Open Bug 1423355 Opened 2 years ago Updated 17 days ago

Assertion failure: value >= minimum && value <= maximum (Unsanitized value), at layout/forms/nsRangeFrame.cpp:507

Categories

(Core :: Layout: Form Controls, defect, P3)

defect

Tracking

()

Tracking Status
firefox-esr60 --- affected
firefox65 --- affected
firefox66 --- affected
firefox67 --- affected
firefox74 --- affected
firefox75 --- affected
firefox76 --- affected

People

(Reporter: rforbes, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file testcase
testcase found by fuzzing on mozilla-central rev b4cef8d1dff0

=================================================================
==11926==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f6968fd1858 bp 0x7ffc30819210 sp 0x7ffc30818fe0 T0)
==11926==The signal is caused by a WRITE memory access.
==11926==Hint: address points to the zero page.
    #0 0x7f6968fd1857 in nsRangeFrame::GetValueAsFractionOfRange() /builds/worker/workspace/build/src/layout/forms/nsRangeFrame.cpp:493:3
    #1 0x7f6968fd1095 in nsRangeFrame::DoUpdateRangeProgressFrame(nsIFrame*, nsSize const&) /builds/worker/workspace/build/src/layout/forms/nsRangeFrame.cpp:711:21
    #2 0x7f6968fd2ebe in nsRangeFrame::UpdateForValueChange() /builds/worker/workspace/build/src/layout/forms/nsRangeFrame.cpp:619:5
    #3 0x7f6967196234 in mozilla::dom::HTMLInputElement::SetValueInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int) /builds/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:3054:20
    #4 0x7f696718897e in mozilla::dom::HTMLInputElement::SetValue(nsTSubstring<char16_t> const&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:1838:9
    #5 0x7f6967196bf8 in mozilla::dom::HTMLInputElement::SetValue(blink::Decimal, mozilla::dom::CallerType) /builds/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:1917:3
    #6 0x7f6967198acc in mozilla::dom::HTMLInputElement::SetValueAsNumber(double, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:2055:3
    #7 0x7f6966a40498 in mozilla::dom::HTMLInputElementBinding::set_valueAsNumber(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLInputElement*, JSJitSetterCallArgs) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/HTMLInputElementBinding.cpp:2754:9
    #8 0x7f6966c6a2ef in mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3003:8
    #9 0x7f696bd6846f in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:291:15
    #10 0x7f696bd67e09 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:473:16
    #11 0x7f696bd691bd in InternalCall(JSContext*, js::AnyInvokeArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12
    #12 0x7f696bd693c5 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:541:10
    #13 0x7f696bd6aa2d in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:670:12
    #14 0x7f696cb8584d in SetExistingProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyResult>, JS::ObjectOpResult&) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2731:10
    #15 0x7f696cb85001 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2759:20
    #16 0x7f696bd0d0b3 in js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/workspace/build/src/js/src/vm/NativeObject.h:1633:12
    #17 0x7f696bd9023a in SetPropertyOperation(JSContext*, JSOp, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::Handle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:270:12
    #18 0x7f696bd4e58f in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2893:10
    #19 0x7f696bd4923b in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:12
    #20 0x7f696bd6afb0 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:706:15
    #21 0x7f696bd6bac9 in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:738:12
    #22 0x7f696c694c8e in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4702:12
    #23 0x7f696c695570 in ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4721:12
    #24 0x7f696c695110 in JS_ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4742:12
    #25 0x7f696538a99c in nsJSUtils::ExecutionContext::CompileAndExec(JS::CompileOptions&, JS::SourceBufferHolder&, JS::MutableHandle<JSScript*>) /builds/worker/workspace/build/src/dom/base/nsJSUtils.cpp:266:8
    #26 0x7f69684c670a in mozilla::dom::ScriptLoader::EvaluateScript(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:2285:25
    #27 0x7f69684c326b in mozilla::dom::ScriptLoader::ProcessRequest(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1927:10
    #28 0x7f69684b0093 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1625:10
    #29 0x7f69684ae9bc in mozilla::dom::ScriptElement::MaybeProcessScript() /builds/worker/workspace/build/src/dom/script/ScriptElement.cpp:147:18
    #30 0x7f69644c123e in nsIScriptElement::AttemptToExecute() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIScriptElement.h:226:18
    #31 0x7f69644c0238 in nsHtml5TreeOpExecutor::RunScript(nsIContent*) /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:735:22
    #32 0x7f69644bc93e in nsHtml5TreeOpExecutor::RunFlushLoop() /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:539:7
    #33 0x7f69644c67e4 in nsHtml5ExecutorFlusher::Run() /builds/worker/workspace/build/src/parser/html/nsHtml5StreamParser.cpp:130:20
    #34 0x7f6962a07fb9 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #35 0x7f6962a3f1bc in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1033:14
    #36 0x7f6962a61938 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:508:10
    #37 0x7f69636648b3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21
    #38 0x7f69635aa7a8 in MessageLoop::RunInternal() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #39 0x7f69635aa62c in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299:3
    #40 0x7f6968619c8a in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:157:27
    #41 0x7f696bb0ef80 in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:865:22
    #42 0x7f6963665515 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:269:9
    #43 0x7f69635aa7a8 in MessageLoop::RunInternal() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #44 0x7f69635aa62c in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299:3
    #45 0x7f696bb0e6de in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:691:34
    #46 0x4ef336 in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
    #47 0x4ef5be in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:280:18
    #48 0x7f6981f2a82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
    #49 0x41f114 in _start (/home/rforbes/fuzzing/builds/mc-asan-debug/firefox+0x41f114)
Priority: -- → P1
Priority: P1 → P3
Looks similar to bug 893331, I'm also running into this while testing EME via shaka-player demo. Not my area of expertise, but I imagine a similar solution to bug 893331 could be suitable: find a minimal test case to add to the crash tests and relax the assert.
Duplicate of this bug: 1429498
You need to log in before you can comment on or make changes to this bug.