Closed Bug 1952317 Opened 1 year ago Closed 1 year ago

Assertion failure: rangeToDelete.EndRef().EqualsOrIsBefore( replaceRangeDataAtEnd.EndRef()), at /editor/libeditor/WhiteSpaceVisibilityKeeper.cpp:1779

Categories

(Core :: DOM: Editor, defect)

Product:
Core
Component:
DOM: Editor
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
142 Branch
Tracking Flags:
Tracking Status
firefox142 --- fixed

People

(Reporter: jkratzer, Assigned: masayuki)

References

(Blocks 1 open bug)

Details

(Keywords: testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files, 1 external file)

Detailed Crash Information
12.12 KB, text/plain
Details
Testcase
321 bytes, text/plain
Details

Testcase found while fuzzing mozilla-central rev 29ca7ddfb776 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 29ca7ddfb776 --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: rangeToDelete.EndRef().EqualsOrIsBefore( replaceRangeDataAtEnd.EndRef()), at /editor/libeditor/WhiteSpaceVisibilityKeeper.cpp:1779

    ==159729==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x775275224823 bp 0x7ffef9d7c180 sp 0x7ffef9d7ba40 T159729)
    ==159729==The signal is caused by a WRITE memory access.
    ==159729==Hint: address points to the zero page.
        #0 0x775275224823 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:267:3
        #1 0x775275224823 in mozilla::WhiteSpaceVisibilityKeeper::MakeSureToKeepVisibleStateOfWhiteSpacesAroundDeletingRange(mozilla::HTMLEditor&, mozilla::EditorDOMRangeBase<mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>>> const&, mozilla::dom::Element const&) /editor/libeditor/WhiteSpaceVisibilityKeeper.cpp:1778:5
        #2 0x775275187375 in mozilla::WhiteSpaceVisibilityKeeper::PrepareToDeleteRange(mozilla::HTMLEditor&, mozilla::EditorDOMRangeBase<mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>>> const&, mozilla::dom::Element const&) /editor/libeditor/WhiteSpaceVisibilityKeeper.h:110:9
        #3 0x775275173688 in mozilla::HTMLEditor::AutoDeleteRangesHandler::HandleDeleteNonCollapsedRanges(mozilla::HTMLEditor&, short, short, mozilla::AutoClonedSelectionRangeArray&, mozilla::HTMLEditor::AutoDeleteRangesHandler::SelectionWasCollapsed, mozilla::dom::Element const&) /editor/libeditor/HTMLEditorDeleteHandler.cpp:4052:11
        #4 0x77527516b490 in mozilla::HTMLEditor::AutoDeleteRangesHandler::Run(mozilla::HTMLEditor&, short, short, mozilla::AutoClonedSelectionRangeArray&, mozilla::dom::Element const&) /editor/libeditor/HTMLEditorDeleteHandler.cpp:1929:47
        #5 0x77527516aa5a in mozilla::HTMLEditor::HandleDeleteSelection(short, short) /editor/libeditor/HTMLEditorDeleteHandler.cpp:1260:61
        #6 0x775275090644 in mozilla::EditorBase::DeleteSelectionAsSubAction(short, short) /editor/libeditor/EditorBase.cpp:4764:9
        #7 0x77527508a4ee in mozilla::EditorBase::DeleteSelectionAsAction(short, short, nsIPrincipal*) /editor/libeditor/EditorBase.cpp:4727:8
        #8 0x7752750ac0f8 in mozilla::DeleteCommand::DoCommand(mozilla::Command, mozilla::EditorBase&, nsIPrincipal*) const /editor/libeditor/EditorCommands.cpp:626:29
        #9 0x77527158316c in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, mozilla::dom::TrustedHTMLOrString const&, nsIPrincipal&, mozilla::ErrorResult&) /dom/base/Document.cpp:5648:37
        #10 0x775272666210 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./DocumentBinding.cpp:4164:36
        #11 0x77527293ed9d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3302:13
        #12 0x7752760b3254 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:493:13
        #13 0x7752760b2aaf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:589:12
        #14 0x7752760c669a in CallFromStack /js/src/vm/Interpreter.cpp:661:10
        #15 0x7752760c669a in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3265:16
        #16 0x7752760b20f1 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:463:13
        #17 0x7752760b2ad5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:621:13
        #18 0x7752760b3efb in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:688:8
        #19 0x775276187c5b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #20 0x775272647b3a in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
        #21 0x7752731fac66 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #22 0x7752731fa652 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1356:43
        #23 0x7752731fb919 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1679:12
        #24 0x7752731fb181 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1576:35
        #25 0x7752731ef6be in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:466:5
        #26 0x7752731ef6be in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:365:17
        #27 0x7752731eed8c in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:606:16
        #28 0x7752731f145d in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1221:11
        #29 0x7752753ce0de in nsDocumentViewer::LoadComplete(nsresult) /layout/base/nsDocumentViewer.cpp:1030:7
        #30 0x775275826863 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /docshell/base/nsDocShell.cpp:6250:13
        #31 0x775275825dc8 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp:5637:7
        #32 0x775275827762 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp
        #33 0x77527059a899 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /uriloader/base/nsDocLoader.cpp:1425:3
        #34 0x77527059a052 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:961:14
        #35 0x7752705983e1 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:783:9
        #36 0x775270599549 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:666:5
        #37 0x77527585aebf in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:13844:23
        #38 0x77526f97d49f in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:636:22
        #39 0x77526f97e626 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:532:10
        #40 0x7752715b206c in mozilla::dom::Document::DoUnblockOnload() /dom/base/Document.cpp:12142:18
        #41 0x775271598a4c in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8454:3
        #42 0x7752716588c5 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #43 0x7752716588c5 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #44 0x7752716588c5 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #45 0x7752716588c5 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #46 0x7752716588c5 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #47 0x7752716588c5 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #48 0x7752716588c5 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #49 0x77526f74be57 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:703:16
        #50 0x77526f74532e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1250:20
        #51 0x77526f744067 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1073:15
        #52 0x77526f7444e5 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:639:36
        #53 0x77526f752f26 in operator() /xpcom/threads/TaskController.cpp:333:37
        #54 0x77526f752f26 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #55 0x77526f764f83 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1159:16
        #56 0x77526f76b5af in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #57 0x7752702c96c7 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #58 0x7752702241e1 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #59 0x7752702241e1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #60 0x775274f681b8 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #61 0x77527502a5f4 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:470:33
        #62 0x775275f1a73b in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:646:20
        #63 0x7752702ca574 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #64 0x7752702241e1 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #65 0x7752702241e1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #66 0x775275f19b79 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:584:34
        #67 0x5b5b4c7681de in main /browser/app/nsBrowserApp.cpp:397:22
        #68 0x77527f81a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #69 0x77527f81a28a in __libc_start_main csu/../csu/libc-start.c:360:3
        #70 0x5b5b4c73ba48 in _start (/home/jkratzer/builds/m-c-20250306092841-fuzzing-debug/firefox-bin+0x5da48) (BuildId: 395562403624ed8bc6460ae01e7788791389e9f1)
    
