1641563 - Assertion failure: !mNextEndRef, at /builds/worker/checkouts/gecko/dom/base/nsRange.cpp:402

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central cfa4bd8e6f78 (built with --enable-debug).

Assertion failure: !mNextEndRef, at /builds/worker/checkouts/gecko/dom/base/nsRange.cpp:402

rax = 0x00007fb73da1ae8c   rdx = 0x0000000000000000
rcx = 0x00005559983cfa58   rbx = 0x000055599977d540
rsi = 0x00007fb74ed068b0   rdi = 0x00007fb74ed05680
rbp = 0x00007ffd4b068c70   rsp = 0x00007ffd4b068ba0
r8 = 0x00007fb74ed068b0    r9 = 0x00007fb74fe6c780
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x000055599979aed0   r13 = 0x00007ffd4b068ca0
r14 = 0x00007ffd4b068d50   r15 = 0x0000555999725480
rip = 0x00007fb7367dfecb
OS|Linux|0.0.0 Linux 5.3.0-51-generic #44~18.04.2-Ubuntu SMP Thu Apr 23 14:27:18 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsRange::CharacterDataChanged(nsIContent*, CharacterDataChangeInfo const&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsRange.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|402|0x29
0|1|libxul.so|mozilla::dom::MutationObservers::NotifyCharacterDataChanged(nsIContent*, CharacterDataChangeInfo const&)|hg:hg.mozilla.org/mozilla-central:dom/base/MutationObservers.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|143|0x19
0|2|libxul.so|mozilla::dom::CharacterData::SetTextInternal(unsigned int, unsigned int, char16_t const*, unsigned int, bool, CharacterDataChangeInfo::Details*)|hg:hg.mozilla.org/mozilla-central:dom/base/CharacterData.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|325|0xb
0|3|libxul.so|mozilla::dom::CharacterData::SetData(nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/CharacterData.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|143|0x15
0|4|libxul.so|mozilla::EditorBase::DoSetText(mozilla::dom::Text&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2110|0x13
0|5|libxul.so|mozilla::EditorBase::SetTextNodeWithoutTransaction(nsTSubstring<char16_t> const&, mozilla::dom::Text&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2718|0x11
0|6|libxul.so|mozilla::TextEditor::SetTextWithoutTransaction(nsTSubstring<char16_t> const&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/TextEditSubActionHandler.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|710|0x1a
0|7|libxul.so|mozilla::TextEditor::SetTextAsSubAction(nsTSubstring<char16_t> const&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/TextEditor.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|572|0xb
0|8|libxul.so|mozilla::TextEditor::SetTextAsAction(nsTSubstring<char16_t> const&, nsIPrincipal*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/TextEditor.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|446|0xb
0|9|libxul.so|mozilla::TextControlState::SetValueWithTextEditor(mozilla::AutoTextControlHandlingState&)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2821|0x1d
0|10|libxul.so|mozilla::TextControlState::SetValue(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const*, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/html/TextControlState.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2658|0x8
0|11|libxul.so|mozilla::dom::HTMLTextAreaElement::SetValueInternal(nsTSubstring<char16_t> const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLTextAreaElement.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|312|0xd
0|12|libxul.so|mozilla::dom::HTMLTextAreaElement::Reset()|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLTextAreaElement.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|690|0x10
0|13|libxul.so|mozilla::dom::HTMLTextAreaElement::ContentChanged(nsIContent*)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLTextAreaElement.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|890|0x8
0|14|libxul.so|mozilla::dom::MutationObservers::NotifyContentAppended(nsIContent*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:dom/base/MutationObservers.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|183|0x16
0|15|libxul.so|nsINode::InsertChildBefore(nsIContent*, nsIContent*, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1542|0x8
0|16|libxul.so|mozilla::dom::Text::SplitText(unsigned int, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/Text.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|56|0x20
0|17|libxul.so|mozilla::dom::Text_Binding::splitText(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:e3ef65cbcff98dad0e2aaa7c82758686fb1e9a6d92f78df5e6092df84201c3da95a2760837367ddc5042e1fd54ac97a7479581bc174a138ca5cfeb73f2c2f1e5/dom/bindings/TextBinding.cpp:|58|0x11
0|18|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|3192|0x21
0|19|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|493|0x12
0|20|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|585|0xe
0|21|libxul.so|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|652|0xa
0|22|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|465|0xb
0|23|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|620|0x8
0|24|libxul.so|<name omitted>|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|665|0xb
0|25|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|2840|0x23
0|26|libxul.so|mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:2563ad09677feb8ddf64827a409899848ef6a80bfacaa11f581c512536a6fb0c779d8b29517ba6358a054c6d475f770bf7bac2913a941d0394881c5649b08603/dom/bindings/EventListenerBinding.cpp:|55|0xe
0|27|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:99837b3cdc69c5eb1234f9d2b3e771dcff734d56a022bedb1d00c0cf4ee6243fb5c91397a058f2ddab63bda8ed6b581ea1232a0229033866910c7289d24cbc2d/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x21
0|28|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1082|0x2c
0|29|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1280|0x16
0|30|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|356|0xb
0|31|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|558|0x19
0|32|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1055|0x5
0|33|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1147|0x1c
0|34|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|5822|0x18
0|35|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|5564|0xb
0|36|libxul.so|non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|0|0x10
0|37|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1367|0x2b
0|38|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|927|0x28
0|39|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|747|0xe
0|40|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|635|0xb
0|41|libxul.so|non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|0|0xd
0|42|libxul.so|mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|615|0x14
0|43|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|522|0xe
0|44|libxul.so|mozilla::dom::Document::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|10673|0x1c
0|45|libxul.so|mozilla::dom::Document::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|10605|0x8
0|46|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|7250|0xd
0|47|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1237|0x17
0|48|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|146|0x11
0|49|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1211|0x11
0|50|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|501|0xc
0|51|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|87|0x7
0|52|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|315|0x17
0|53|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|290|0x8
0|54|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|137|0xd
0|55|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|913|0xe
0|56|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|237|0x5
0|57|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|315|0x17
0|58|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|290|0x8
0|59|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|744|0x5
0|60|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|56|0x11
0|61|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|303|0x20
0|62|libc.so.6||||0x21b97
0|63|firefox-bin|<name omitted>|hg:hg.mozilla.org/mozilla-central:mfbt/UniquePtr.h:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|253|0x17

