1443977 - Assertion failure: aPoint.IsSetAndValid(), at /builds/worker/workspace/build/src/editor/libeditor/WSRunObject.cpp:1599

Status: RESOLVED DUPLICATE of bug 1649980

(Core :: DOM: Editor, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase

Testcase found while fuzzing mozilla-central rev cb3b2b090314.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007fc207cc22dd   rbx = 0x00007ffe2767eb98
rsi = 0x00007fc207f91770   rdi = 0x00007fc207f90540
rbp = 0x00007ffe2767e900   rsp = 0x00007ffe2767e860
r8 = 0x00007fc207f91770    r9 = 0x00007fc20905c740
r10 = 0x0000000000000039   r11 = 0x0000000000000000
r12 = 0x00007ffe2767eb98   r13 = 0x00007ffe2767eb28
r14 = 0x0000000000000000   r15 = 0x0000000000000026
rip = 0x00007fc1f87d6e1a
OS|Linux|0.0.0 Linux 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::WSRunObject::FindNearestRun|hg:hg.mozilla.org/mozilla-central:editor/libeditor/WSRunObject.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|1599|0x18
0|1|libxul.so|mozilla::WSRunObject::InsertBreak|hg:hg.mozilla.org/mozilla-central:editor/libeditor/WSRunObject.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|164|0xd
0|2|libxul.so|mozilla::HTMLEditRules::WillInsertText|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditRules.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|1489|0x23
0|3|libxul.so|mozilla::HTMLEditRules::WillDoAction|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditRules.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|634|0x23
0|4|libxul.so|mozilla::TextEditor::InsertText|hg:hg.mozilla.org/mozilla-central:editor/libeditor/TextEditor.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|706|0x27
0|5|libxul.so|mozilla::InsertPlaintextCommand::DoCommandParams|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorCommands.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|1102|0xf
0|6|libxul.so|nsControllerCommandTable::DoCommandParams|hg:hg.mozilla.org/mozilla-central:dom/commandhandler/nsControllerCommandTable.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|162|0x1c
0|7|libxul.so|nsBaseCommandController::DoCommandWithParams|hg:hg.mozilla.org/mozilla-central:dom/commandhandler/nsBaseCommandController.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|152|0x1c
0|8|libxul.so|nsCommandManager::DoCommand|hg:hg.mozilla.org/mozilla-central:dom/commandhandler/nsCommandManager.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|210|0x17
0|9|libxul.so|nsHTMLDocument::ExecCommand|hg:hg.mozilla.org/mozilla-central:dom/html/nsHTMLDocument.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|3105|0x27
0|10|libxul.so|mozilla::dom::HTMLDocumentBinding::execCommand|s3:gecko-generated-sources:098d79455797e9e7f8282464a007eea51b26c60389f19cfd33b690419c597667b0abcc88ec4a7aac22de8babaafb857709d2e7fb70a85dcc3481e1cb347b62e1/dom/bindings/HTMLDocumentBinding.cpp:|811|0x32
0|11|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|3031|0x9
0|12|libxul.so|js::CallJSNative|hg:hg.mozilla.org/mozilla-central:js/src/vm/JSContext-inl.h:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|290|0x6
0|13|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|467|0xf
0|14|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|516|0xd
0|15|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|522|0xf
0|16|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|417|0xb
0|17|libxul.so|js::ExecuteKernel|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|700|0x5
0|18|libxul.so|js::Execute|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|733|0x5
0|19|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|4729|0x12
0|20|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|4748|0x5
0|21|libxul.so|nsJSUtils::ExecutionContext::CompileAndExec|hg:hg.mozilla.org/mozilla-central:dom/base/nsJSUtils.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|266|0xc
0|22|libxul.so|mozilla::dom::ScriptLoader::EvaluateScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|2321|0x12
0|23|libxul.so|mozilla::dom::ScriptLoader::ProcessRequest|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|1950|0xb
0|24|libxul.so|mozilla::dom::ScriptLoader::ProcessInlineScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|1591|0xf
0|25|libxul.so|mozilla::dom::ScriptLoader::ProcessScriptElement|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|1310|0xb
0|26|libxul.so|mozilla::dom::ScriptElement::MaybeProcessScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptElement.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|141|0x13
0|27|libxul.so|nsIScriptElement::AttemptToExecute|hg:hg.mozilla.org/mozilla-central:dom/script/nsIScriptElement.h:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|247|0x3
0|28|libxul.so|nsHtml5TreeOpExecutor::RunScript|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeOpExecutor.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|736|0x10
0|29|libxul.so|nsHtml5TreeOpExecutor::RunFlushLoop|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeOpExecutor.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|540|0x8
0|30|libxul.so|nsHtml5ExecutorFlusher::Run|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5StreamParser.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|131|0x10
0|31|libxul.so|mozilla::SchedulerGroup::Runnable::Run|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|413|0x1c
0|32|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|1040|0x15
0|33|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|517|0x11
0|34|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|97|0xa
0|35|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|326|0x17
0|36|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|319|0x8
0|37|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|157|0xd
0|38|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|892|0x11
0|39|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|269|0x5
0|40|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|326|0x17
0|41|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|319|0x8
0|42|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|718|0x8
0|43|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|50|0x14
0|44|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|280|0x11
0|45|libc-2.23.so||||0x20830
0|46|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:cb3b2b090314e6b1c4bc0bc7ebe7814ba474d974|164|0x5

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
The bug appears to have been fixed in the following build range:

Start: fe9cbc63cbd4f5d6d32a3bd841cd7d08154b957b (20200713222602)
End: 935a16d8abe697428f6d6cf14ebed7095ccb41de (20200713222736)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=fe9cbc63cbd4f5d6d32a3bd841cd7d08154b957b&tochange=935a16d8abe697428f6d6cf14ebed7095ccb41de