1978693 - Assertion failure: aCmp(*(aBegin + a), *(aBegin + b)) (Your comparator is not a valid strict-weak ordering), at /builds/worker/checkouts/gecko/xpcom/ds/nsTArray.h:319

Status: NEW

(Core :: DOM: Editor, defect)

Description

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: testcase.html

Found while fuzzing 20250527-8b348e466de5 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: aCmp(*(aBegin + a), *(aBegin + b)) (Your comparator is not a valid strict-weak ordering), at /builds/worker/checkouts/gecko/xpcom/ds/nsTArray.h:319

#0 0x70e2d48844b1 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
#1 0x70e2d48844b1 in void detail::AssertStrictWeakOrder<StyledRange*, void nsTArray_Impl<StyledRange, nsTArrayInfallibleAllocator>::Sort<std::function<int (StyledRange const&, StyledRange const&)>>(std::function<int (StyledRange const&, StyledRange const&)> const&)::'lambda'(std::function<int (StyledRange const&, StyledRange const&)> const&, auto const&)>(std::function<int (StyledRange const&, StyledRange const&)>, std::function<int (StyledRange const&, StyledRange const&)>, auto const&) /builds/worker/checkouts/gecko/xpcom/ds/nsTArray.h:318:9
#2 0x70e2d484a9a7 in void nsTArray_Impl<StyledRange, nsTArrayInfallibleAllocator>::Sort<std::function<int (StyledRange const&, StyledRange const&)>>(std::function<int (StyledRange const&, StyledRange const&)> const&) /builds/worker/checkouts/gecko/xpcom/ds/nsTArray.h:2389:5
#3 0x70e2d484a470 in mozilla::dom::Selection::StyledRanges::ReorderRangesIfNecessary() /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1710:15
#4 0x70e2d4846f56 in mozilla::dom::Selection::StyledRanges::GetIndicesForInterval(nsINode const*, unsigned int, nsINode const*, unsigned int, bool, mozilla::Maybe<unsigned long>&, mozilla::Maybe<unsigned long>&) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1732:3
#5 0x70e2d484950b in mozilla::dom::Selection::GetAbstractRangesForIntervalArray(nsINode*, unsigned int, nsINode*, unsigned int, bool, nsTArray<mozilla::dom::AbstractRange*>*) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:1588:32
#6 0x70e2d484fe16 in mozilla::dom::Selection::RemoveRangeAndUnselectFramesAndNotifyListeners(mozilla::dom::AbstractRange&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/Selection.cpp:2731:8
#7 0x70e2d8c8e421 in mozInlineSpellChecker::RemoveRange(mozilla::dom::Selection*, nsRange*) /builds/worker/checkouts/gecko/extensions/spellcheck/src/mozInlineSpellChecker.cpp:1772:14
#8 0x70e2d8c90ebd in mozInlineSpellChecker::CleanupRangesInSelection(mozilla::dom::Selection*) /builds/worker/checkouts/gecko/extensions/spellcheck/src/mozInlineSpellChecker.cpp:1746:9
#9 0x70e2d8c90727 in mozInlineSpellChecker::ResumeCheck(mozilla::UniquePtr<mozInlineSpellStatus, mozilla::DefaultDelete<mozInlineSpellStatus>>&&) /builds/worker/checkouts/gecko/extensions/spellcheck/src/mozInlineSpellChecker.cpp:1688:3
#10 0x70e2d8c9af68 in mozInlineSpellResume::Run() /builds/worker/checkouts/gecko/extensions/spellcheck/src/mozInlineSpellChecker.cpp:515:31
#11 0x70e2d28386e5 in IdleRunnableWrapper::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:327:22
#12 0x70e2d280e0d7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#13 0x70e2d280740e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1252:20
#14 0x70e2d28062ae in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1117:15
#15 0x70e2d28065c5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#16 0x70e2d2815209 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:336:37
#17 0x70e2d2815209 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#18 0x70e2d2827183 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#19 0x70e2d282d8ef in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#20 0x70e2d4772d8c in SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, (lambda at /builds/worker/checkouts/gecko/dom/base/FuzzingFunctions.cpp:408:22)> /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25
#21 0x70e2d4772d8c in mozilla::dom::FuzzingFunctions::SpinEventLoopFor(mozilla::dom::GlobalObject const&, unsigned int) /builds/worker/checkouts/gecko/dom/base/FuzzingFunctions.cpp:407:3
#22 0x70e2d593fa1b in mozilla::dom::FuzzingFunctions_Binding::spinEventLoopFor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./FuzzingFunctionsBinding.cpp:280:3
#23 0x70e2d9295364 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:494:13
#24 0x70e2d9294bbf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:590:12
#25 0x70e2d92a8866 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:662:10
#26 0x70e2d92a8866 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3286:16
#27 0x70e2d9294201 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:464:13
#28 0x70e2d9294be5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:622:13
#29 0x70e2d929600b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:689:8
#30 0x70e2d936f14b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#31 0x70e2d550bb1b in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./WindowBinding.cpp:457:8
#32 0x70e2d45fb955 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:390:12
#33 0x70e2d45fb716 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, char const*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:403:12
#34 0x70e2d47c66c2 in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) /builds/worker/checkouts/gecko/dom/base/IdleRequest.cpp:69:13
#35 0x70e2d44df881 in nsGlobalWindowInner::RunIdleRequest(mozilla::dom::IdleRequest*, double, bool) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:740:12
#36 0x70e2d44de87c in nsGlobalWindowInner::ExecuteIdleRequest(mozilla::TimeStamp) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:768:3
#37 0x70e2d44de680 in IdleRequestExecutor::Run() /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:609:13
#38 0x70e2d280e0d7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#39 0x70e2d280740e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1252:20
#40 0x70e2d28062ae in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1117:15
#41 0x70e2d28065c5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#42 0x70e2d28151a6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
#43 0x70e2d28151a6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#44 0x70e2d2827183 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#45 0x70e2d282d8ef in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#46 0x70e2d33db9e7 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#47 0x70e2d3334a51 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#48 0x70e2d3334a51 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#49 0x70e2d80f32b8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#50 0x70e2d81b4e84 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:471:33
#51 0x70e2d90f339b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:20
#52 0x70e2d33dc894 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#53 0x70e2d3334a51 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#54 0x70e2d3334a51 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#55 0x70e2d90f27d9 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:590:34
#56 0x5832cc8316be in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250722162531-73304b4f70e7.
The bug appears to have been introduced in the following build range:

Start: 30b9bd7f6722f7d8458091be7d95f12b6245f9a1 (20250516143342)
End: 3b07ab6b33156283d65c6ff48abb0c38933bd486 (20250516160850)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=30b9bd7f6722f7d8458091be7d95f12b6245f9a1&tochange=3b07ab6b33156283d65c6ff48abb0c38933bd486

Comment 2

[Mayank Bansal]

Bug 1966135 seems the most likely.

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Redirecting ni? for Sean to Jan because of the reviewer.

Comment 4

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20250527035423-8b348e466de5) but not with tip (mozilla-central 20251114214833-26057ca50b94.)

The bug appears to have been fixed in the following build range:

Start: 560bb42d94978daf9590391e01a1f4368cfc1e73 (20251101095152)
End: 6ae294af3af135196c330ccee18cb3154fd40513 (20251101131121)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=560bb42d94978daf9590391e01a1f4368cfc1e73&tochange=6ae294af3af135196c330ccee18cb3154fd40513

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 5

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

It is reproducible with m-c 20251127-a7e5bfa46961.

Restoring previous ni?