1923214 - Assertion failure: ((aNodeType == nsINode::TEXT_NODE) == (aName == nsGkAtoms::textTagName)) ... (Wrong localName for nodeType), at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/NodeInfoInlines.h:99

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20241007-4bdfb2c22e6e (--enable-debug --enable-fuzzing)

This was found by visiting a live website with a debug build.

A Pernosco session is available here: https://pernos.co/debug/3U_utYQOmeoSOor8wFzSHg/index.html

STR:

• Launch browser and visit site

This issue was triggered by visiting http://sberbank-tele.com/.

Assertion failure: ((aNodeType == nsINode::TEXT_NODE) == (aName == nsGkAtoms::textTagName)) && ((aNodeType == nsINode::CDATA_SECTION_NODE) == (aName == nsGkAtoms::cdataTagName)) && ((aNodeType == nsINode::COMMENT_NODE) == (aName == nsGkAtoms::commentTagName)) && ((aNodeType == nsINode::DOCUMENT_NODE) == (aName == nsGkAtoms::documentNodeName)) && ((aNodeType == nsINode::DOCUMENT_FRAGMENT_NODE) == (aName == nsGkAtoms::documentFragmentNodeName)) && ((aNodeType == nsINode::DOCUMENT_TYPE_NODE) == (aName == nsGkAtoms::documentTypeNodeName)) && ((aNodeType == nsINode::PROCESSING_INSTRUCTION_NODE) == (aName == nsGkAtoms::processingInstructionTagName)) (Wrong localName for nodeType), at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/NodeInfoInlines.h:99

#0 0xe0199a9a in CheckValidNodeInfo(unsigned short, nsAtom const*, int, nsAtom const*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/NodeInfoInlines.h:85:3
#1 0xe032b47a in nsNodeInfoManager::GetNodeInfo(nsAtom*, nsAtom*, int, unsigned short, nsAtom*) /builds/worker/checkouts/gecko/dom/base/nsNodeInfoManager.cpp:125:3
#2 0xe02904f1 in nsDOMAttributeMap::IndexedGetter(unsigned int, bool&) /builds/worker/checkouts/gecko/dom/base/nsDOMAttributeMap.cpp:305:48
#3 0xe068b242 in mozilla::dom::NamedNodeMap_Binding::DOMProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) const /builds/worker/workspace/obj-build/dom/bindings/./NamedNodeMapBinding.cpp:815:73
#4 0xe4fc4894 in js::Proxy::getInternal(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:526:19
#5 0xe4fc511e in js::ProxyGetPropertyByValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/proxy/Proxy.cpp:551:10
#6 0x3b71dd42  ([anon:js-executable-memory])

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:masayuki, could you have a look please?

For more information, please visit BugBot documentation.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

aNodeType is 2 which means an attribute node. Then, any names should be fine. However, if the name is same as one of nsGkAtoms::textTagName, nsGkAtoms::cdataTagName, nsGkAtoms::commentTagName, nsGkAtoms::documentNodeName, nsGkAtoms::documentFragmentNodeName, nsGkAtoms::documentTypeNodeName, nsGkAtoms::processingInstructionTagName, the assertion fails due to aNodeType is fixed.

I think that each condition should be separated to a MOZ_ASSERT_IF like:

MOZ_ASSERT_IF(aNodeType == nsINode::*_NODE, aName == nsGkAtoms::*);

(I don't know how to check the nsGkAtoms value in Pernosco.)

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

I guess this is the cause:

<template #text>
  <sbt-button size="l" variant="white" href="#tariffs">Оформить сим-карту</sbt-button>
</template>