    ==159729==Register values:
    rax = 0x0000000000000000  rbx = 0x00007ffef9d7c220  rcx = 0x00000000000006f3  rdx = 0x000077527f9f4563  
    rdi = 0x000077527f9f5700  rsi = 0x0000000000000000  rbp = 0x00007ffef9d7c180  rsp = 0x00007ffef9d7ba40  
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000000  r11 = 0x0000000000000293  
    r12 = 0x00007ffef9d7c130  r13 = 0x00007ffef9d7c270  r14 = 0x00005b5b6804f8b0  r15 = 0x00007ffef9d7bd90  
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:267:3 in MOZ_CrashSequence
    ==159729==ABORTING
Attached file Testcase —

Verified bug as reproducible on mozilla-central 20250306213030-deee0cffec33.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: ac5529a784bdd0522e58c4bcdb3293674601ac52 (20240308044528)
End: 29ca7ddfb7762e3b16be4961eff0e7b5b2755dd9 (20250306092841)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

This detects a bug of current white-space normalizer which replaces white-spaces shorter than deleting range. So, it may cause odd result for users, but not serious. Additionally, the white-space normalizer will be retired.

Severity: -- → S4
Depends on: 1951832

Testcase crashes using the initial build (mozilla-central 20250306092841-29ca7ddfb776) but not with tip (mozilla-central 20250328212938-f31082d6f90f.)

The bug appears to have been fixed in the following build range:

Start: e70c7d40b6829d29cb279d159c1f468f8f89d78a (20250319070758)
End: 1209c2a794ce1508f211b8f02bd2d5b5c60afa83 (20250319095450)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=e70c7d40b6829d29cb279d159c1f468f8f89d78a&tochange=1209c2a794ce1508f211b8f02bd2d5b5c60afa83

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Flags: needinfo?(jkratzer)
Keywords: bugmon

This is suppressed by enabling the new white-space normalizer, but it's not shipped in the release yet.

Depends on: better-white-space-normalizer
Flags: needinfo?(jkratzer)

The bug itself has gone because the legacy white-space normalizer was
removed in bug 1951038.

Assignee: nobody → masayuki
Status: NEW → ASSIGNED
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/53844 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/69e499386dad

Status: ASSIGNED → RESOLVED
Closed: 1 year ago
status-firefox142: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 142 Branch
Upstream PR merged by moz-wptsync-bot
QA Whiteboard: [qa-triage-done-c143/b142]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: