1908378 - Assertion failure: !AreNormalAndCrossShadowBoundaryRangesCollapsed(), at /dom/base/Selection.cpp:2803

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 9abfb7fcb613 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 9abfb7fcb613 --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !AreNormalAndCrossShadowBoundaryRangesCollapsed(), at /dom/base/Selection.cpp:2803

    ==861173==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7b8cadfd6ef2 bp 0x7ffdd20c6160 sp 0x7ffdd20c6140 T861173)
    ==861173==The signal is caused by a WRITE memory access.
    ==861173==Hint: address points to the zero page.
        #0 0x7b8cadfd6ef2 in mozilla::dom::Selection::GetDirection(nsTSubstring<char16_t>&) const /dom/base/Selection.cpp:2803:5
        #1 0x7b8cae81fd3c in mozilla::dom::Selection_Binding::get_direction(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./SelectionBinding.cpp:324:24
        #2 0x7b8caf0a0acc in bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3150:13
        #3 0x7b8cb242d6c4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:491:13
        #4 0x7b8cb242ceaf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:585:12
        #5 0x7b8cb242e4af in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:684:8
        #6 0x7b8cb242f613 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:806:10
        #7 0x7b8cb2680ea4 in CallGetter /js/src/vm/NativeObject.cpp:2143:12
        #8 0x7b8cb2680ea4 in bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, js::PropertyInfoBase<unsigned int>, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /js/src/vm/NativeObject.cpp:2171:12
        #9 0x7b8cb2681727 in bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /js/src/vm/NativeObject.cpp:2319:14
        #10 0x7b8cb23c14eb in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) /js/src/vm/ObjectOperations-inl.h:124:10
        #11 0x7b8cb2454118 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:4807:10
        #12 0x7b8cb2ee82a1 in js::jit::DoGetPropFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, JS::MutableHandle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1291:8
        #13 0x364b14f19a4a  ([anon:js-executable-memory]+0xca4a)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/base/Selection.cpp:2803:5 in mozilla::dom::Selection::GetDirection(nsTSubstring<char16_t>&) const
    ==861173==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240717153113-7aa82d756333.
The bug appears to have been introduced in the following build range:

Start: ba88bf442c827bc84857e2353c9b58a16f1e7f99 (20240528183401)
End: 5b0b8114258165e3f07b6de78afd11996023a4e7 (20240528200432)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=ba88bf442c827bc84857e2353c9b58a16f1e7f99&tochange=5b0b8114258165e3f07b6de78afd11996023a4e7

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1899020

:sefeng, since you are the author of the regressor, bug 1899020, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Sean Feng [:sefeng211]]

This was an edge case where the selection got collapsed into a single point due to DOM mutation, I'll need to think a bit more for this.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1899020

Comment 6

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 7

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 8

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20240717091155-9abfb7fcb613) but not with tip (mozilla-central 20241026092643-d37bf17b084b.)

Unable to bisect testcase (End build crashes!):

Start: 9abfb7fcb61359f585c74dc63165a5b3e6feeb23 (20240717091155)
End: d37bf17b084b8ea4444e9083d2acda66987f8ae7 (20241026092643)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 9

[Sean Feng [:sefeng211]]

Perhaps bug 1972096 can fix this?

Clear my NI given I won't be able to work on this