1706145 - Assertion failure: aEditorBase.SelectionRef().GetAnchorFocusRange()->StartRef() == mAnchorFocusRange->StartRef(), at /builds/worker/checkouts/gecko/editor/libeditor/EditorUtils.cpp:159

Jason Kratzer [:jkratzer]

Reporter

Description

•

3 years ago

Attached file testcase.html — Details

Testcase found while fuzzing mozilla-central rev 8e850fd29a95 (built with --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install grizzly-framework
$ python -m grizzly.replay --xvfb ~/builds/mc-debug/firefox ./testcase.html

Assertion failure: aEditorBase.SelectionRef().GetAnchorFocusRange()->StartRef() == mAnchorFocusRange->StartRef(), at /builds/worker/checkouts/gecko/editor/libeditor/EditorUtils.cpp:159

    #0 0x7f964621cd13 in mozilla::AutoRangeArray::ExtendAnchorFocusRangeFor(mozilla::EditorBase const&, short) /builds/worker/checkouts/gecko/editor/libeditor/EditorUtils.cpp:158:3
    #1 0x7f96462a6c8a in mozilla::HTMLEditor::AutoDeleteRangesHandler::Run(mozilla::HTMLEditor&, short, short, mozilla::AutoRangeArray&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:1491:25
    #2 0x7f96462a5c2a in mozilla::HTMLEditor::HandleDeleteSelection(short, short) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:1127:43
    #3 0x7f964620ad8d in mozilla::EditorBase::DeleteSelectionAsSubAction(short, short) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:3782:7
    #4 0x7f96461fb479 in mozilla::EditorBase::DeleteSelectionAsAction(short, short, nsIPrincipal*) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:3746:8
    #5 0x7f964621517b in mozilla::DeleteCommand::DoCommand(mozilla::Command, mozilla::TextEditor&, nsIPrincipal*) const /builds/worker/checkouts/gecko/editor/libeditor/EditorCommands.cpp:619:29
    #6 0x7f96436c4670 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:5308:37
    #7 0x7f96446fd40d in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/DocumentBinding.cpp:3477:36
    #8 0x7f9644a7f37d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3232:13
    #9 0x7f9647ae20d0 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:437:13
    #10 0x7f9647ae183c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:522:12
    #11 0x7f9647ae3049 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:582:10
    #12 0x7f9647ad7ca5 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:586:10
    #13 0x7f9647ad7ca5 in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3248:16
    #14 0x7f9647acf295 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:406:13
    #15 0x7f9647ae1859 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:554:13
    #16 0x7f9647ae3049 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:582:10
    #17 0x7f9647ae326f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:599:8
    #18 0x7f964806a0cb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2830:10
    #19 0x7f96446d1dbc in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:58:8
    #20 0x7f9644e341c6 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
    #21 0x7f9644e33f0e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1104:43
    #22 0x7f9644e34b90 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1301:17
    #23 0x7f9644e29e95 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:390:5
    #24 0x7f9644e29e95 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:354:17
    #25 0x7f9644e29443 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:556:16
    #26 0x7f9644e2c041 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1099:11
    #27 0x7f9644e2ebd6 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp
    #28 0x7f9643855893 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:1331:17
    #29 0x7f9643569faa in nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:4183:28
    #30 0x7f9643569e36 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:4153:10
    #31 0x7f96436d0993 in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7672:3
    #32 0x7f96437436c6 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1148:12
    #33 0x7f96437436c6 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1154:12
    #34 0x7f96437436c6 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1201:13
    #35 0x7f9641acc032 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:143:20
    #36 0x7f9641af7463 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:473:16
    #37 0x7f9641ad4d09 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:757:26
    #38 0x7f9641ad3c74 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:612:15
    #39 0x7f9641ad3e03 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:396:36
    #40 0x7f9641afad86 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:135:37
    #41 0x7f9641afad86 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
    #42 0x7f9641ae6b10 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
    #43 0x7f9641aed7ba in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #44 0x7f9642427676 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #45 0x7f9642392553 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #46 0x7f964239246d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #47 0x7f964239246d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #48 0x7f96461345f8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #49 0x7f96479adea3 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:906:20
    #50 0x7f964242855c in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #51 0x7f9642392553 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #52 0x7f964239246d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #53 0x7f964239246d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #54 0x7f96479ada7f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:738:34
    #55 0x56459e3be0d6 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #56 0x56459e3be0d6 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:309:18
    #57 0x7f965726c0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

Flags: in-testsuite?

Bugmon [:jkratzer for issues]

Comment 1

•

3 years ago

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20210419221626-e2fb29057e4c
mozilla-central 20210419094740-8e850fd29a95
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon

Whiteboard: [bugmon:confirm] → [bugmon:confirmed]

Olli Pettay [:smaug][bugs@pettay.fi]

Updated

•

3 years ago

Severity: -- → S3

Priority: -- → P3

Jason Kratzer [:jkratzer]

Reporter

Updated

•

3 years ago

No longer blocks: domino

Depends on: domino

Jason Kratzer [:jkratzer]

Reporter

Updated

•

3 years ago

Blocks: domino

No longer depends on: domino

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 2

•

11 months ago

jkratzer: Do you still reproduce this bug? bugmon and I do not reproduce this bug. (I don't know how fuzzing build affects in the testcase, though.) If you don't reproduce it, I'll just add the reported testcase into the tree.

Flags: needinfo?(jkratzer)

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 3

•

11 months ago

The testcase tries forwardDelete when selection is collapsed after the editable <slot> after the <body>. Therefore, I guess that this has already been fixed in bug 1677566.

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 4

•

11 months ago

Attached file Bug 1706145 - Add reported testcase r=m_kato! — Details

Depends on D179522

Phabricator Automation

Updated

•

11 months ago

Assignee: nobody → masayuki

Status: NEW → ASSIGNED

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 5

•

11 months ago

Oh, it's crashed in some platforms in tryserver.

Flags: needinfo?(jkratzer)

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 6

•

11 months ago

Oh, no. It's for different test. So it seems that this is not reproducible anymore.

Flags: needinfo?(jkratzer)

Jason Kratzer [:jkratzer]

Reporter

Comment 7

•

11 months ago

:masayuki, I can't reproduce with the testcase attached to this bug. However, the fuzzers have reported a crash with the same assertion on 2023/01/25. Unfortunately, I cannot reproduce the issue using that testcase.

Assertion failure: aEditorBase.SelectionRef().GetAnchorFocusRange()->StartRef() == mAnchorFocusRange->StartRef(), at /builds/worker/checkouts/gecko/editor/libeditor/AutoRangeArray.cpp:212

