2004155 - Hit MOZ_CRASH(ElementAt(aIndex = 18446744073709551615, aLength = 0)) at /builds/worker/checkouts/gecko/mfbt/Assertions.cpp:78

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20251202-8d7ce95293b5 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(ElementAt(aIndex = 18446744073709551615, aLength = 0)) at /builds/worker/checkouts/gecko/mfbt/Assertions.cpp:78

#0 0x5cf994531591 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
#1 0x5cf994531591 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:375:3
#2 0x5cf994531591 in mozilla::detail::InvalidArrayIndex_CRASH(unsigned long, unsigned long) /builds/worker/checkouts/gecko/mfbt/Assertions.cpp:77:3
#3 0x736d45fa82ba in RemoveElementsAt /builds/worker/checkouts/gecko/xpcom/ds/nsTArray.h:2420:5
#4 0x736d45fa82ba in RemoveElementAt /builds/worker/checkouts/gecko/xpcom/ds/nsTArray.h:1742:45
#5 0x736d45fa82ba in RemoveElementAt /builds/worker/checkouts/gecko/xpcom/ds/nsTObserverArray.h:210:12
#6 0x736d45fa82ba in nsAutoTObserverArray<nsCOMPtr<nsIWeakReference>, 0ul>::ForwardIterator::Remove() /builds/worker/checkouts/gecko/xpcom/ds/nsTObserverArray.h:339:32
#7 0x736d45fa7a5e in mozilla::dom::Document::FlushAutoFocusCandidates() /builds/worker/checkouts/gecko/dom/base/Document.cpp:13789:10
#8 0x736d4d4559a1 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2408:29
#9 0x736d4d4559a1 in operator() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1311:7
#10 0x736d4d4559a1 in RunRenderingPhaseLegacy<(lambda at /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1290:35)> /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1283:3
#11 0x736d4d4559a1 in void nsRefreshDriver::RunRenderingPhase<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_2>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_2&&, bool (*)(mozilla::dom::Document const&)) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:1290:3
#12 0x736d4d450079 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2405:3
#13 0x736d4d4667a6 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:365:13
#14 0x736d4d4667a6 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:343:7
#15 0x736d4d46656a in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:359:5
#16 0x736d4d4661e1 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:949:5
#17 0x736d4d465089 in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:859:5
#18 0x736d4d463bf2 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:756:5
#19 0x736d4d463228 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:590:14
#20 0x736d4d462e65 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:547:9
#21 0x736d4bce367b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#22 0x736d4c1896d1 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:229:78
#23 0x736d4353336f in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:5097:32
#24 0x736d4348f3d5 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1793:25
#25 0x736d4348b8c9 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1719:9
#26 0x736d4348c6e7 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1508:3
#27 0x736d4348dc03 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1610:14
#28 0x736d41d1336a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:705:16
#29 0x736d41d02feb in mozilla::TaskController::RunTask(mozilla::Task*) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:196:19
#30 0x736d41d0a2ed in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1325:20
#31 0x736d41d07dc8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1148:15
#32 0x736d41d083e6 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:641:36
#33 0x736d41d22914 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:336:37
#34 0x736d41d22914 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:549:5
#35 0x736d41d43d7a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1164:16
#36 0x736d41d4ec48 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:461:10
#37 0x736d43497f83 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5
#38 0x736d4337aac4 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:368:10
#39 0x736d4337aac4 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:361:3
#40 0x736d4337aac4 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:343:3
#41 0x736d4cca7686 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:152:27
#42 0x736d4ce9613b in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:555:33
#43 0x736d4ef41dfd in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:20
#44 0x736d4337aac4 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:368:10
#45 0x736d4337aac4 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:361:3
#46 0x736d4337aac4 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:343:3
#47 0x736d4ef40db6 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:594:34
#48 0x5cf99452030a in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:465:22

Comment 1

[Mayank Bansal]

Got this crash on Nightly from the testcase: https://crash-stats.mozilla.org/report/index/cb0886af-2f8f-434a-a81a-8a3aa0251205#tab-bugzilla

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20251204162126-81ecdc1354ae.
The bug appears to have been introduced in the following build range:

Start: 7f41ffc04dd6e3bc610d55ec82fe98be6963ca83 (20251124094751)
End: 5c5d6f1b875f2000e5ddb436a8eef7b756543241 (20251124061148)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7f41ffc04dd6e3bc610d55ec82fe98be6963ca83&tochange=5c5d6f1b875f2000e5ddb436a8eef7b756543241

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 3

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Confirmed with mozregression that this is from bug 543435.

Comment 5

[BugBot [:suhaib / :marco]]

:vhilla, since you are the author of the regressor, bug 543435, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 6

[Vincent Hilla [:vhilla]]

autoFocusElementDoc->FlushPendingNotifications(FlushType::Frames); causes Document::MaybeInitializeFinalizeFrameLoaders() to execute, which fires a load event and executes go(). That creates a dialog, focuses it and clears the top document's auto focus candidates (topDocument->SetAutoFocusFired()). So the iterator is invalidated.

Comment 7

[Vincent Hilla [:vhilla]]

Locally, I can only reproduce it with opt builds. I suppose debug builds are too slow and somehow the reload wins over the focus code.

An immediate fix would be to check mAutoFocusFired. But I wonder if the iterator could be invalidated in other ways or some pre-condition like topWindow->GetFocusedElement() could change.

Comment 8

[Vincent Hilla [:vhilla]]

Attachment: testcase2.html

Another crash for which checking mAutoFocusFired doesn't suffice.

Comment 9

[Vincent Hilla [:vhilla]]

Report for testcase2: https://crash-stats.mozilla.org/report/index/ee4b3dfe-3c0c-4cc3-b39e-6b7a70251205
Pernosco is pending

Comment 10

[Emilio Cobos Álvarez [:emilio]]

But the point of using an TObserverArray is that we expect iterators to be invalidated? Oh, is the Remove() call what fails... So the iterator has been cleared already... I think Remove just needs a check for mPosition being zero...

Comment 11

[Vincent Hilla [:vhilla]]

( And because we check if (iter->mPosition > aModPos) { removing multiple autofocus candidates won't cause the unsigned index to underflow )

Even if mPosition > 0. If FlushPendingNotifications ends up changing what iter points to, autoFocusElement isn't what iter.Remove() will remove.

Maybe we should do mAutoFocusCandidates->RemoveElement(someWeakRef) and assert mPosition > 0 in Remove.

Comment 12

[Vincent Hilla [:vhilla]]

Attachment: Bug 2004155 - Make FlushAutoFocusCandidates robust to iterator position changes. r=#dom-core,emilio

The code uses an nsTObserverArray to tolerate modifications during iteration.
But FlushPendingNotifications can desynchronize autoFocusElement from the
iterator's current position, resulting in removal at an unexpected or invalid
index.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/103787e777fc
https://hg.mozilla.org/integration/autoland/rev/a622576942e6
Make FlushAutoFocusCandidates robust to iterator position changes. r=dom-core,smaug

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Bug 543435 was reverted from Fx147. Updating the flags accordingly.

Comment 15

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/a622576942e6

Comment 16

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20251209093753-54464cf30cd7.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.