1636596 - null pointer passed as argument 1, which is declared to never be null in intl/icu/source/common/uloc.cpp:1206

Status: RESOLVED FIXED

(Core :: JavaScript: Internationalization API, defect, P5)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found with m-c 20200506-93a33cb7f236
Can be triggered with an UBSan build with the attached test case. To enable this check add the following to your mozconfig:

ac_add_options --enable-undefined-sanitizer="nonnull-attribute"

src/intl/icu/source/common/uloc.cpp:1206:5: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
    #0 0x7f552f600b0f in ulocimp_getLanguage_67 src/intl/icu/source/common/uloc.cpp:1206:5
    #1 0x7f552f602eee in uloc_getCountry_67 src/intl/icu/source/common/uloc.cpp:1803:5
    #2 0x7f552f4d491c in ulocimp_getRegionForSupplementalData_67 src/intl/icu/source/common/loclikely.cpp:1334:17
    #3 0x7f552f5dd80b in ucurr_forLocale_67 src/intl/icu/source/common/ucurr.cpp:535:5
    #4 0x7f552f75069c in icu_67::DecimalFormatSymbols::initialize(icu_67::Locale const&, UErrorCode&, signed char, icu_67::NumberingSystem const*) src/intl/icu/source/i18n/dcfmtsym.cpp:461:29
    #5 0x7f552f87a385 in icu_67::NumberFormat::makeInstance(icu_67::Locale const&, UNumberFormatStyle, signed char, UErrorCode&) src/intl/icu/source/i18n/numfmt.cpp:1399:58
    #6 0x7f552f879006 in icu_67::NumberFormat::internalCreateInstance(icu_67::Locale const&, UNumberFormatStyle, UErrorCode&) src/intl/icu/source/i18n/numfmt.cpp:1050:12
    #7 0x7f552f879cdb in icu_67::LocaleCacheKey<icu_67::SharedNumberFormat>::createObject(void const*, UErrorCode&) const src/intl/icu/source/i18n/numfmt.cpp:1261:24
    #8 0x7f552f6342c9 in icu_67::UnifiedCache::_get(icu_67::CacheKeyBase const&, icu_67::SharedObject const*&, void const*, UErrorCode&) const src/intl/icu/source/common/unifiedcache.cpp:394:17
    #9 0x7f552f87c9ad in void icu_67::UnifiedCache::get<icu_67::SharedNumberFormat>(icu_67::CacheKey<icu_67::SharedNumberFormat> const&, void const*, icu_67::SharedNumberFormat const*&, UErrorCode&) const src/intl/icu/source/common/unifiedcache.h:234:8
    #10 0x7f552f87b700 in void icu_67::UnifiedCache::getByLocale<icu_67::SharedNumberFormat>(icu_67::Locale const&, icu_67::SharedNumberFormat const*&, UErrorCode&) src/intl/icu/source/common/unifiedcache.h:274:15
    #11 0x7f552f8791f3 in icu_67::NumberFormat::createSharedInstance(icu_67::Locale const&, UNumberFormatStyle, UErrorCode&) src/intl/icu/source/i18n/numfmt.cpp:1286:5
    #12 0x7f552f878718 in icu_67::NumberFormat::createInstance(icu_67::Locale const&, UNumberFormatStyle, UErrorCode&) src/intl/icu/source/i18n/numfmt.cpp:1058:40
    #13 0x7f552f9758bd in unum_open_67 src/intl/icu/source/i18n/unum.cpp:63:18
    #14 0x7f552f1c2a18 in ICUUtils::ParseNumber(nsTSubstring<char16_t>&, ICUUtils::LanguageTagIterForContent&) src/intl/unicharutil/util/ICUUtils.cpp:131:9
