1784375 - Assertion failure: variants.length() == 0, at src/intl/components/src/Locale.cpp:1136

Status: VERIFIED FIXED

(Core :: Internationalization, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220810-d9acc6dde178 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: variants.length() == 0, at src/intl/components/src/Locale.cpp:1136

#0 0x7fc2ab608ca9 in mozilla::intl::LocaleParser::InternalParseBaseName(mozilla::intl::LocaleParser&, mozilla::intl::Locale&, mozilla::intl::LocaleParser::Token&) src/intl/components/src/Locale.cpp:1136:3
#1 0x7fc2ab608dec in ParseBaseName /builds/worker/workspace/obj-build/dist/include/mozilla/intl/Locale.h:683:12
#2 0x7fc2ab608dec in mozilla::intl::LocaleParser::TryParse(mozilla::Span<char const, 18446744073709551615ul>, mozilla::intl::Locale&) src/intl/components/src/Locale.cpp:1158:3
#3 0x7fc2ab5cfb22 in nsLanguageAtomService::GetUncachedLanguageGroup(nsAtom*) const src/intl/locale/nsLanguageAtomService.cpp:198:18
#4 0x7fc2ab5ceecf in operator() src/intl/locale/nsLanguageAtomService.cpp:152:12
#5 0x7fc2ab5ceecf in OrInsertWith<(lambda at src/intl/locale/nsLanguageAtomService.cpp:150:53)> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:726:23
#6 0x7fc2ab5ceecf in operator()<nsBaseHashtable<nsRefPtrHashKey<nsAtom>, nsStaticAtom *, nsStaticAtom *, nsDefaultConverter<nsStaticAtom *, nsStaticAtom *> >::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:423:26
#7 0x7fc2ab5ceecf in operator()<nsTHashtable<nsBaseHashtableET<nsRefPtrHashKey<nsAtom>, nsStaticAtom *> >::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:836:18
#8 0x7fc2ab5ceecf in operator()<PLDHashTable::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:437:18
#9 0x7fc2ab5ceecf in WithEntryHandle<(lambda at /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:436:9)> /builds/worker/workspace/obj-build/dist/include/PLDHashTable.h:603:12
#10 0x7fc2ab5ceecf in WithEntryHandle<(lambda at /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:835:15)> /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:434:25
#11 0x7fc2ab5ceecf in WithEntryHandle<(lambda at /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:422:34)> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:834:18
#12 0x7fc2ab5ceecf in LookupOrInsertWith<(lambda at src/intl/locale/nsLanguageAtomService.cpp:150:53)> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:422:12
#13 0x7fc2ab5ceecf in nsLanguageAtomService::GetLanguageGroup(nsAtom*, bool*) src/intl/locale/nsLanguageAtomService.cpp:150:23
#14 0x7fc2b0652a2a in GetLangGroup src/layout/base/StaticPresData.cpp:205:21
#15 0x7fc2b0652a2a in mozilla::StaticPresData::GetFontPrefsForLang(nsAtom*, bool*) src/layout/base/StaticPresData.cpp:222:33
#16 0x7fc2b05ba860 in nsStyleFont::nsStyleFont(mozilla::dom::Document const&) src/layout/style/nsStyleStruct.cpp:248:19
#17 0x7fc2b58745f6 in style::gecko_properties::_$LT$impl$u20$style..gecko_bindings..structs..root..mozilla..GeckoFont$GT$::default::h15b506dd348c0124 /builds/worker/workspace/obj-build/x86_64-unknown-linux-gnu/debug/build/style-d155a5235005b8d8/out/gecko_properties.rs:17964:13
#18 0x7fc2b58745f6 in style::gecko_properties::ComputedValues::default_values::hd67473d32c7c03d9 /builds/worker/workspace/obj-build/x86_64-unknown-linux-gnu/debug/build/style-d155a5235005b8d8/out/gecko_properties.rs:315:13
#19 0x7fc2b55a5bf0 in style::gecko::media_queries::Device::reset_computed_values::hd2c9dd31b2af864d src/servo/components/style/gecko/media_queries.rs:200:31
#20 0x7fc2b55a5bf0 in style::gecko::media_queries::Device::rebuild_cached_data::hc3a56a997c7673a0 src/servo/components/style/gecko/media_queries.rs:205:9
#21 0x7fc2b52f299c in Servo_StyleSet_RebuildCachedData src/servo/ports/geckolib/glue.rs:4301:5
#22 0x7fc2b058f659 in mozilla::ServoStyleSet::ClearCachedStyleData() src/layout/style/ServoStyleSet.cpp:1121:3
#23 0x7fc2b0640997 in mozilla::RestyleManager::RebuildAllStyleData(nsChangeHint, mozilla::StyleRestyleHint) src/layout/base/RestyleManager.cpp:2338:17
#24 0x7fc2ace7fd04 in mozilla::dom::Document::SetHeaderData(nsAtom*, nsTSubstring<char16_t> const&) src/dom/base/Document.cpp:6704:20
#25 0x7fc2ace9fb18 in mozilla::dom::Document::ProcessMETATag(mozilla::dom::HTMLMetaElement*) src/dom/base/Document.cpp:10927:7
#26 0x7fc2aec5caf4 in mozilla::dom::HTMLMetaElement::BindToTree(mozilla::dom::BindContext&, nsINode&) src/dom/html/HTMLMetaElement.cpp:87:9
#27 0x7fc2ad10e2fc in nsINode::InsertChildBefore(nsIContent*, nsIContent*, bool, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:1579:15
#28 0x7fc2ac4e3848 in AppendChildTo /builds/worker/workspace/obj-build/dist/include/nsINode.h:900:5
#29 0x7fc2ac4e3848 in nsHtml5TreeOperation::Append(nsIContent*, nsIContent*, nsHtml5DocumentBuilder*) src/parser/html/nsHtml5TreeOperation.cpp:251:12
#30 0x7fc2ac4da467 in nsHtml5TreeOperation::Append(nsIContent*, nsIContent*, mozilla::dom::FromParser, nsHtml5DocumentBuilder*) src/parser/html/nsHtml5TreeOperation.cpp:268:17
#31 0x7fc2ac4df42d in operator() src/parser/html/nsHtml5TreeOperation.cpp:796:14
#32 0x7fc2ac4df42d in match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opUpdateCharsetSource, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:266:16
#33 0x7fc2ac4df42d in match<TreeOperationMatcher, mozilla::Variant<uninitialized, opAppend, opDetach, opAppendChildrenToNewParent, opFosterParent, opAppendToDocument, opAddAttributes, nsHtml5DocumentMode, opCreateHTMLElement, opCreateSVGElement, opCreateMathMLElement, opSetFormElement, opAppendText, opFosterParentText, opAppendComment, opAppendCommentToDocument, opAppendDoctypeToDocument, opGetDocumentFragmentForTemplate, opGetFosterParent, opMarkAsBroken, opRunScript, opRunScriptAsyncDefer, opPreventScriptExecution, opDoneAddingChildren, opDoneCreatingElement, opUpdateCharsetSource, opCharsetSwitchTo, opUpdateStyleSheet, opProcessOfflineManifest, opMarkMalformedIfScript, opStreamEnded, opSetStyleLineNumber, opSetScriptLineNumberAndFreeze, opSvgLoad, opMaybeComplainAboutCharset, opMaybeComplainAboutDeepTree, opAddClass, opAddViewSourceHref, opAddViewSourceBase, opAddErrorType, opAddLineNumberId, opStartLayout, opEnableEncodingMenu> &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14
#34 0x7fc2ac4df42d in match<TreeOperationMatcher> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:852:12
#35 0x7fc2ac4df42d in nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor*, nsIContent**, bool*, bool*) src/parser/html/nsHtml5TreeOperation.cpp:1207:21
#36 0x7fc2ac4debc4 in nsHtml5TreeOpExecutor::RunFlushLoop() src/parser/html/nsHtml5TreeOpExecutor.cpp:686:19
#37 0x7fc2ac4e65d1 in nsHtml5ExecutorReflusher::Run() src/parser/html/nsHtml5TreeOpExecutor.cpp:79:16
#38 0x7fc2ab4b92b2 in mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:140:20
#39 0x7fc2ab4eafee in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:538:16
#40 0x7fc2ab4c3699 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:851:26
#41 0x7fc2ab4c2223 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:683:15
#42 0x7fc2ab4c2493 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:461:36
#43 0x7fc2ab4ee846 in operator() src/xpcom/threads/TaskController.cpp:187:37
#44 0x7fc2ab4ee846 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#45 0x7fc2ab4d815f in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1205:16
#46 0x7fc2ab4de76d in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:465:10
#47 0x7fc2ac0b3806 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
#48 0x7fc2abfd8ee7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:381:10
#49 0x7fc2abfd8df2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:374:3
#50 0x7fc2abfd8df2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:356:3
#51 0x7fc2b02b0ca8 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:150:27
#52 0x7fc2b23c37ab in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:893:20
#53 0x7fc2ac0b46fa in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
#54 0x7fc2abfd8ee7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:381:10
#55 0x7fc2abfd8df2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:374:3
#56 0x7fc2abfd8df2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:356:3
#57 0x7fc2b23c2cc3 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:752:34
#58 0x55a3cc54c429 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#59 0x55a3cc54c429 in main src/browser/app/nsBrowserApp.cpp:362:18
#60 0x7fc2c1c65082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#61 0x55a3cc5221cc in _start (/home/worker/builds/m-c-20220810212956-fuzzing-debug/firefox-bin+0x161cc) (BuildId: 2c6a0db38d07a9173a196017cc6eaab91847f54b)

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/Chg7fVC0SjlRgfOLev94-Q/index.html

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220811094015-7169b8faa7e1.
The bug appears to have been introduced in the following build range:

Start: 3d5f318264fe441b039f3bc4fd1f2c41873d16a8 (20220302164031)
End: 3079bbbfc4cba8ff4a069fa8d1a4470af492cdf4 (20220302141241)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3d5f318264fe441b039f3bc4fd1f2c41873d16a8&tochange=3079bbbfc4cba8ff4a069fa8d1a4470af492cdf4

Comment 3

[André Bargull [:anba]]

Attachment: Bug 1784375: Call LocaleParser::TryParse() with a new, empty Locale. r=#platform-i18n-reviewers!

For this to work, we need to add a move-constructor to Locale, so that it's
possible to write loc = {}. (We need move instead of copy semantics, because
Locale has UniquePtr members.) All other Locale members except for
LanguageTagSubtag already support move semantics. Add copy-constructors to
LanguageTagSubtag, so defaulted move-constructor/assignment works for Locale.
LanguageTagSubtag gets copy- instead of move-constructors, because there isn't
a good reason to disallow copying when moving is allowed.

Also add extra assertions and comments to document the requirement that TryParse
expects a new, empty Locale.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

:anba, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1757578

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b35abe0d09b3
Call LocaleParser::TryParse() with a new, empty Locale. r=platform-i18n-reviewers,dminor

Comment 7

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/b35abe0d09b3

Comment 8

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220815214739-1c3c5be93f58.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:anba, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox104 to wontfix.

For more information, please visit auto_nag documentation.