crash near null in [@ mozilla::dom::Document::GetRootElement] (print preview)
Categories
(Core :: DOM: Core & HTML, defect)
Tracking
()
People
(Reporter: tsmith, Assigned: emilio)
References
(Blocks 1 open bug)
Details
(Keywords: crash, testcase)
Attachments
(2 files)
Found while fuzzing m-c 20210613-f531f12e5c35 (--enable-address-sanitizer --enable-fuzzing)
==11910==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000001e0 (pc 0x7f7f4cbe25db bp 0x7fff398888b0 sp 0x7fff398888b0 T0)
==11910==The signal is caused by a READ memory access.
==11910==Hint: address points to the zero page.
#0 0x7f7f4cbe25db in mozilla::dom::Document::GetRootElement() const /gecko/dom/base/Document.cpp:6928:11
#1 0x7f7f517abfac in nsPresContext::Init(nsDeviceContext*) /gecko/layout/base/nsPresContext.cpp:646:30
#2 0x7f7f5173a121 in nsDocumentViewer::SetPrintSettingsForSubdocument(nsIPrintSettings*) /gecko/layout/base/nsDocumentViewer.cpp:3526:24
#3 0x7f7f5088434f in mozilla::dom::BrowserChild::RecvCloneDocumentTreeIntoSelf(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, mozilla::embedding::PrintData const&) /gecko/dom/ipc/BrowserChild.cpp:1096:12
#4 0x7f7f4b55dbee in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBrowserChild.cpp:4135:56
#5 0x7f7f4abd23cb in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8322:32
#6 0x7f7f4a94541a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /gecko/ipc/glue/MessageChannel.cpp:2155:25
#7 0x7f7f4a941b48 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /gecko/ipc/glue/MessageChannel.cpp:2079:9
#8 0x7f7f4a9434a5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /gecko/ipc/glue/MessageChannel.cpp:1924:3
#9 0x7f7f4a94400b in mozilla::ipc::MessageChannel::MessageTask::Run() /gecko/ipc/glue/MessageChannel.cpp:1955:13
#10 0x7f7f49769592 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:479:16
#11 0x7f7f49736200 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:782:26
#12 0x7f7f49733a48 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:618:15
#13 0x7f7f4973415d in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:402:36
#14 0x7f7f49773604 in operator() /gecko/xpcom/threads/TaskController.cpp:138:37
#15 0x7f7f49773604 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /gecko/xpcom/threads/nsThreadUtils.h:534:5
#16 0x7f7f49750978 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1159:16
#17 0x7f7f4975b6bc in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:548:10
#18 0x7f7f4a94cb94 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:107:5
#19 0x7f7f4a854031 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:335:10
#20 0x7f7f4a854031 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:328:3
#21 0x7f7f4a854031 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:310:3
#22 0x7f7f51111037 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
#23 0x7f7f5537e6af in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:910:20
#24 0x7f7f4a854031 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:335:10
#25 0x7f7f4a854031 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:328:3
#26 0x7f7f4a854031 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:310:3
#27 0x7f7f5537e088 in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:742:34
#28 0x5557196cf74d in content_process_main(mozilla::Bootstrap*, int, char**) /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#29 0x5557196cfb7d in main /gecko/browser/app/nsBrowserApp.cpp:313:18
#30 0x7f7f6b16f0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#31 0x555719620a49 in _start (/home/worker/builds/m-c-20210613214113-fuzzing-asan-opt/firefox+0x5ba49)
Reporter | ||
Comment 1•3 years ago
|
||
A Pernosco session is available here: https://pernos.co/debug/vBAj1QMOyaoDIb3C7G77VA/index.html
Comment 2•3 years ago
|
||
Bugmon Analysis
Unable to reproduce bug using build mozilla-central 20210613214113-f531f12e5c35. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Comment 3•3 years ago
|
||
Hi Emilio, the test is about print preview, so I bring it to your radar.
Assignee | ||
Comment 4•3 years ago
|
||
nsDocumentViewer::mDocument ends up null because Destroy() is called
as a result of nsGlobalWindowOuter::SetNewDocument failing because of
the AncestorsAreCurrent check:
https://searchfox.org/mozilla-central/rev/d6188c9ce02efeea309e7177fc14c9eb2f09db37/dom/base/Document.cpp#13026-13030
https://searchfox.org/mozilla-central/rev/d6188c9ce02efeea309e7177fc14c9eb2f09db37/layout/base/nsDocumentViewer.cpp#1888
https://searchfox.org/mozilla-central/rev/d6188c9ce02efeea309e7177fc14c9eb2f09db37/dom/base/nsGlobalWindowOuter.cpp#2089-2091
Just bail out if we don't have a document when creating the print
presentation, as that presentation won't be shown either way.
Updated•3 years ago
|
Assignee | ||
Updated•3 years ago
|
Comment 6•3 years ago
|
||
bugherder |
Updated•3 years ago
|
Comment 7•2 years ago
|
||
:emilio, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.
Assignee | ||
Updated•2 years ago
|
Description
•