==292403==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f9bb797508c bp 0x7ffdeecdb5a0 sp 0x7ffdeecdb4f0 T292403)
==292403==The signal is caused by a WRITE memory access.
==292403==Hint: address points to the zero page.
    #0 0x7f9bb797508c in mozilla::AutoRangeArray::ExtendAnchorFocusRangeFor(mozilla::EditorBase const&, short) /builds/worker/checkouts/gecko/editor/libeditor/AutoRangeArray.cpp:211:3
    #1 0x7f9bb7a6e59c in mozilla::HTMLEditor::AutoDeleteRangesHandler::Run(mozilla::HTMLEditor&, short, short, mozilla::AutoRangeArray&, mozilla::dom::Element const&) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:1532:25
    #2 0x7f9bb7a6d422 in mozilla::HTMLEditor::HandleDeleteSelection(short, short) /builds/worker/checkouts/gecko/editor/libeditor/HTMLEditorDeleteHandler.cpp:1160:61
    #3 0x7f9bb7999eb4 in mozilla::EditorBase::DeleteSelectionAsSubAction(short, short) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:4230:9
    #4 0x7f9bb7994a71 in mozilla::EditorBase::DeleteSelectionAsAction(short, short, nsIPrincipal*) /builds/worker/checkouts/gecko/editor/libeditor/EditorBase.cpp:4193:8
    #5 0x7f9bb79b2a3b in mozilla::DeleteCommand::DoCommand(mozilla::Command, mozilla::EditorBase&, nsIPrincipal*) const /builds/worker/checkouts/gecko/editor/libeditor/EditorCommands.cpp:619:29
    #6 0x7f9bb41ac526 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:5491:37
    #7 0x7f9bb557428f in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/DocumentBinding.cpp:4149:36
    #8 0x7f9bb5909a72 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3308:13
    #9 0x7f9bb9d22a86 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:459:13
    #10 0x7f9bb9d223af in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:547:12
    #11 0x7f9bb9d13fef in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:619:10
    #12 0x7f9bb9d13fef in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3362:16
    #13 0x7f9bb9d076ae in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:431:13
    #14 0x7f9bb9d24e6b in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:812:13
    #15 0x7f9bb9d253a0 in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:844:10
    #16 0x7f9bb9dff6e6 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:473:10
    #17 0x7f9bb9dff8fb in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/worker/checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:497:10
    #18 0x7f9bb429eda8 in mozilla::dom::JSExecutionContext::ExecScript() /builds/worker/checkouts/gecko/dom/base/JSExecutionContext.cpp:241:8
    #19 0x7f9bb763dfea in ExecuteCompiledScript /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:2142:16
    #20 0x7f9bb763dfea in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:2407:12
    #21 0x7f9bb763d22e in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:2211:10
    #22 0x7f9bb7639bef in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:1861:10
    #23 0x7f9bb763ab84 in mozilla::dom::ScriptLoader::CompileOffThreadOrProcessRequest(JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:1445:10
    #24 0x7f9bb762b90e in mozilla::dom::ScriptLoader::ProcessPendingRequests() /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:2736:7
    #25 0x7f9bb764b836 in applyImpl<mozilla::dom::ScriptLoader, void (mozilla::dom::ScriptLoader::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
    #26 0x7f9bb764b836 in apply<mozilla::dom::ScriptLoader, void (mozilla::dom::ScriptLoader::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1168:12
    #27 0x7f9bb764b836 in mozilla::detail::RunnableMethodImpl<mozilla::dom::ScriptLoader*, void (mozilla::dom::ScriptLoader::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1215:13
    #28 0x7f9bb27432a2 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:114:20
    #29 0x7f9bb274d535 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:539:16
    #30 0x7f9bb2748b0c in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:852:26
    #31 0x7f9bb27476da in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:684:15
    #32 0x7f9bb2747a35 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:462:36
    #33 0x7f9bb2750e36 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:188:37
    #34 0x7f9bb2750e36 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
    #35 0x7f9bb2766335 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1197:16
    #36 0x7f9bb276c65d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:477:10
    #37 0x7f9bb336f373 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #38 0x7f9bb3291118 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
    #39 0x7f9bb3291021 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
    #40 0x7f9bb3291021 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
    #41 0x7f9bb7896ab8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
    #42 0x7f9bb9adcd5b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:742:20
    #43 0x7f9bb3370239 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
    #44 0x7f9bb3291118 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
    #45 0x7f9bb3291021 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
    #46 0x7f9bb3291021 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
    #47 0x7f9bb9adc8b8 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:675:34
    #48 0x5621a6f58ce0 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #49 0x5621a6f58ce0 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:353:18
    #50 0x7f9bc5e89082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #51 0x5621a6f2f348 in _start (/home/worker/builds/m-c-20230125162955-fuzzing-debug/firefox-bin+0x5b348) (BuildId: 5617339602c941ce309a3995ecdae11c03e3dd67)

Flags: needinfo?(jkratzer)

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 8

•

11 months ago

Thank you. I'll close this bug with adding the testcase into the tree. Please file a new bug if you find a way to hit the assertion with new testcase.

Pulsebot

Comment 9

•

10 months ago

Pushed by masayuki@d-toybox.com:
https://hg.mozilla.org/integration/autoland/rev/c73c9ac3fe19
Add reported testcase r=m_kato

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Comment 10

•

10 months ago

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/40490 for changes under testing/web-platform/tests

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Updated

•

10 months ago

Whiteboard: [bugmon:confirmed] → [bugmon:confirmed], [wptsync upstream]

Cristian Tuns

Comment 11

•

10 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/c73c9ac3fe19

Status: ASSIGNED → RESOLVED

Closed: 10 months ago

status-firefox116: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 116 Branch

Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)

Comment 12

•

10 months ago

Upstream PR merged by moz-wptsync-bot

Ryan VanderMeulen [:RyanVM]

Updated

•

10 months ago

status-firefox114: --- → wontfix

status-firefox115: --- → wontfix

status-firefox89: affected → wontfix

status-firefox-esr102: --- → wontfix

Flags: in-testsuite? → in-testsuite+

testcase.html 3 years ago Jason Kratzer [:jkratzer] 848 bytes, text/html		Details
Bug 1706145 - Add reported testcase r=m_kato! 11 months ago Masayuki Nakano [:masayuki] (he/him)(JST, +0900) 48 bytes, text/x-phabricator-request		Details \| Review