    #15 0x7f55356748e6 in mozilla::dom::NumericInputTypeBase::ConvertStringToNumber(nsTSubstring<char16_t>&, blink::Decimal&) const src/dom/html/input/NumericInputTypes.cpp:100:27
    #16 0x7f5535501045 in mozilla::dom::HTMLInputElement::GetValueAsDecimal() const src/dom/html/HTMLInputElement.cpp:1519:23
    #17 0x7f5535673ae9 in mozilla::dom::NumericInputTypeBase::IsRangeOverflow() const src/dom/html/input/NumericInputTypes.cpp:22:34
    #18 0x7f55354fee06 in mozilla::dom::HTMLInputElement::UpdateRangeOverflowValidityState() src/dom/html/HTMLInputElement.cpp:6518:51
    #19 0x7f553550a17a in mozilla::dom::HTMLInputElement::UpdateAllValidityStatesButNotElementState() src/dom/html/HTMLInputElement.cpp:6548:3
    #20 0x7f55355086cf in mozilla::dom::HTMLInputElement::UpdateAllValidityStates(bool) src/dom/html/HTMLInputElement.cpp:6535:3
    #21 0x7f5535508fee in mozilla::dom::HTMLInputElement::OnValueChanged(mozilla::TextControlElement::ValueChangeKind) src/dom/html/HTMLInputElement.cpp:6634:3
    #22 0x7f5535501c40 in mozilla::dom::HTMLInputElement::SetValueInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int) src/dom/html/HTMLInputElement.cpp:2666:11
    #23 0x7f55354fbdfb in mozilla::dom::HTMLInputElement::DoneCreatingElement() src/dom/html/HTMLInputElement.cpp:5827:5
    #24 0x7f5531c1f9ad in decltype(auto) mozilla::detail::VariantImplementation<...>&) src/objdir-ff-ubsan/dist/include/mozilla/Variant.h:257:16
    #25 0x7f5531c18913 in nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**, bool*, bool*) src/parser/html/nsHtml5TreeOperation.cpp:1188:21
    #26 0x7f5531c181b1 in nsHtml5TreeOpExecutor::RunFlushLoop() src/parser/html/nsHtml5TreeOpExecutor.cpp:495:19
    #27 0x7f5531c4755b in nsHtml5ExecutorReflusher::Run() src/parser/html/nsHtml5TreeOpExecutor.cpp:70:16
    #28 0x7f552eff5196 in mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:146:20
    #29 0x7f552f02b6d6 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1200:14
    #30 0x7f552f0322ec in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:481:10
    #31 0x7f55303ffefa in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
    #32 0x7f553025e1d4 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
    #33 0x7f55372a3d1a in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
    #34 0x7f553b2d8df1 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:909:20
    #35 0x7f55304011a1 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:237:9
    #36 0x7f553025e1d4 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290:3
    #37 0x7f553b2d8452 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:740:34
    #38 0x563ea3ebb20d in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #39 0x563ea3ebb536 in main src/browser/app/nsBrowserApp.cpp:303:18

