1729525 - Crash [@ NS_ABORT_OOM]

Status: NEW

(Core :: XSLT, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev eac402936496 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build eac402936496 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

[@ NS_ABORT_OOM]

    ==274240==WARNING: AddressSanitizer failed to allocate 0x20e00000 bytes
    =================================================================
    ==274240==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7fccda612635 bp 0x7ffdcf08ae60 sp 0x7ffdcf08ae60 T0)
    ==274240==The signal is caused by a WRITE memory access.
    ==274240==Hint: address points to the zero page.
        #0 0x7fccda612635 in NS_ABORT_OOM(unsigned long) /xpcom/base/nsDebugImpl.cpp:618:3
        #1 0x7fcce20a6df5 in txMozillaXMLOutput::characters(nsTSubstring<char16_t> const&, bool) /dom/xslt/xslt/txMozillaXMLOutput.cpp:161:11
        #2 0x7fcce20995e5 in txValueOf::execute(txExecutionState&) /dom/xslt/xslt/txInstructions.cpp:781:34
        #3 0x7fcce20de1cb in txXSLTProcessor::execute(txExecutionState&) /dom/xslt/xslt/txXSLTProcessor.cpp:37:17
        #4 0x7fcce20b3839 in txMozillaXSLTProcessor::TransformToFragment(nsINode&, mozilla::dom::Document&, mozilla::ErrorResult&) /dom/xslt/xslt/txMozillaXSLTProcessor.cpp:630:10
        #5 0x7fccdf4e5aed in mozilla::dom::XSLTProcessor_Binding::transformToFragment(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/XSLTProcessorBinding.cpp:145:83
        #6 0x7fccdfbb87cf in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3300:13
        #7 0x7fcc505143a1  (<unknown module>)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /xpcom/base/nsDebugImpl.cpp:618:3 in NS_ABORT_OOM(unsigned long)
    ==274240==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Bugmon was unable to identify a testcase that reproduces this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Anne (:annevk)]

Peter, can you assess severity for this?