2014584 - Assertion failure: !maximum.isNaN(), at /dom/html/input/NumericInputTypes.cpp:52

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jason Kratzer [:jkratzer]]

Reproduced on mozilla-central rev ab79c347a784 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build ab79c347a784 --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Assertion failure: !maximum.isNaN(), at /dom/html/input/NumericInputTypes.cpp:52

    ==1354061==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x774d6e049c01 bp 0x7ffcaa6f4e80 sp 0x7ffcaa6f4d80 T1354061)
    ==1354061==The signal is caused by a WRITE memory access.
    ==1354061==Hint: address points to the zero page.
        #0 0x774d6e049c01 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x774d6e049c01 in mozilla::dom::NumericInputTypeBase::GetRangeOverflowMessage(nsTSubstring<char16_t>&) /dom/html/input/NumericInputTypes.cpp:52:3
        #2 0x774d6c45007f in mozilla::dom::HTMLInputElement_Binding::get_validationMessage(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./HTMLInputElementBinding.cpp:3732:24
        #3 0x774d6d44abb4 in bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3178:13
        #4 0x774d72015b24 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:490:13
        #5 0x774d720153cf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:586:12
        #6 0x774d720167cc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
        #7 0x774d72017933 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:807:10
        #8 0x774d723a2bcf in CallGetter /js/src/vm/NativeObject.cpp:2139:12
        #9 0x774d723a2bcf in bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, js::PropertyInfoBase<unsigned int>, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /js/src/vm/NativeObject.cpp:2167:12
        #10 0x774d723a3352 in bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /js/src/vm/NativeObject.cpp:2310:14
        #11 0x774d70e54043 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) /js/src/vm/ObjectOperations-inl.h:120:10
        #12 0x774d72036390 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:4630:10
        #13 0x774d7161e5d3 in js::jit::DoGetPropFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/jit/BaselineIC.cpp:1318:8
        #14 0x1d9df55e7dda  ([anon:js-executable-memory]+0xcdda)
    
    ==1354061==Register values:
    rax = 0x0000000000000000  rbx = 0x00007ffcaa6f4ec0  rcx = 0x0000000000000034  rdx = 0x0000774d7b804563
    rdi = 0x0000774d7b805700  rsi = 0x0000000000000000  rbp = 0x00007ffcaa6f4e80  rsp = 0x00007ffcaa6f4d80
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x00005c6c412f9910  r13 = 0x00007ffcaa6f4fc0  r14 = 0x00005c6c412f9990  r15 = 0xaaaaaaaaaaaaaaaa
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/jkratzer/builds/m-c-20260204094524-fuzzing-debug/libxul.so+0x8a49c01) (BuildId: 6324a18a77ec64a491609780586d8badab323adb)
    ==1354061==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Detailed Crash Information

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 2014584 using build mozilla-central 20260204094524-ab79c347a784. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260205042023-4779d1a57487.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 5223a9e8f62812d59d3daaedadb64d1be3c8757b (20250206161648)
End: ab79c347a7844435bf155b6ff78757fdd6a605d1 (20260204094524)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

As far as I see, this is just an assertion failure. Could we even just remove that assertion? Or return early.

Comment 6

[Leo Tenenbaum [:ltenenbaum]]

Attachment: (secure)

Comment 7

[Leo Tenenbaum [:ltenenbaum]]

There is no crash or vulnerability in optimized builds: validationMessage returns "Please select a value that is no more than NaN." which is incorrect but not a security issue.

Comment 8

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Comment 9

[Leo Tenenbaum [:ltenenbaum]]

Attachment: (secure)

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/fb9fe69a699d
https://hg.mozilla.org/integration/autoland/rev/e4c838f95ab8
Don't localize input min/max attributes. r=dom-core,edgar

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/e4c838f95ab8

Comment 12

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:ltenenbaum, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox149 to wontfix.

For more information, please visit BugBot documentation.

Comment 13

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260227050019-ac66d1c9d3b2.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.