1998992 - Assertion failure: mSpec.Length() <= StaticPrefs::network_standard_url_max_length() (The spec should never be this long, we missed a check.), at /builds/worker/checkouts/gecko/netwerk/base/nsStandardURL.cpp:1156

Status: RESOLVED FIXED

(Core :: Networking, defect, P2)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20251106-330420a3e506 (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting the URL in this report https://crash-stats.mozilla.org/report/index/754739c4-d720-4ec6-b988-7507c0251107.

Assertion failure: mSpec.Length() <= StaticPrefs::network_standard_url_max_length() (The spec should never be this long, we missed a check.), at /builds/worker/checkouts/gecko/netwerk/base/nsStandardURL.cpp:1156

0|0|libxul.so|mozilla::net::nsStandardURL::GetSpec(nsTSubstring<char>&)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsStandardURL.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1155|0x55
0|1|libxul.so|nsContentUtils::TruncatedURLForDisplay(nsIURI*, unsigned long)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|12351|0x40
0|2|libxul.so|mozilla::dom::WindowGlobalChild::SetDocumentURI(nsIURI*)|hg:hg.mozilla.org/mozilla-central:dom/ipc/WindowGlobalChild.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|635|0x96
0|3|libxul.so|mozilla::dom::Document::SetDocumentURI(nsIURI*)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|4452|0x298
0|4|libxul.so|nsDocShell::HandleSameDocumentNavigation(nsDocShellLoadState*, SameDocumentNavigationState&, bool&)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|9039|0xdce
0|5|libxul.so|nsDocShell::InternalLoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|9713|0x9d7
0|6|libxul.so|nsDocShell::LoadURI(nsDocShellLoadState*, bool, bool)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|871|0x6d5
0|7|libxul.so|mozilla::dom::BrowsingContext::LoadURI(nsDocShellLoadState*, bool)|hg:hg.mozilla.org/mozilla-central:docshell/base/BrowsingContext.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|2143|0xc2
0|8|libxul.so|mozilla::dom::BrowsingContext::Navigate(nsIURI*, nsIPrincipal&, mozilla::ErrorResult&, mozilla::dom::NavigationHistoryBehavior, bool, nsIStructuredCloneContainer*, mozilla::dom::NavigationAPIMethodTracker*)|hg:hg.mozilla.org/mozilla-central:docshell/base/BrowsingContext.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|2500|0x24a
0|9|libxul.so|mozilla::dom::LocationBase::Navigate(nsIURI*, nsIPrincipal&, mozilla::ErrorResult&, mozilla::dom::NavigationHistoryBehavior)|hg:hg.mozilla.org/mozilla-central:dom/base/LocationBase.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|47|0xac
0|10|libxul.so|mozilla::dom::Location::SetHash(nsTSubstring<char> const&, nsIPrincipal&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/Location.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|175|0x1ea
0|11|libxul.so|mozilla::dom::Location_Binding::set_hash(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs)|s3:gecko-generated-sources:1dbe5245aeb5e120e30fe84a18fd8bcc44f31639f7b5b7cd1c0af5028300dcccb57a6fa1f7ea6dc90e8fdab48f6bab34bf765c053b35a7283b332e8b65dc8e2f/dom/bindings/LocationBinding.cpp:|860|0x18e
0|12|libxul.so|mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|3253|0x299
0|13|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|490|0xf4
0|14|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|586|0x2bf
0|15|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|685|0x12c
0|16|libxul.so|js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|816|0xb4
0|17|libxul.so|js::SetPropertyIgnoringNamedGetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<mozilla::Maybe<JS::PropertyDescriptor> >, JS::ObjectOpResult&)|hg:hg.mozilla.org/mozilla-central:js/src/proxy/BaseProxyHandler.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|240|0x270
0|18|libxul.so|mozilla::dom::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const|hg:hg.mozilla.org/mozilla-central:dom/bindings/DOMJSProxyHandler.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|248|0x114
0|19|libxul.so|mozilla::dom::Location_Binding::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const|s3:gecko-generated-sources:1dbe5245aeb5e120e30fe84a18fd8bcc44f31639f7b5b7cd1c0af5028300dcccb57a6fa1f7ea6dc90e8fdab48f6bab34bf765c053b35a7283b332e8b65dc8e2f/dom/bindings/LocationBinding.cpp:|1659|0x13a
0|20|libxul.so|js::Proxy::setInternal(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)|hg:hg.mozilla.org/mozilla-central:js/src/proxy/Proxy.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|593|0x393
0|21|libxul.so|js::Proxy::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)|hg:hg.mozilla.org/mozilla-central:js/src/proxy/Proxy.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|601|0x82
0|22|libxul.so|js::Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|3018|0x6ba8
0|23|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|460|0x3da
0|24|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|618|0x2e5
0|25|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|685|0x12c
