1752668 - crash near null in [@ mozilla::HTMLEditUtils::IsEmptyNode]

Status: VERIFIED FIXED

(Core :: DOM: Editor, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220121-00753e705770 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --xvfb

==8247==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x7f35e9a9f318 bp 0x7fff1c42ac70 sp 0x7fff1c42ac70 T0)
==8247==The signal is caused by a READ memory access.
==8247==Hint: address points to the zero page.
    #0 0x7f35e9a9f318 in get /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27
    #1 0x7f35e9a9f318 in operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:316:12
    #2 0x7f35e9a9f318 in nsINode::NodeType() const /builds/worker/workspace/obj-build/dist/include/nsINode.h:738:38
    #3 0x7f35ef75b351 in IsText /builds/worker/workspace/obj-build/dist/include/nsINode.h:555:25
    #4 0x7f35ef75b351 in FromNode<nsINode> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Text.h:19:3
    #5 0x7f35ef75b351 in FromNode<nsINode> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Text.h:19:3
    #6 0x7f35ef75b351 in mozilla::HTMLEditUtils::IsEmptyNode(nsPresContext*, nsINode const&, mozilla::EnumSet<mozilla::HTMLEditUtils::EmptyCheckOption, unsigned int> const&, bool*) /gecko/editor/libeditor/HTMLEditUtils.cpp:584:26
    #7 0x7f35ef740469 in IsEmptyNode /gecko/editor/libeditor/HTMLEditUtils.h:434:12
    #8 0x7f35ef740469 in mozilla::HTMLEditor::ClearStyleAt(mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&, nsAtom*, nsAtom*, mozilla::SpecifiedStyle) /gecko/editor/libeditor/HTMLStyleEditor.cpp:973:7
    #9 0x7f35ef7101e9 in mozilla::HTMLEditor::CreateStyleForInsertText(mozilla::dom::AbstractRange const&) /gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:5069:11
    #10 0x7f35ef70e984 in mozilla::HTMLEditor::HandleInsertText(mozilla::EditSubAction, nsTSubstring<char16_t> const&, mozilla::EditorBase::SelectionHandling) /gecko/editor/libeditor/HTMLEditSubActionHandler.cpp:1064:8
    #11 0x7f35ef6be576 in mozilla::EditorBase::InsertTextAsSubAction(nsTSubstring<char16_t> const&, mozilla::EditorBase::SelectionHandling) /gecko/editor/libeditor/EditorBase.cpp:5970:7
    #12 0x7f35ef6d6d41 in mozilla::EditorBase::InsertTextAsAction(nsTSubstring<char16_t> const&, nsIPrincipal*) /gecko/editor/libeditor/EditorBase.cpp:5933:8
    #13 0x7f35ef6dd732 in mozilla::InsertPlaintextCommand::DoCommandParam(mozilla::Command, nsTSubstring<char16_t> const&, mozilla::EditorBase&, nsIPrincipal*) const /gecko/editor/libeditor/EditorCommands.cpp:852:19
    #14 0x7f35eaa03eb4 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /gecko/dom/base/Document.cpp:5437:27
    #15 0x7f35ec3f58bc in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/DocumentBinding.cpp:3772:36
    #16 0x7f35ec8a225d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3306:13
    #17 0x7f35f44c6c14 in CallJSNative /gecko/js/src/vm/Interpreter.cpp:425:13
    #18 0x7f35f44c6c14 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:512:12
    #19 0x7f35f44b30de in CallFromStack /gecko/js/src/vm/Interpreter.cpp:576:10
    #20 0x7f35f44b30de in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3309:16
    #21 0x7f35f4497ee1 in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:394:13
    #22 0x7f35f44c6d4f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:544:13
    #23 0x7f35f44c8e9b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:589:8
    #24 0x7f35f4747acd in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/CallAndConstruct.cpp:117:10
    #25 0x7f35ec4be2ef in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:283:37
    #26 0x7f35ed1b8423 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:365:12
    #27 0x7f35ed1b6954 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /gecko/dom/events/JSEventHandler.cpp:201:12
    #28 0x7f35ed17db28 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /gecko/dom/events/EventListenerManager.cpp:1314:22
    #29 0x7f35ed17f13c in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /gecko/dom/events/EventListenerManager.cpp:1505:17
    #30 0x7f35ed16d20e in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:348:17
    #31 0x7f35ed16ba1d in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:550:16
    #32 0x7f35ed16fc95 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /gecko/dom/events/EventDispatcher.cpp:1085:11
    #33 0x7f35efb35af7 in nsDocumentViewer::LoadComplete(nsresult) /gecko/layout/base/nsDocumentViewer.cpp:1086:7
    #34 0x7f35f3578083 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /gecko/docshell/base/nsDocShell.cpp:6278:20
    #35 0x7f35f357737b in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp:5667:7
    #36 0x7f35f357934f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp
    #37 0x7f35e9809f90 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:1377:3
    #38 0x7f35e9808ba4 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:975:14
    #39 0x7f35e98053d2 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /gecko/uriloader/base/nsDocLoader.cpp:794:9
    #40 0x7f35e9807595 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:677:5
    #41 0x7f35f35b18bb in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /gecko/docshell/base/nsDocShell.cpp:13540:23
    #42 0x7f35e751d66e in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:614:22
    #43 0x7f35e75200b3 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:518:10
    #44 0x7f35eaa47342 in mozilla::dom::Document::DoUnblockOnload() /gecko/dom/base/Document.cpp:11554:18
    #45 0x7f35ea9f4747 in mozilla::dom::Document::UnblockOnload(bool) /gecko/dom/base/Document.cpp:11484:9
    #46 0x7f35eaa1f0fc in mozilla::dom::Document::DispatchContentLoadedEvents() /gecko/dom/base/Document.cpp:7999:3
    #47 0x7f35eab0ef2d in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1147:12
    #48 0x7f35eab0ef2d in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1153:12
    #49 0x7f35eab0ef2d in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1200:13
    #50 0x7f35e718191f in mozilla::SchedulerGroup::Runnable::Run() /gecko/xpcom/threads/SchedulerGroup.cpp:144:20
    #51 0x7f35e71cf4b2 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:467:16
    #52 0x7f35e7194dad in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:770:26
    #53 0x7f35e7192308 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:606:15
    #54 0x7f35e7192a19 in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:390:36
    #55 0x7f35e71d78b1 in operator() /gecko/xpcom/threads/TaskController.cpp:124:37
    #56 0x7f35e71d78b1 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /gecko/xpcom/threads/nsThreadUtils.h:531:5
    #57 0x7f35e71b50a7 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1195:16
    #58 0x7f35e71c028c in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:467:10
    #59 0x7f35e86d630f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:85:21
    #60 0x7f35e8556021 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #61 0x7f35e8556021 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #62 0x7f35e8556021 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #63 0x7f35ef4b9b37 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
    #64 0x7f35f41e489f in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:870:20
    #65 0x7f35e8556021 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #66 0x7f35e8556021 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #67 0x7f35e8556021 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #68 0x7f35f41e3ad3 in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:707:34
    #69 0x55d7457c80ad in content_process_main(mozilla::Bootstrap*, int, char**) /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #70 0x55d7457c84d8 in main /gecko/browser/app/nsBrowserApp.cpp:327:18
    #71 0x7f360b9690b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #72 0x55d745717179 in _start (/home/worker/builds/m-c-20220121214138-fuzzing-asan-opt/firefox+0x5d179)

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220130093554-12ecc19b4b60.
The bug appears to have been introduced in the following build range:

Start: 77e540295ce542e22373507a92e52d70c9947f88 (20211124035313)
End: 6cb77e9e9cf5e82d1083f751dc5255a634359e9c (20211124030523)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=77e540295ce542e22373507a92e52d70c9947f88&tochange=6cb77e9e9cf5e82d1083f751dc5255a634359e9c

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1752668 - Restore null-check in `HTMLEditor::ClearStyleAt` r=m_kato!

I don't remember why I removed the null-check in
https://phabricator.services.mozilla.com/D131748#change-Q0aewmYc3vaK

Restoring the null-check should be fine.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1740858

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/712bef3646ff
Restore null-check in `HTMLEditor::ClearStyleAt` r=m_kato

Comment 5

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/32621 for changes under testing/web-platform/tests

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/712bef3646ff

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 8

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Comment on attachment 9261462 [details]
Bug 1752668 - Restore null-check in HTMLEditor::ClearStyleAt r=m_kato!

Beta/Release Uplift Approval Request

• User impact if declined: Users may meet crash when they insert text with different style in some richtext editors.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This patch just restores a null-check which was accidentally removed.
• String changes made/needed:

Comment 9

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Comment on attachment 9261462 [details]
Bug 1752668 - Restore null-check in HTMLEditor::ClearStyleAt r=m_kato!

Oops, the version of Nightly has not been bumped. I meant the previous request was to land into 98. So that we don't need to uplift it unless we'd get too may crash reports.

Comment 10

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220131212843-788ab1920ef8.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.