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Failed to identify testcase.  Please ensure that the testcase meets the requirements identified here: https://github.com/MozillaSecurity/bugmon#testcase-identification
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Comment 3

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200528032513-cfa4bd8e6f78.
Failed to bisect testcase (Start build crashes!):
> Start: 73c98da145a7c0ef518404493b23a979f328768e (20190530034755)
> End: cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f (20200528032513)
> BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 6

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/aPMj7B_y7NGwMuiOzTQ2jQ/index.html

Comment 7

[Jens Stutte [:jstutte]]

The assertion in question has been introduced/changed in bug 1380367. Does this ring a bell, :smaug?

Comment 8

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20220205014840-e8991d00a1d1) but not with tip (mozilla-central 20230203160655-a356e2d3cf46.)

The bug appears to have been fixed in the following build range:

Start: f75c73066b887c2379158c73c994b5ef95460238 (20230127094652)
End: e001f4e845a43564f0588adee16baf8044c74fcb (20230127050229)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f75c73066b887c2379158c73c994b5ef95460238&tochange=e001f4e845a43564f0588adee16baf8044c74fcb

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 9

[Jason Kratzer [:jkratzer]]

:masayuki, was this fixed via bug 822734?

Comment 10

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Yeah, it uses Text::SplitText, so this must be caused by same bug. I'll add the testcase into WPT.

Comment 11

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1641563 - Add reported test case to WPT r=smaug!

The bug itself was fixed in bug 822734.

The reported test case of bug 1641563 does not require invalid HTML structure,
and using simpler Selection API. Therefore, it's worthwhile to add the test
into WPT.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5cea0d162bb2
Add reported test case to WPT r=smaug

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/38390 for changes under testing/web-platform/tests

Comment 14

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/5cea0d162bb2

Comment 15

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot