1840191 - Assertion failure: aTerminated || mDocument->GetReadyStateEnum() == Document::READYSTATE_LOADING (Bad readyState), at /builds/worker/checkouts/gecko/dom/base/nsContentSink.cpp:765

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Tyson Smith [:tsmith] (PTO)]

Attachment: testcase.html

Found while fuzzing m-c 20230426-169ca1394b27 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: aTerminated || mDocument->GetReadyStateEnum() == Document::READYSTATE_LOADING (Bad readyState), at /builds/worker/checkouts/gecko/dom/base/nsContentSink.cpp:765

#0 0x7fa9088066f7 in nsContentSink::DidBuildModelImpl(bool) /builds/worker/checkouts/gecko/dom/base/nsContentSink.cpp:763:3
#1 0x7fa907b63cd6 in nsHtml5TreeOpExecutor::DidBuildModel(bool) /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:187:3
#2 0x7fa907b658aa in nsHtml5TreeOpExecutor::RunFlushLoop() /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:728:7
#3 0x7fa907b6ddc5 in nsHtml5ExecutorReflusher::Run() /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:80:16
#4 0x7fa906a1a6c7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
#5 0x7fa906a12331 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:880:26
#6 0x7fa906a10cc7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:704:15
#7 0x7fa906a11125 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
#8 0x7fa906a1e5b9 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:221:37
#9 0x7fa906a1e5b9 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#10 0x7fa906a34c8a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#11 0x7fa906a3ba4d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#12 0x7fa90b6351dc in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::NotNull<mozilla::dom::BrowserChild*>, nsIOpenWindowInfo*, unsigned int, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_4>(nsTSubstring<char> const&, mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::NotNull<mozilla::dom::BrowserChild*>, nsIOpenWindowInfo*, unsigned int, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_4&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
#13 0x7fa90b632f3b in mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::NotNull<mozilla::dom::BrowserChild*>, nsIOpenWindowInfo*, unsigned int, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/ContentChild.cpp:1265:5
#14 0x7fa90b66b5b1 in mozilla::dom::BrowserChild::ProvideWindow(nsIOpenWindowInfo*, unsigned int, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:716:14
#15 0x7fa90e1c3c93 in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsIArray*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:943:24
#16 0x7fa90e1c62ed in nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsISupports*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:389:10
#17 0x7fa908482823 in nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsGlobalWindowOuter::PrintKind, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:6879:21
#18 0x7fa908486e0a in OpenNoNavigate /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5560:10
#19 0x7fa908486e0a in non-virtual thunk to nsGlobalWindowOuter::OpenNoNavigate(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp
#20 0x7fa90da6e663 in nsDocShell::PerformRetargeting(nsDocShellLoadState*) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:8596:15
#21 0x7fa90d9e1325 in nsDocShell::InternalLoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:9295:12
#22 0x7fa90da8e179 in nsDocShell::OnLinkClickSync(nsIContent*, nsDocShellLoadState*, bool, nsIPrincipal*) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:13152:17
#23 0x7fa90a5c8ae9 in mozilla::dom::HTMLFormElement::SubmitSubmission(mozilla::dom::HTMLFormSubmission*) /builds/worker/checkouts/gecko/dom/html/HTMLFormElement.cpp:842:39
#24 0x7fa90a5c6de1 in mozilla::dom::HTMLFormElement::DoSubmit(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/html/HTMLFormElement.cpp:708:10
#25 0x7fa90a5c6aaf in mozilla::dom::HTMLFormElement::Submit(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/html/HTMLFormElement.cpp:292:56
#26 0x7fa909c363c4 in mozilla::dom::HTMLFormElement_Binding::submit(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/HTMLFormElementBinding.cpp:1000:24
#27 0x7fa909d24538 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3327:13
#28 0x7fa90e48dd65 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
#29 0x7fa90e48d5bd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:12
#30 0x7fa90e4a1e32 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:652:10
#31 0x7fa90e4a1e32 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3395:16
#32 0x7fa90e48cb0d in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:458:13
#33 0x7fa90e48d5d9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:612:13
#34 0x7fa90e48ebed in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
#35 0x7fa90e57a642 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
#36 0x7fa9099ef1bb in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:65:37
#37 0x7fa90a38e3b9 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#38 0x7fa90a38d489 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:199:12
#39 0x7fa90a36bbfd in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1241:22
#40 0x7fa90a36c68e in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1427:21
#41 0x7fa90a3610e0 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:412:5
#42 0x7fa90a3610e0 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:342:17
#43 0x7fa90a36059b in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:551:16
#44 0x7fa90a362e6e in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1152:11
#45 0x7fa90a365f87 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp
#46 0x7fa908894ca9 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:1400:17
#47 0x7fa90a373462 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /builds/worker/checkouts/gecko/dom/events/EventTarget.cpp:180:13
#48 0x7fa90a318d7d in mozilla::AsyncEventDispatcher::DispatchEventOnTarget(mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::ChromeOnlyDispatch, mozilla::Composed) /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:75:3
#49 0x7fa90a319182 in mozilla::AsyncEventDispatcher::RunDOMEventWhenSafe(mozilla::dom::EventTarget&, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::ChromeOnlyDispatch, mozilla::Composed) /builds/worker/checkouts/gecko/dom/events/AsyncEventDispatcher.cpp:128:5
#50 0x7fa9085da96a in mozilla::dom::Document::SetReadyStateInternal(mozilla::dom::Document::ReadyState, bool) /builds/worker/checkouts/gecko/dom/base/Document.cpp:12214:3
#51 0x7fa908806464 in nsContentSink::DidBuildModelImpl(bool) /builds/worker/checkouts/gecko/dom/base/nsContentSink.cpp:766:14
#52 0x7fa907b63cd6 in nsHtml5TreeOpExecutor::DidBuildModel(bool) /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:187:3
#53 0x7fa907b181d6 in nsHtml5Parser::Terminate() /builds/worker/checkouts/gecko/parser/html/nsHtml5Parser.cpp:481:20
#54 0x7fa90c38dd54 in nsDocumentViewer::Stop() /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1794:16
#55 0x7fa90da0a1c0 in nsDocShell::Stop(unsigned int) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:4276:11
#56 0x7fa90da4ffd6 in non-virtual thunk to nsDocShell::Stop(unsigned int) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
#57 0x7fa90847fa1d in nsGlobalWindowOuter::StopOuter(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:4946:22
#58 0x7fa908439c99 in nsGlobalWindowInner::Stop(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:3737:3
#59 0x7fa9096dfb34 in mozilla::dom::Window_Binding::stop(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:2508:24
#60 0x7fa909d26232 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3327:13
#61 0x7fa90e48dd65 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
#62 0x7fa90e48d5bd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:12
#63 0x7fa90e4a1e32 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:652:10
#64 0x7fa90e4a1e32 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3395:16
#65 0x7fa90e48cb0d in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:458:13
#66 0x7fa90e48d5d9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:612:13
#67 0x7fa90e48ebed in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
#68 0x7fa90e57a642 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
#69 0x7fa9099ef1bb in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:65:37
#70 0x7fa90a38e3b9 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#71 0x7fa90a38d489 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:199:12
#72 0x7fa90a36bbfd in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1241:22
#73 0x7fa90a36c68e in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1427:21
#74 0x7fa90a3610e0 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:412:5
#75 0x7fa90a3610e0 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:342:17
#76 0x7fa90a36059b in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:551:16
#77 0x7fa90a362e6e in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1152:11
#78 0x7fa9088c5de7 in FocusBlurEvent::Run() /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:2741:12
#79 0x7fa9083a6695 in nsContentUtils::AddScriptRunner(already_AddRefed<nsIRunnable>) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:6050:13
#80 0x7fa9083a696a in nsContentUtils::AddScriptRunner(nsIRunnable*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:6056:3
#81 0x7fa90884e914 in nsFocusManager::FireFocusOrBlurEvent(mozilla::EventMessage, mozilla::PresShell*, nsISupports*, bool, bool, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:2884:3
#82 0x7fa90884d96a in nsFocusManager::SendFocusOrBlurEvent(mozilla::EventMessage, mozilla::PresShell*, mozilla::dom::Document*, nsISupports*, bool, bool, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:2855:3
#83 0x7fa908845e21 in nsFocusManager::Focus(nsPIDOMWindowOuter*, mozilla::dom::Element*, unsigned int, bool, bool, bool, bool, unsigned long, mozilla::Maybe<nsFocusManager::BlurredElementInfo> const&) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:2674:9
#84 0x7fa90883df1c in nsFocusManager::SetFocusInner(mozilla::dom::Element*, int, bool, bool) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:1798:5
#85 0x7fa90883ff53 in nsFocusManager::SetFocus(mozilla::dom::Element*, unsigned int) /builds/worker/checkouts/gecko/dom/base/nsFocusManager.cpp:474:3
#86 0x7fa908652748 in mozilla::dom::Element::Focus(mozilla::dom::FocusOptions const&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Element.cpp:481:16
#87 0x7fa908622d5e in mozilla::dom::Document::TryAutoFocusCandidate(mozilla::dom::Element&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:13023:13
#88 0x7fa90862260d in mozilla::dom::Document::FlushAutoFocusCandidates() /builds/worker/checkouts/gecko/dom/base/Document.cpp:13006:9
#89 0x7fa90c2cfc51 in nsRefreshDriver::FlushAutoFocusDocuments() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2165:25
#90 0x7fa90c2ce4cf in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2613:7
#91 0x7fa90c2d7a61 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:373:13
#92 0x7fa90c2d7a61 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:351:7
#93 0x7fa90c2d7960 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:5
#94 0x7fa90c2d77fd in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:911:5
#95 0x7fa90c2d6b76 in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:825:5
#96 0x7fa90c2d5ea9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:592:14
#97 0x7fa90b65c47b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#98 0x7fa90b92da2e in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:78
#99 0x7fa90b81e220 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8737:32
#100 0x7fa9076e637f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1811:25
#101 0x7fa9076e30d2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1736:9
#102 0x7fa9076e3d52 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1536:3
#103 0x7fa9076e4e9f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1634:14
#104 0x7fa906a1a6c7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
#105 0x7fa906a12331 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:880:26
#106 0x7fa906a10cc7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:704:15
#107 0x7fa906a11125 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
#108 0x7fa906a1e546 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
#109 0x7fa906a1e546 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#110 0x7fa906a34c8a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#111 0x7fa906a3ba4d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#112 0x7fa9076ec2e5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#113 0x7fa907605711 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#114 0x7fa907605711 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#115 0x7fa90bf24198 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#116 0x7fa90e24c75b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:717:20
#117 0x7fa9076ed1c6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#118 0x7fa907605711 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#119 0x7fa907605711 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#120 0x7fa90e24c02a in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:34
#121 0x5594086ab526 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#122 0x5594086ab526 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#123 0x7fa91bc29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#124 0x7fa91bc29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#125 0x5594086827c8 in _start (/home/user/workspace/browsers/m-c-20230623092529-fuzzing-debug/firefox-bin+0x587c8) (BuildId: 04f6d112bdce125b7eb5f3038130a7d797a40438)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230623092529-750c24176cc2.
The bug appears to have been introduced in the following build range:

Start: b2d97b936206d8168d56322cc387fbbc7ad9c515 (20230216043537)
End: fd7522f1263a0d073f9595b351a867516af44d5c (20230215213831)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b2d97b936206d8168d56322cc387fbbc7ad9c515&tochange=fd7522f1263a0d073f9595b351a867516af44d5c

Comment 2

[Andreas Farre [:farre]]

Imanaged to limit the regression range further to https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=b2d97b936206d8168d56322cc387fbbc7ad9c515&tochange=aad1e7be018256fa3210f82a5807a5bd5d6fece1

Sean any ideas of what's going on?

Comment 3

[Sean Feng [:sefeng]]

Attachment: Bug 1840191 - Fix a crash where nsContentSink::DidBuildModelImpl gets called with incorrect state r=#dom-core,hsivonen!

The autofocus algorithm made this noticeable because we now can run
scripts at an earlier time.

Comment 4

[Sean Feng [:sefeng]]

I made a patch to fix this, so clearing my NI.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a571cda7fb82
Fix a crash where nsContentSink::DidBuildModelImpl gets called with incorrect state r=hsivonen,dom-core

Comment 6

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/a571cda7fb82

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:sefeng, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox117 to wontfix.

For more information, please visit BugBot documentation.

Comment 8

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230818035253-a30dd2859512.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.