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.

Comment 2

[Tyson Smith [:tsmith]]

Let's piggy back this on here.

src/intl/icu/source/common/uloc.cpp:1254:5: runtime error: null pointer passed as argument 1, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
    #0 0x7f8aae2a445f in ulocimp_getScript_67 src/intl/icu/source/common/uloc.cpp:1254:5
    #1 0x7f8aae2a60f8 in uloc_getCountry_67 src/intl/icu/source/common/uloc.cpp:1807:9
    #2 0x7f8aae177adc in ulocimp_getRegionForSupplementalData_67 src/intl/icu/source/common/loclikely.cpp:1334:17
    #3 0x7f8aae2809cb in ucurr_forLocale_67 src/intl/icu/source/common/ucurr.cpp:535:5
    #4 0x7f8aae3f383c in icu_67::DecimalFormatSymbols::initialize(icu_67::Locale const&, UErrorCode&, signed char, icu_67::NumberingSystem const*) src/intl/icu/source/i18n/dcfmtsym.cpp:461:29
    #5 0x7f8aae51d525 in icu_67::NumberFormat::makeInstance(icu_67::Locale const&, UNumberFormatStyle, signed char, UErrorCode&) src/intl/icu/source/i18n/numfmt.cpp:1399:58
    #6 0x7f8aae51c1a6 in icu_67::NumberFormat::internalCreateInstance(icu_67::Locale const&, UNumberFormatStyle, UErrorCode&) src/intl/icu/source/i18n/numfmt.cpp:1050:12
    #7 0x7f8aae51ce7b in icu_67::LocaleCacheKey<icu_67::SharedNumberFormat>::createObject(void const*, UErrorCode&) const src/intl/icu/source/i18n/numfmt.cpp:1261:24
    #8 0x7f8aae2d7469 in icu_67::UnifiedCache::_get(icu_67::CacheKeyBase const&, icu_67::SharedObject const*&, void const*, UErrorCode&) const src/intl/icu/source/common/unifiedcache.cpp:394:17
    #9 0x7f8aae51fb4d in void icu_67::UnifiedCache::get<icu_67::SharedNumberFormat>(icu_67::CacheKey<icu_67::SharedNumberFormat> const&, void const*, icu_67::SharedNumberFormat const*&, UErrorCode&) const src/intl/icu/source/common/unifiedcache.h:234:8
    #10 0x7f8aae51e8a0 in void icu_67::UnifiedCache::getByLocale<icu_67::SharedNumberFormat>(icu_67::Locale const&, icu_67::SharedNumberFormat const*&, UErrorCode&) src/intl/icu/source/common/unifiedcache.h:274:15
    #11 0x7f8aae51c393 in icu_67::NumberFormat::createSharedInstance(icu_67::Locale const&, UNumberFormatStyle, UErrorCode&) src/intl/icu/source/i18n/numfmt.cpp:1286:5
    #12 0x7f8aae51b8b8 in icu_67::NumberFormat::createInstance(icu_67::Locale const&, UNumberFormatStyle, UErrorCode&) src/intl/icu/source/i18n/numfmt.cpp:1058:40
    #13 0x7f8aae618a5d in unum_open_67 src/intl/icu/source/i18n/unum.cpp:63:18
    #14 0x7f8aade65d68 in ICUUtils::ParseNumber(nsTSubstring<char16_t>&, ICUUtils::LanguageTagIterForContent&) src/intl/unicharutil/util/ICUUtils.cpp:131:9
    #15 0x7f8ab4331a16 in mozilla::dom::NumericInputTypeBase::ConvertStringToNumber(nsTSubstring<char16_t>&, blink::Decimal&) const src/dom/html/input/NumericInputTypes.cpp:100:27
    #16 0x7f8ab41be0d5 in mozilla::dom::HTMLInputElement::GetValueAsDecimal() const src/dom/html/HTMLInputElement.cpp:1519:23
    #17 0x7f8ab4330c19 in mozilla::dom::NumericInputTypeBase::IsRangeOverflow() const src/dom/html/input/NumericInputTypes.cpp:22:34
    #18 0x7f8ab41bbe96 in mozilla::dom::HTMLInputElement::UpdateRangeOverflowValidityState() src/dom/html/HTMLInputElement.cpp:6518:51
    #19 0x7f8ab41c720a in mozilla::dom::HTMLInputElement::UpdateAllValidityStatesButNotElementState() src/dom/html/HTMLInputElement.cpp:6548:3
    #20 0x7f8ab41c575f in mozilla::dom::HTMLInputElement::UpdateAllValidityStates(bool) src/dom/html/HTMLInputElement.cpp:6535:3
    #21 0x7f8ab41c607e in mozilla::dom::HTMLInputElement::OnValueChanged(mozilla::TextControlElement::ValueChangeKind) src/dom/html/HTMLInputElement.cpp:6634:3
    #22 0x7f8ab41becd0 in mozilla::dom::HTMLInputElement::SetValueInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int) src/dom/html/HTMLInputElement.cpp:2666:11
    #23 0x7f8ab41b8e8b in mozilla::dom::HTMLInputElement::DoneCreatingElement() src/dom/html/HTMLInputElement.cpp:5827:5
    #24 0x7f8ab59d4d47 in nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int, bool) src/dom/xml/nsXMLContentSink.cpp:958:14
    #25 0x7f8ab59d46b8 in nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int) src/dom/xml/nsXMLContentSink.cpp:889:10
    #26 0x7f8ab083a051 in nsExpatDriver::HandleStartElement(void*, char16_t const*, char16_t const**) src/parser/htmlparser/nsExpatDriver.cpp:293:32
    #27 0x7f8ab7ca623d in doContent src/parser/expat/lib/xmlparse.c:2900:11
...

Comment 3

[André Bargull [:anba]]

Filed https://unicode-org.atlassian.net/browse/ICU-21118 to track this issue upstream.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:Waldo, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[Jason Orendorff [:jorendorff]]

Fixed upstream. This will be fixed eventually by updating our in-tree ICU.

By itself, this is pretty low priority. Symptomless bug as far as I can tell.

Comment 6

[André Bargull [:anba]]

Fixed upstream in ICU 69 (bug 1714933).

Comment 7

[André Bargull [:anba]]

Fixed when updating to ICU 69 (bug 1714933).