1427820 - Assertion failure: ((bool)(__builtin_expect(!!(!NS_FAILED_impl(rv)), 1))), at /builds/worker/workspace/build/src/caps/NullPrincipal.cpp:64

Status: RESOLVED DUPLICATE of bug 1425866

(Core :: CSS Parsing and Computation, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev ac93fdadf10.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007f480c4c92ad   rbx = 0x00007f47ea1fe190
rsi = 0x00007f480c798770   rdi = 0x00007f480c797540
rbp = 0x00007ffcc7a4f050   rsp = 0x00007ffcc7a4f020
r8 = 0x00007f480c798770    r9 = 0x00007f480da7e740
r10 = 0x0000000000000039   r11 = 0x0000000000000000
r12 = 0x00007ffcc7a4f070   r13 = 0x00007ffcc7a4f078
r14 = 0x0000000000000000   r15 = 0x0000000000000000
rip = 0x00007f47fba2dcc5
OS|Linux|0.0.0 Linux 4.4.0-104-generic #127-Ubuntu SMP Mon Dec 11 12:16:42 UTC 2017 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|NullPrincipal::Create|hg:hg.mozilla.org/mozilla-central:caps/NullPrincipal.cpp:ac93fdadf102|64|0x1c
0|1|libxul.so|mozilla::StyleSheetInfo::StyleSheetInfo|hg:hg.mozilla.org/mozilla-central:layout/style/StyleSheet.cpp:ac93fdadf102|236|0xd
0|2|libxul.so|mozilla::ServoStyleSheetInner::ServoStyleSheetInner|hg:hg.mozilla.org/mozilla-central:layout/style/ServoStyleSheet.cpp:ac93fdadf102|38|0x5
0|3|libxul.so|mozilla::ServoStyleSheet::ServoStyleSheet|hg:hg.mozilla.org/mozilla-central:layout/style/ServoStyleSheet.cpp:ac93fdadf102|138|0x12
0|4|libxul.so|mozilla::css::Loader::CreateSheet|hg:hg.mozilla.org/mozilla-central:layout/style/Loader.cpp:ac93fdadf102|1120|0x5
0|5|libxul.so|mozilla::css::Loader::LoadInlineStyle|hg:hg.mozilla.org/mozilla-central:layout/style/Loader.cpp:ac93fdadf102|1933|0x31
0|6|libxul.so|nsStyleLinkElement::DoUpdateStyleSheet|hg:hg.mozilla.org/mozilla-central:dom/base/nsStyleLinkElement.cpp:ac93fdadf102|551|0x55
0|7|libxul.so|nsStyleLinkElement::UpdateStyleSheetInternal|hg:hg.mozilla.org/mozilla-central:dom/base/nsStyleLinkElement.cpp:ac93fdadf102|345|0x10
0|8|libxul.so|mozilla::dom::SVGStyleElement::UnbindFromTree|hg:hg.mozilla.org/mozilla-central:dom/svg/SVGStyleElement.cpp:ac93fdadf102|89|0x15
0|9|libxul.so|mozilla::dom::Element::UnbindFromTree|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:ac93fdadf102|2087|0x18
0|10|libxul.so|nsGenericHTMLElement::UnbindFromTree|hg:hg.mozilla.org/mozilla-central:dom/html/nsGenericHTMLElement.cpp:ac93fdadf102|538|0x10
0|11|libxul.so|mozilla::dom::HTMLSharedElement::UnbindFromTree|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLSharedElement.cpp:ac93fdadf102|260|0xc
0|12|libxul.so|mozilla::dom::Element::UnbindFromTree|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:ac93fdadf102|2097|0x14
0|13|libxul.so|nsXMLElement::UnbindFromTree|hg:hg.mozilla.org/mozilla-central:dom/xml/nsXMLElement.cpp:ac93fdadf102|52|0x10
0|14|libxul.so|mozilla::dom::Element::UnbindFromTree|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:ac93fdadf102|2087|0x18
0|15|libxul.so|nsGenericHTMLElement::UnbindFromTree|hg:hg.mozilla.org/mozilla-central:dom/html/nsGenericHTMLElement.cpp:ac93fdadf102|538|0x10
0|16|libxul.so|mozilla::dom::HTMLSharedElement::UnbindFromTree|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLSharedElement.cpp:ac93fdadf102|260|0xc
0|17|libxul.so|nsDocument::cycleCollection::Unlink|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:ac93fdadf102|2065|0x21
0|18|libxul.so|nsHTMLDocument::cycleCollection::Unlink|hg:hg.mozilla.org/mozilla-central:dom/html/nsHTMLDocument.cpp:ac93fdadf102|198|0x8
0|19|libxul.so|nsCycleCollector::CollectWhite|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:ac93fdadf102|3396|0x10
0|20|libxul.so|nsCycleCollector::Collect|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:ac93fdadf102|3764|0x8
0|21|libxul.so|nsCycleCollector::ShutdownCollect|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:ac93fdadf102|3682|0x15
0|22|libxul.so|nsCycleCollector_shutdown|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:ac93fdadf102|4368|0x14
0|23|libxul.so|mozilla::ShutdownXPCOM|hg:hg.mozilla.org/mozilla-central:xpcom/build/XPCOMInit.cpp:ac93fdadf102|969|0xa
0|24|libxul.so|XRE_TermEmbedding|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:ac93fdadf102|228|0x7
0|25|libxul.so|mozilla::ipc::ScopedXREEmbed::Stop|hg:hg.mozilla.org/mozilla-central:ipc/glue/ScopedXREEmbed.cpp:ac93fdadf102|108|0x5
0|26|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:ac93fdadf102|705|0x11
0|27|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:ac93fdadf102|63|0x14
0|28|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:ac93fdadf102|280|0x11
0|29|libc-2.23.so||||0x20830
0|30|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:ac93fdadf102|165|0x5

Comment 1

[Jason Kratzer [:jkratzer]]

Crashes on ASAN builds.

Comment 2

[Jet Villegas (inactive)]

[ Triage 2017/02/20: P2 ] P2 bugs may become P1's after further analysis. Please prioritize diagnosis and repair.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: trigger.html