Open Bug 1593704 Opened 1 year ago Updated 9 months ago

Crash near [@nsGlobalWindowInner::InnerSetNewDocument]

Categories

(Core :: DOM: Navigation, defect, P2)

defect

Tracking

()

Tracking Status
firefox72 --- fix-optional

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase)

Attachments

(1 file)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 5647ec4ba6f2. Testcase must be served via a local webserver in order to reproduce and also requires the env variable GNOME_ACCESSIBILITY=1.

==26305==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7fd665f9e9af bp 0x7ffc55cc1210 sp 0x7ffc55cc1140 T0)
==26305==The signal is caused by a WRITE memory access.
==26305==Hint: address points to the zero page.
    #0 0x7fd665f9e9ae in get /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:278:27
    #1 0x7fd665f9e9ae in operator mozilla::dom::BrowsingContext * /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:291:12
    #2 0x7fd665f9e9ae in GetBrowsingContext /builds/worker/workspace/build/src/dom/base/nsPIDOMWindowInlines.h:70:10
    #3 0x7fd665f9e9ae in nsGlobalWindowInner::InnerSetNewDocument(JSContext*, mozilla::dom::Document*) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowInner.cpp:1609:29
    #4 0x7fd665ff88dd in nsGlobalWindowOuter::SetNewDocument(mozilla::dom::Document*, nsISupports*, bool, mozilla::dom::WindowGlobalChild*) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:2213:23
    #5 0x7fd66b899bb9 in nsDocumentViewer::InitInternal(nsIWidget*, nsISupports*, mozilla::dom::WindowGlobalChild*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, bool, bool) /builds/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:977:22
    #6 0x7fd66b8990fa in nsDocumentViewer::Init(nsIWidget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::dom::WindowGlobalChild*) /builds/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:743:10
    #7 0x7fd66e649820 in nsDocShell::SetupNewViewer(nsIContentViewer*, mozilla::dom::WindowGlobalChild*) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:8257:7
    #8 0x7fd66e648729 in nsDocShell::Embed(nsIContentViewer*, mozilla::dom::WindowGlobalChild*) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:6030:17
    #9 0x7fd66e653dd1 in nsDocShell::CreateAboutBlankContentViewer(nsIPrincipal*, nsIPrincipal*, nsIContentSecurityPolicy*, nsIURI*, bool, bool, mozilla::dom::WindowGlobalChild*) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:6869:14
    #10 0x7fd66e5ff89a in nsDocShell::EnsureContentViewer() /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:6703:17
    #11 0x7fd66e62c1f7 in GetDocument /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:3506:3
    #12 0x7fd66e62c1f7 in non-virtual thunk to nsDocShell::GetDocument() /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp
    #13 0x7fd666031748 in nsPIDOMWindowOuter::MaybeCreateDoc() /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp:7883:45
    #14 0x7fd66e762c0c in GetDoc /builds/worker/workspace/build/src/obj-firefox/dist/include/nsPIDOMWindow.h:839:7
    #15 0x7fd66e762c0c in mozilla::a11y::DocManager::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/workspace/build/src/accessible/base/DocManager.cpp:220:43
    #16 0x7fd664b430f3 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1352:3
    #17 0x7fd664b4167f in nsDocLoader::FireOnStateChange(nsIWebProgress*, nsIRequest*, int, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1315:14
    #18 0x7fd664b3fb80 in nsDocLoader::OnStartRequest(nsIRequest*) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp
    #19 0x7fd664b4013c in non-virtual thunk to nsDocLoader::OnStartRequest(nsIRequest*) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp
    #20 0x7fd6623224f1 in mozilla::net::nsLoadGroup::AddRequest(nsIRequest*, nsISupports*) /builds/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:464:22
    #21 0x7fd6622b2de7 in nsBaseChannel::AsyncOpen(nsIStreamListener*) /builds/worker/workspace/build/src/netwerk/base/nsBaseChannel.cpp:704:31
    #22 0x7fd664b51cff in nsURILoader::OpenURI(nsIChannel*, unsigned int, nsIInterfaceRequestor*) /builds/worker/workspace/build/src/uriloader/base/nsURILoader.cpp:840:19
    #23 0x7fd66e670183 in nsDocShell::OpenInitializedChannel(nsIChannel*, nsIURILoader*, unsigned int) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:10545:20
    #24 0x7fd66e670b73 in nsDocShell::DoChannelLoad(nsIChannel*, nsIURILoader*, bool) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:10500:10
    #25 0x7fd66e6696af in nsDocShell::DoURILoad(nsDocShellLoadState*, bool, nsIDocShell**, nsIRequest**) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:10309:8
    #26 0x7fd66e607efb in nsDocShell::InternalLoad(nsDocShellLoadState*, nsIDocShell**, nsIRequest**) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:9479:8
    #27 0x7fd66e601632 in nsDocShell::LoadURI(nsDocShellLoadState*, bool) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:800:10
    #28 0x7fd6664fe97e in nsFrameLoader::ReallyStartLoadingInternal() /builds/worker/workspace/build/src/dom/base/nsFrameLoader.cpp:670:23
    #29 0x7fd6664fd83f in nsFrameLoader::ReallyStartLoading() /builds/worker/workspace/build/src/dom/base/nsFrameLoader.cpp:548:17
    #30 0x7fd66622aa49 in mozilla::dom::Document::MaybeInitializeFinalizeFrameLoaders() /builds/worker/workspace/build/src/dom/base/Document.cpp:8463:13
    #31 0x7fd66622a203 in mozilla::dom::Document::EndUpdate() /builds/worker/workspace/build/src/dom/base/Document.cpp:6983:3
    #32 0x7fd666540be9 in ~mozAutoDocUpdate /builds/worker/workspace/build/src/dom/base/mozAutoDocUpdate.h:34:18
    #33 0x7fd666540be9 in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsINode.cpp:2407:1
    #34 0x7fd666e76fa0 in InsertBefore /builds/worker/workspace/build/src/dom/base/nsINode.h:1723:12
    #35 0x7fd666e76fa0 in AppendChild /builds/worker/workspace/build/src/dom/base/nsINode.h:1726:12
    #36 0x7fd666e76fa0 in mozilla::dom::Node_Binding::appendChild(JSContext*, JS::Handle<JSObject*>, nsINode*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/NodeBinding.cpp:953:60
    #37 0x7fd6687e0a3c in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3218:13
    #38 0x7fd5d976de0f  (<unknown module>)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:278:27 in get

