Open Bug 1673649 Opened 4 years ago Updated 2 years ago

Assertion failure: index >= 0, at /builds/worker/workspace/obj-build/dist/include/mozilla/RangeBoundary.h:207

Categories

(Core :: DOM: Editor, defect, P3)

Product:
Core
Component:
DOM: Editor
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox-esr91 --- wontfix
firefox-esr102 --- wontfix
firefox84 --- wontfix
firefox101 --- wontfix
firefox102 --- wontfix
firefox103 --- wontfix
firefox104 --- wontfix

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 2 open bugs, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file, 1 obsolete file)

testcase.zip
685 bytes, application/zip
Details
Attached file testcase.html (obsolete) —

Testcase found while fuzzing mozilla-central rev 3d6ed9f4cf34 (built with --enable-debug). Testcase requires the environment variable GNOME_ACCESSIBILITY=1 to be set.

Assertion failure: index >= 0, at /builds/worker/workspace/obj-build/dist/include/mozilla/RangeBoundary.h:207

==1860437==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f70ef0cd324 bp 0x7ffd9c3fb700 sp 0x7ffd9c3fb6f0 T1860437)
==1860437==The signal is caused by a WRITE memory access.
==1860437==Hint: address points to the zero page.
    #0 0x7f70ef0cd324 in mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> >::DetermineOffsetFromReference() const /builds/worker/workspace/obj-build/dist/include/mozilla/RangeBoundary.h:207:5
    #1 0x7f70ef3a3430 in Offset /builds/worker/workspace/obj-build/dist/include/mozilla/RangeBoundary.h:185:11
    #2 0x7f70ef3a3430 in StartOffset /builds/worker/workspace/obj-build/dist/include/mozilla/dom/AbstractRange.h:65:17
    #3 0x7f70ef3a3430 in IsItemInRangeComparator::operator()(nsRange const*) const /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:284:38
    #4 0x7f70ef3a30a1 in nsINode::IsSelected(unsigned int, unsigned int) const /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:350:20
    #5 0x7f70f2fc4a74 in IsSelected /builds/worker/workspace/obj-build/dist/include/nsIFrame.h:3674:64
    #6 0x7f70f2fc4a74 in mozilla::a11y::HTMLTableCellAccessible::NativeState() const /builds/worker/checkouts/gecko/accessible/html/HTMLTableAccessible.cpp:65:23
    #7 0x7f70f2f9be8c in mozilla::a11y::Accessible::State() /builds/worker/checkouts/gecko/accessible/generic/Accessible.cpp:1143:20
    #8 0x7f70f2f5e624 in mozilla::a11y::AccTextChangeEvent::AccTextChangeEvent(mozilla::a11y::Accessible*, int, nsTSubstring<char16_t> const&, bool, mozilla::a11y::EIsFromUserInput) /builds/worker/checkouts/gecko/accessible/base/AccEvent.cpp:96:20
    #9 0x7f70f2f68d55 in mozilla::a11y::NotificationController::QueueMutationEvent(mozilla::a11y::AccTreeMutationEvent*) /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:266:38
    #10 0x7f70f2f6910b in mozilla::a11y::TreeMutation::BeforeRemoval(mozilla::a11y::Accessible*, bool) /builds/worker/checkouts/gecko/accessible/base/EventTree.cpp:86:21
    #11 0x7f70f2faa260 in mozilla::a11y::DocAccessible::ContentRemoved(mozilla::a11y::Accessible*) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:2125:6
    #12 0x7f70f2fa6ce6 in mozilla::a11y::DocAccessible::ContentRemoved(nsIContent*) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:2154:5
    #13 0x7f70f2f83ce4 in nsAccessibilityService::ContentRemoved(mozilla::PresShell*, nsIContent*) /builds/worker/checkouts/gecko/accessible/base/nsAccessibilityService.cpp:577:15
    #14 0x7f70f1f02a9d in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7490:21
    #15 0x7f70f1eaa678 in mozilla::PresShell::ContentRemoved(nsIContent*, nsIContent*) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4438:22
    #16 0x7f70ef2b6685 in mozilla::dom::MutationObservers::NotifyContentRemoved(nsINode*, nsIContent*, nsIContent*) /builds/worker/checkouts/gecko/dom/base/MutationObservers.cpp:214:3
    #17 0x7f70ef3aa0f0 in nsINode::RemoveChildNode(nsIContent*, bool) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:2092:5
    #18 0x7f70ef3a4524 in nsINode::RemoveChild(nsINode&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:798:3
    #19 0x7f70f1cf11d6 in mozilla::HTMLEditor::MoveChildrenBetween(nsIContent&, nsIContent&, mozilla::EditorDOMPointBase<nsINode*, nsIContent*> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:7474:19
    #20 0x7f70f1cf16b8 in mozilla::HTMLEditor::MovePreviousSiblings(nsIContent&, mozilla::EditorDOMPointBase<nsINode*, nsIContent*> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:7526:3
    #21 0x7f70f1d2e195 in mozilla::HTMLEditor::DoSplitNode(mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&, nsIContent&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditor.cpp:4363:9
    #22 0x7f70f1d8079f in mozilla::SplitNodeTransaction::DoTransaction() /builds/worker/checkouts/gecko/editor/libeditor/SplitNodeTransaction.cpp:96:15
    #23 0x7f70f1dc4a99 in DoTransaction /builds/worker/checkouts/gecko/editor/txmgr/TransactionItem.cpp:81:30
    #24 0x7f70f1dc4a99 in mozilla::TransactionManager::BeginTransaction(nsITransaction*, nsISupports*) /builds/worker/checkouts/gecko/editor/txmgr/TransactionManager.cpp:686:34
    #25 0x7f70f1dc4764 in mozilla::TransactionManager::DoTransaction(nsITransaction*) /builds/worker/checkouts/gecko/editor/txmgr/TransactionManager.cpp:71:8
    #26 0x7f70f1c721ca in mozilla::EditorBase::DoTransactionInternal(nsITransaction*) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:854:41
    #27 0x7f70f1cf7134 in mozilla::HTMLEditor::SplitNodeWithTransaction(mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditor.cpp:4145:12
    #28 0x7f70f1ccda75 in mozilla::HTMLEditor::SplitNodeDeepWithTransaction(nsIContent&, mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&, mozilla::HTMLEditor::SplitAtEdges) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditor.cpp:4219:11
    #29 0x7f70f1d0ef36 in mozilla::HTMLEditor::SplitElementsAtEveryBRElement(nsIContent&, nsTArray<mozilla::OwningNonNull<nsIContent> >&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:11957:39
    #30 0x7f70f1d0e1d7 in mozilla::HTMLEditor::MaybeSplitElementsAtEveryBRElement(nsTArray<mozilla::OwningNonNull<nsIContent> >&, mozilla::EditSubAction) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:11814:25
    #31 0x7f70f1d00a2c in mozilla::HTMLEditor::SplitInlinesAndCollectEditTargetNodes(nsTArray<RefPtr<nsRange> >&, nsTArray<mozilla::OwningNonNull<nsIContent> >&, mozilla::EditSubAction, mozilla::HTMLEditor::CollectNonEditableNodes) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:11575:8
