/worker/workspace/build/src/xpcom/threads/nsTimerImpl.cpp:704:40
    #6 0x7fc530bae079 in nsTimerEvent::Run() /builds/worker/workspace/build/src/xpcom/threads/TimerThread.cpp:286:11
    #7 0x7fc530bbdbee in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1033:14
    #8 0x7fc530bd9970 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:508:10
    #9 0x7fc53753febc in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/dom/ipc/ContentChild.cpp:1071:24)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:323:25
    #10 0x7fc53753febc in mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::TabChild*, mozIDOMWindowProxy*, bool, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/dom/ipc/ContentChild.cpp:1071
    #11 0x7fc5375ca8d5 in mozilla::dom::TabChild::ProvideWindow(mozIDOMWindowProxy*, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/dom/ipc/TabChild.cpp:1059:16
    #12 0x7fc53c46b2e6 in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsIDocShellLoadInfo*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:852:24
    #13 0x7fc53c47041c in OpenWindow2 /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:444:10
    #14 0x7fc53c47041c in non-virtual thunk to nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, nsIDocShellLoadInfo*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp
    #15 0x7fc533a19385 in nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsIDocShellLoadInfo*, bool, nsPIDOMWindowOuter**) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:7205:21
    #16 0x7fc533a181ad in OpenJS /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:5613:10
    #17 0x7fc533a181ad in nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:5588
    #18 0x7fc5339b8972 in nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowInner.cpp:3757:3
    #19 0x7fc5353105d4 in mozilla::dom::WindowBinding::open(JSContext*, JS::Handle<JSObject*>, nsGlobalWindowInner*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:2190:56
    #20 0x7fc53530e9d0 in mozilla::dom::WindowBinding::genericMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:15333:13
    #21 0x1587dc808165  (<unknown module>)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:7798 in nsIDocument::GetURL(nsTString<char16_t>&) const
Attached file testcase
Attached file 1015563-1.html
Attached file prefs.js
Nika, do you have ideas of what's up here?
Flags: needinfo?(nika)
Priority: -- → P3
Flags: needinfo?(nika)
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.