Flags: in-testsuite?
Group: dom-core-security

Oh, this isn't what I was thinking.
I see 'too much recursion'

Group: dom-core-security

Please note, that the testcase bisects back further than a year.

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression

Didn't crash locally (perhaps it needs to run longer), but the following errors, etc were emitted:

JavaScript error: https://bug1593704.bmoattachments.org/attachment.cgi?id=9106205, line 7: too much recursion
JavaScript error: https://bug1593704.bmoattachments.org/attachment.cgi?id=9106205, line 7: too much recursion
JavaScript error: https://bug1593704.bmoattachments.org/attachment.cgi?id=9106205, line 8: too much recursion
JavaScript error: https://bug1593704.bmoattachments.org/attachment.cgi?id=9106205, line 8: too much recursion
JavaScript error: https://bug1593704.bmoattachments.org/attachment.cgi?id=9106205, line 9: too much recursion
JavaScript error: https://bug1593704.bmoattachments.org/attachment.cgi?id=9106205, line 8: too much recursion
++DOCSHELL 0x7f6f5faeb000 == 3 [pid = 25292] [id = {fbf41ede-bb6e-481e-a5f6-a3448d9f6022}]
++DOMWINDOW == 7 (0x7f6f5e2a0c40) [pid = 25292] [serial = 8] [outer = (nil)]
[Child 25292, Main Thread] WARNING: Overrecursion in SetNewDocument: file /home/mirko/src/firefox/gecko/dom/base/nsGlobalWindowOuter.cpp, line 1916
[Child 25292, Main Thread] WARNING: ContentViewer Initialization failed: file /home/mirko/src/firefox/gecko/docshell/base/nsDocShell.cpp, line 8198
[Child 25292, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005: file /home/mirko/src/firefox/gecko/docshell/base/nsDocShell.cpp, line 5970
[Child 25292, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005: file /home/mirko/src/firefox/gecko/docshell/base/nsDocShell.cpp, line 6809
[Child 25292, Main Thread] WARNING: NS_ENSURE_TRUE(mContentViewer) failed: file /home/mirko/src/firefox/gecko/docshell/base/nsDocShell.cpp, line 6645
[Child 25292, Main Thread] WARNING: NS_ENSURE_SUCCESS(EnsureContentViewer(), nullptr) failed with result 0x8000FFFF: file /home/mirko/src/firefox/gecko/docshell/base/nsDocShell.cpp, line 3455
[Child 25292, Main Thread] WARNING: NS_ENSURE_TRUE(document) failed: file /home/mirko/src/firefox/gecko/accessible/base/DocManager.cpp, line 221 
JavaScript error: https://bug1593704.bmoattachments.org/attachment.cgi?id=9106205, line 7: too much recursion
[Child 25292, Main Thread] WARNING: Subdocument container has non-subdocument frame: 'subdocFrame->Type() == LayoutFrameType::None', file /home/mirko/src/firefox/gecko/layout/base/nsDocumentViewer.cpp, line 2490
[Child 25292, Main Thread] WARNING: Overrecursion in SetNewDocument: file /home/mirko/src/firefox/gecko/dom/base/nsGlobalWindowOuter.cpp, line 1916
[Child 25292, Main Thread] WARNING: ContentViewer Initialization failed: file /home/mirko/src/firefox/gecko/docshell/base/nsDocShell.cpp, line 8198
[Child 25292, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005: file /home/mirko/src/firefox/gecko/docshell/base/nsDocShell.cpp, line 5970
[Child 25292, Main Thread] WARNING: NS_ENSURE_SUCCESS(Embed(viewer), NS_ERROR_FAILURE) failed with result 0x80004005: file /home/mirko/src/firefox/gecko/docshell/base/nsDocShell.cpp, line 7998
[Child 25292, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520015: file /home/mirko/src/firefox/gecko/toolkit/xre/nsXREDirProvider.cpp, line 1553
[Child 25292, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520015: file /home/mirko/src/firefox/gecko/toolkit/profile/nsToolkitProfileService.cpp, line 727 
^G[Child 25292, Main Thread] ###!!! ASSERTION: nsToolkitProfileService::Init failed!: 'Error', file /home/mirko/src/firefox/gecko/toolkit/profile/nsToolkitProfileService.cpp, line 2019```
Component: DOM: Core & HTML → DOM: Navigation
Fission Milestone: --- → M5
Priority: -- → P2

Clearing Fission milestone because this bug does not appear to be Fission-related.

Fission Milestone: M5 → ---
You need to log in before you can comment on or make changes to this bug.