    #32 0x7f70f1cf57d2 in mozilla::HTMLEditor::SplitInlinesAndCollectEditTargetNodesInExtendedSelectionRanges(nsTArray<mozilla::OwningNonNull<nsIContent> >&, mozilla::EditSubAction, mozilla::HTMLEditor::CollectNonEditableNodes) /builds/worker/workspace/obj-build/dist/include/mozilla/HTMLEditor.h:1492:19
    #33 0x7f70f1d06a0f in mozilla::HTMLEditor::AlignContentsAtSelection(nsTSubstring<char16_t> const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:10098:17
    #34 0x7f70f1d0662b in mozilla::HTMLEditor::AlignAsSubAction(nsTSubstring<char16_t> const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:10065:8
    #35 0x7f70f1d26b0f in mozilla::HTMLEditor::AlignAsAction(nsTSubstring<char16_t> const&, nsIPrincipal*) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditor.cpp:2511:29
    #36 0x7f70f1d380b8 in mozilla::AlignCommand::SetState(mozilla::HTMLEditor*, nsTSubstring<char16_t> const&, nsIPrincipal*) const /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorCommands.cpp:894:30
    #37 0x7f70f1d3648e in mozilla::MultiStateCommandBase::DoCommandParam(mozilla::Command, nsTSubstring<char16_t> const&, mozilla::TextEditor&, nsIPrincipal*) const /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorCommands.cpp:516:17
    #38 0x7f70ef214731 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:5069:26
    #39 0x7f70f021080d in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/DocumentBinding.cpp:3472:36
    #40 0x7f70f057366a in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3229:13
    #41 0x7f70f34ff001 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:506:13
    #42 0x7f70f34fe718 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:598:12
    #43 0x7f70f35002e3 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:663:10
    #44 0x7f70f34f4083 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:667:10
    #45 0x7f70f34f4083 in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3336:16
    #46 0x7f70f34eb1f4 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:476:13
    #47 0x7f70f34fe6e9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:635:13
    #48 0x7f70f35002e3 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:663:10
    #49 0x7f70f350051f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:680:8
    #50 0x7f70f3aebc8b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2829:10
    #51 0x7f70f02a427c in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:57:8
    #52 0x7f70f09082a6 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:66:12
    #53 0x7f70f0907fed in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1073:43
    #54 0x7f70f0908c92 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1270:17
    #55 0x7f70f08fdf62 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:354:5
    #56 0x7f70f08fdf62 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:352:17
    #57 0x7f70f08fd513 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:554:16
    #58 0x7f70f0900020 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1092:11
    #59 0x7f70f1f129b7 in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1095:7
    #60 0x7f70f2ec7641 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6451:20
    #61 0x7f70f2ec702a in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5804:7
    #62 0x7f70f2ec7f1f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
    #63 0x7f70ee86b51c in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1348:3
    #64 0x7f70ee86aaca in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:954:14
    #65 0x7f70ee868e5c in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:757:9
    #66 0x7f70ee869f0d in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:640:5
    #67 0x7f70ee86a6ec in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp
    #68 0x7f70ed7dff66 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:615:22
    #69 0x7f70ed7e1473 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:522:10
    #70 0x7f70ef230f01 in mozilla::dom::Document::DoUnblockOnload() /builds/worker/checkouts/gecko/dom/base/Document.cpp:10984:18
    #71 0x7f70ef20fc50 in mozilla::dom::Document::UnblockOnload(bool) /builds/worker/checkouts/gecko/dom/base/Document.cpp:10914:9
    #72 0x7f70ef22042d in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7473:3
    #73 0x7f70ef291296 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1188:12
    #74 0x7f70ef291296 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1194:12
    #75 0x7f70ef291296 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1240:13
    #76 0x7f70ed649d32 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:146:20
    #77 0x7f70ed64f1df in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:245:16
    #78 0x7f70ed64d85a in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:515:26
    #79 0x7f70ed64c904 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:374:15
    #80 0x7f70ed64cab7 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:171:36
    #81 0x7f70ed652706 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:85:37
    #82 0x7f70ed652706 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #83 0x7f70ed663957 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1197:14
    #84 0x7f70ed66969a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #85 0x7f70edf5d4c6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #86 0x7f70edecf3b3 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #87 0x7f70edecf2cd in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #88 0x7f70edecf2cd in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #89 0x7f70f1bc9308 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #90 0x7f70f33c4aa3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #91 0x7f70edf5e289 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #92 0x7f70edecf3b3 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #93 0x7f70edecf2cd in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #94 0x7f70edecf2cd in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #95 0x7f70f33c4688 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #96 0x55ad69e51647 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #97 0x55ad69e51647 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:304:18
    #98 0x7f7101f640b2 in __libc_start_main /build/glibc-ZN95T4/glibc-2.31/csu/../csu/libc-start.c:308:16
    #99 0x55ad69e2f3f9 in _start (/home/forb1dden/builds/mc-debug/firefox-bin+0x143f9)