0|26|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/CallAndConstruct.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|119|0x20b
0|27|libxul.so|mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:6bb50a9febd07b2ad041cb59a1fa6678b97d5dfa7934c45cdfb310e02ee1d5fd2d0aff84c3cbda807717ae7247884aa5f52594385c678b698b0d951ba796aa45/dom/bindings/EventHandlerBinding.cpp:|65|0x305
0|28|libxul.so|mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:2c0600fb668133ec78b4dbdd71621eeefcafca4a527e24f8dcefe291fb1ae7c5c4647bce637883fe669db31805b6a9d1251a807433b4f2db5c3b207f28308026/dist/include/mozilla/dom/EventHandlerBinding.h:|82|0x12b
0|29|libxul.so|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|hg:hg.mozilla.org/mozilla-central:dom/events/JSEventHandler.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|201|0x52b
0|30|libxul.so|mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1273|0x301
0|31|libxul.so|mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1579|0x389
0|32|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1484|0x1df
0|33|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|364|0x1de
0|34|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|605|0x65c
0|35|libxul.so|mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1260|0x15d2
0|36|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1019|0x48e
0|37|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|6445|0x3cb
0|38|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|5767|0x78e
0|39|libxul.so|{virtual override thunk({offset(-440)}, nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult))}|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:330420a3e506d2f5d3cd5946626fe008345af95e||0xf
0|40|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1514|0x1b9
0|41|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1046|0x1c2
0|42|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|841|0x31c
0|43|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|722|0x5ea
0|44|libxul.so|nsDocShell::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|14528|0x5b
0|45|libxul.so|mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|656|0x13f
0|46|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|540|0x56
0|47|libxul.so|mozilla::dom::Document::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|12503|0xdb
0|48|libxul.so|mozilla::LoadBlockingAsyncEventDispatcher::~LoadBlockingAsyncEventDispatcher()|hg:hg.mozilla.org/mozilla-central:dom/events/AsyncEventDispatcher.h:330420a3e506d2f5d3cd5946626fe008345af95e|202|0x1f
0|49|libxul.so|mozilla::LoadBlockingAsyncEventDispatcher::~LoadBlockingAsyncEventDispatcher()|hg:hg.mozilla.org/mozilla-central:dom/events/AsyncEventDispatcher.h:330420a3e506d2f5d3cd5946626fe008345af95e|202|0xd
0|50|libxul.so|mozilla::Runnable::Release()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|65|0x50
0|51|libxul.so|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|706|0x2e
0|52|libxul.so|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1325|0x597
0|53|libxul.so|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1148|0x57
0|54|libxul.so|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|641|0x65
0|55|libxul.so|mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:330420a3e506d2f5d3cd5946626fe008345af95e|549|0x16
0|56|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|1166|0x5aa
0|57|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|461|0x4f
0|58|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|85|0xc0
0|59|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:330420a3e506d2f5d3cd5946626fe008345af95e|343|0x61
0|60|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|152|0x28
0|61|libxul.so|nsAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/gtk/nsAppShell.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|470|0x114
0|62|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|656|0x6b
0|63|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|235|0x3c
0|64|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:330420a3e506d2f5d3cd5946626fe008345af95e|343|0x61
0|65|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|594|0xa21
0|66|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:330420a3e506d2f5d3cd5946626fe008345af95e|465|0x21c

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/A6ftzUmtO6X2HFXdv-vvnw/index.html

Comment 2

[Valentin Gosu [:valentin]]

I think the problem is that with SetRef we check the input.Length() but then filter & encode the segments, which would change the length.
I'm 99% sure that's the problem, as the codepath in pernosco comes via Location::SetHash.

The check should be added here

Comment 3

[Valentin Gosu [:valentin]]

Attachment: Bug 1998992 - Make sure URL cannot exceed length limits via ref/query setters r=#necko

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/543200cba199
https://hg.mozilla.org/integration/autoland/rev/dc6a6bd6c008
Make sure URL cannot exceed length limits via ref/query setters r=necko-reviewers,kershaw

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/dc6a6bd6c008