Open Bug 1427811 Opened 2 years ago Updated 2 years ago

Assertion failure: mRawPtr != nullptr (You can't dereference a NULL nsCOMPtr with operator->().), at /builds/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:801

Categories

(Core :: Disability Access APIs, defect, P3)

59 Branch
defect

Tracking

()

Tracking Status
firefox59 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Testcase found while fuzzing mozilla-central rev ac93fdadf102.  On Linux, the testcase requires the GNOME_ACCESSIBILITY=1 env variable in order to reproduce the issue.  Further, the fuzzPriv extension is also required in order to reproduce the issue.

The fuzzPriv extension can be found at the following URL:
https://github.com/MozillaSecurity/fuzzpriv

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007f68a217b2ad   rbx = 0x0000000000000001
rsi = 0x00007f68a244a770   rdi = 0x00007f68a2449540
rbp = 0x00007fff0af9c690   rsp = 0x00007fff0af9c690
r8 = 0x00007f68a244a770    r9 = 0x00007f68a3730740
r10 = 0x0000000000000039   r11 = 0x0000000000000000
r12 = 0x00007fff0af9c6e0   r13 = 0x00007f68763610c0
r14 = 0x00007f687ea0fa10   r15 = 0x00007f687fefb160
rip = 0x00007f68915bcae6
OS|Linux|0.0.0 Linux 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsCOMPtr<nsINode>::operator->|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCOMPtr.h:ac93fdadf102|800|0x5
0|1|libxul.so|mozilla::a11y::RootAccessible::ProcessDOMEvent|hg:hg.mozilla.org/mozilla-central:accessible/generic/RootAccessible.cpp:ac93fdadf102|285|0xc
0|2|libxul.so|mozilla::a11y::NotificationController::WillRefresh|hg:hg.mozilla.org/mozilla-central:accessible/base/NotificationController.cpp:ac93fdadf102|838|0x5
0|3|libxul.so|nsRefreshDriver::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:ac93fdadf102|1862|0xd
0|4|libxul.so|mozilla::RefreshDriverTimer::TickRefreshDrivers|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:ac93fdadf102|306|0xf
0|5|libxul.so|mozilla::RefreshDriverTimer::Tick|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:ac93fdadf102|328|0x12
0|6|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:ac93fdadf102|769|0x5
0|7|libxul.so|mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync|hg:hg.mozilla.org/mozilla-central:layout/base/nsRefreshDriver.cpp:ac93fdadf102|583|0xc
0|8|libxul.so|mozilla::layout::VsyncChild::RecvNotify|hg:hg.mozilla.org/mozilla-central:layout/ipc/VsyncChild.cpp:ac93fdadf102|68|0x9
0|9|libxul.so|mozilla::layout::PVsyncChild::OnMessageReceived|s3:gecko-generated-sources:06086093ccb59dd5a99cf8c9f9fb7f4860fd8ddbfd516af5e5b3508be62029679421dcf2abdf6b1c945b6a054050bd403c9574aad49f857cb4a31d3f4cf56b9a/ipc/ipdl/PVsyncChild.cpp:|155|0xf
0|10|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:ac93fdadf102|2110|0x6
0|11|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:ac93fdadf102|2040|0xb
0|12|libxul.so|mozilla::ipc::MessageChannel::RunMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:ac93fdadf102|1886|0xb
0|13|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:ac93fdadf102|1919|0xc
0|14|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:ac93fdadf102|1039|0x15
0|15|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:ac93fdadf102|510|0x11
0|16|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:ac93fdadf102|97|0xa
0|17|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ac93fdadf102|326|0x17
0|18|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ac93fdadf102|319|0x8
0|19|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:ac93fdadf102|157|0xd
0|20|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:ac93fdadf102|875|0x11
0|21|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:ac93fdadf102|269|0x5
0|22|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ac93fdadf102|326|0x17
0|23|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ac93fdadf102|319|0x8
0|24|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:ac93fdadf102|701|0x8
0|25|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:ac93fdadf102|63|0x14
0|26|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:ac93fdadf102|280|0x11
0|27|libc-2.23.so||||0x20830
0|28|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:ac93fdadf102|165|0x5
Flags: in-testsuite?
Jason, you forgot to attach a test case eventually?
Flags: needinfo?(jkratzer)
Priority: -- → P3
Attached file trigger.html
Apologies for the delay.  Testcase attached.
Flags: needinfo?(jkratzer)
You need to log in before you can comment on or make changes to this bug.