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/RangeBoundary.h:207:5 in mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> >::DetermineOffsetFromReference() const
Flags: in-testsuite?

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201027095021-3d6ed9f4cf34.
The bug appears to have been introduced in the following build range:

Start: a63f4be757ec28b4362f900f910ff3b21f5accdd (20191121100520)
End: 2f70fc091d1d1b9e6e4d613feec8a95d9d4b1345 (20191121101459)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a63f4be757ec28b4362f900f910ff3b21f5accdd&tochange=2f70fc091d1d1b9e6e4d613feec8a95d9d4b1345

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Flags: needinfo?(mbrodesser)
Flags: needinfo?(mbrodesser)
See Also: → 1601416

The correctness of the MOZ_ASSERT has to be reconsidered. This requires analysis of the callers of RangeBoundaryBase::Offset.

Priority: -- → P3

No clue yet but could it be something inside <caption> implementation? I've already seen it causing a dirty state on bug 1654362.

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20201027095021-3d6ed9f4cf34)but not with tip (mozilla-central 20210818115204-09aa8d80251a.)
The bug appears to have been fixed in the following build range:

Start: 8803bc71047a75f0983844d891d82b4a5edecda4 (20210310041823)
End: 194e31587e6c4174702a223b448e8748b1b4a144 (20210310045802)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=8803bc71047a75f0983844d891d82b4a5edecda4&tochange=194e31587e6c4174702a223b448e8748b1b4a144

:mats, is it possible that this was fixed by bug 1714944?

Flags: needinfo?(mats)

Apologies - this was in reference to a different bug.

Flags: needinfo?(mats)

:masayuki, is it possible that this was fixed via bug 1677566?

Flags: needinfo?(masayuki)

My apologies. It looks like this bug still exists although the original testcase no longer triggers the assertion. I'll upload a new testcase.

Attached file testcase.zip —

Testcase found while fuzzing mozilla-central rev 1e6d20eb3a01 (built with --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 1e6d20eb3a01 --debug --fuzzing -n mc-debug
$ python -m grizzly.replay ./mc-debug/firefox ./testcase.zip
Attachment #9183998 - Attachment is obsolete: true
Flags: needinfo?(masayuki)

Setting regressed_by field after analyzing regression range found by bugmon.

Regressed by: 1597968

Set release status flags based on info from the regressing bug 1597968

status-firefox101: --- → affected
status-firefox102: --- → affected
status-firefox103: --- → affected
status-firefox-esr91: --- → affected

Set release status flags based on info from the regressing bug 1597968

status-firefox104: --- → affected
status-firefox-esr102: --- → affected
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: