2014588 - Assertion failure: !mPreload (Forgot to cancel the running preload), at /dom/html/HTMLLinkElement.cpp:714

Reporter

Description

•

8 months ago

Reproduced on mozilla-central rev ab79c347a784 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build ab79c347a784 --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Assertion failure: !mPreload (Forgot to cancel the running preload), at /dom/html/HTMLLinkElement.cpp:714

    ==1371503==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ad7de9e9790 bp 0x7ffdd9ab4740 sp 0x7ffdd9ab4710 T1371503)
    ==1371503==The signal is caused by a WRITE memory access.
    ==1371503==Hint: address points to the zero page.
        #0 0x7ad7de9e9790 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x7ad7de9e9790 in mozilla::dom::HTMLLinkElement::StartPreload(nsIContentPolicy::nsContentPolicyType) /dom/html/HTMLLinkElement.cpp:714:3
        #2 0x7ad7de9e8680 in mozilla::dom::HTMLLinkElement::UpdatePreload(nsAtom*, nsAttrValue const*, nsAttrValue const*) /dom/html/HTMLLinkElement.cpp:0:0
        #3 0x7ad7de9e7c94 in mozilla::dom::HTMLLinkElement::AfterSetAttr(int, nsAtom*, nsAttrValue const*, nsAttrValue const*, nsIPrincipal*, bool) /dom/html/HTMLLinkElement.cpp:284:9
        #4 0x7ad7dc9e9ed2 in mozilla::dom::Element::SetAttrAndNotify(int, nsAtom*, nsAtom*, nsAttrValue const*, nsAttrValue&, nsIPrincipal*, AttrModType, bool, bool, mozilla::dom::Document*, mozAutoDocUpdate const&) /dom/base/Element.cpp:3704:5
        #5 0x7ad7dc9dc016 in SetAttrInternal<(lambda at /dom/base/Element.cpp:3469:26)> /dom/base/Element.cpp:3562:10
        #6 0x7ad7dc9dc016 in mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool) /dom/base/Element.cpp:3467:10
        #7 0x7ad7dc9dd2f7 in mozilla::dom::Element::SetAttribute(nsTSubstring<char16_t> const&, mozilla::dom::TrustedHTMLOrTrustedScriptOrTrustedScriptURLOrString const&, nsIPrincipal*, mozilla::ErrorResult&) /dom/base/Element.cpp:1813:14
        #8 0x7ad7ddc8c404 in mozilla::dom::Element_Binding::setAttribute(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./ElementBinding.cpp:2519:24
        #9 0x7ad7dde4f966 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3309:13
        #10 0x7ad7e2a15b24 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:490:13
        #11 0x7ad7e2a153cf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:586:12
        #12 0x7ad7e2a260b2 in CallFromStack /js/src/vm/Interpreter.cpp:658:10
        #13 0x7ad7e2a260b2 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3272:16
        #14 0x7ad7e2a14a4a in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:460:13
        #15 0x7ad7e2a153f5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #16 0x7ad7e2a167cc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
        #17 0x7ad7e2c594eb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #18 0x7ad7ddcf7a35 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
        #19 0x7ad7de794d9b in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
        #20 0x7ad7de7938e2 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /dom/events/JSEventHandler.cpp:201:12
        #21 0x7ad7de76eff1 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1282:22
        #22 0x7ad7de770149 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1588:12
        #23 0x7ad7de76fa31 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1493:35
        #24 0x7ad7de7643de in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:465:5
        #25 0x7ad7de7643de in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:364:17
        #26 0x7ad7de763aac in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:605:16
        #27 0x7ad7de766262 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1260:11
        #28 0x7ad7dc78d5b1 in nsGlobalWindowInner::FireFrameLoadEvent() /dom/base/nsGlobalWindowInner.cpp:2248:5
        #29 0x7ad7dc78e2ec in nsGlobalWindowInner::PostHandleEvent(mozilla::EventChainPostVisitor&) /dom/base/nsGlobalWindowInner.cpp:2336:5
        #30 0x7ad7de763361 in mozilla::EventTargetChainItem::PostHandleEvent(mozilla::EventChainPostVisitor&) /dom/events/EventDispatcher.cpp:486:12
        #31 0x7ad7de763ac3 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:609:16
        #32 0x7ad7de763ed2 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:686:5
        #33 0x7ad7de766262 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1260:11
        #34 0x7ad7e0b0620a in nsDocumentViewer::LoadComplete(nsresult) /layout/base/nsDocumentViewer.cpp:968:7
        #35 0x7ad7e0f7b800 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /docshell/base/nsDocShell.cpp:6523:13
        #36 0x7ad7e0f7acff in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp:5844:7
        #37 0x7ad7e0f7c362 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp:0:0
        #38 0x7ad7db82c2c9 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /uriloader/base/nsDocLoader.cpp:1527:3
        #39 0x7ad7db82ba82 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:1059:14
        #40 0x7ad7db829604 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:854:9
        #41 0x7ad7db82ae2a in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:722:5
        #42 0x7ad7e0fa301f in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:14922:23
        #43 0x7ad7daba2d3f in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:656:22
        #44 0x7ad7daba3ee6 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:540:10
        #45 0x7ad7dc98dc9c in mozilla::dom::Document::DoUnblockOnload() /dom/base/Document.cpp:12492:18
        #46 0x7ad7dc9739d6 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8715:3
        #47 0x7ad7dca3faa5 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:18
        #48 0x7ad7dca3faa5 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
        #49 0x7ad7dca3faa5 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:95:14
        #50 0x7ad7dca3faa5 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1740:14
        #51 0x7ad7dca3faa5 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1751:14
        #52 0x7ad7dca3faa5 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1081:12
        #53 0x7ad7dca3faa5 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1132:13
        #54 0x7ad7da940097 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:705:16
        #55 0x7ad7da93a764 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1325:20
        #56 0x7ad7da9393e7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1148:15
        #57 0x7ad7da939865 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:641:36
        #58 0x7ad7da949376 in operator() /xpcom/threads/TaskController.cpp:333:37
        #59 0x7ad7da949376 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:549:5
        #60 0x7ad7da95b8f3 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1168:16
        #61 0x7ad7da96154f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #62 0x7ad7db5506c7 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #63 0x7ad7db4a9ad1 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #64 0x7ad7db4a9ad1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #65 0x7ad7e065b948 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:152:27
        #66 0x7ad7e0727264 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:555:33
        #67 0x7ad7e176e9cb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:656:20
        #68 0x7ad7db551574 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #69 0x7ad7db4a9ad1 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #70 0x7ad7db4a9ad1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #71 0x7ad7e176e12f in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:594:34
        #72 0x5d77ed04d35c in main /browser/app/nsBrowserApp.cpp:465:22
        #73 0x7ad7ec22a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #74 0x7ad7ec22a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #75 0x5d77ed0211b8 in _start ??:0:0
    
    ==1371503==Register values:
    rax = 0x0000000000000000  rbx = 0x00005d77f2a36b98  rcx = 0x00000000000002ca  rdx = 0x00007ad7ec404563
    rdi = 0x00007ad7ec405700  rsi = 0x0000000000000000  rbp = 0x00007ffdd9ab4740  rsp = 0x00007ffdd9ab4710
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x00007ffdd9ab4cb8  r13 = 0x0000000000000002  r14 = 0x00005d77f2a36ad0  r15 = 0x0000000000000002
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/jkratzer/builds/m-c-20260204094524-fuzzing-debug/libxul.so+0x89e9790) (BuildId: 6324a18a77ec64a491609780586d8badab323adb)
    ==1371503==ABORTING

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

8 months ago

Attached file Detailed Crash Information — Details

Jason Kratzer [:jkratzer]

Reporter

Comment 2

•

8 months ago

Attached file Testcase — Details

Comment hidden (obsolete)

Jason Kratzer [:jkratzer]

Reporter

Updated

•

8 months ago

Keywords: bugmon

Bugmon [:jkratzer for issues]

Comment 4

•

8 months ago

Verified bug as reproducible on mozilla-central 20260205042023-4779d1a57487.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 5223a9e8f62812d59d3daaedadb64d1be3c8757b (20250206161648)
End: ab79c347a7844435bf155b6ff78757fdd6a605d1 (20260204094524)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Olli Pettay [:smaug][bugs@pettay.fi]

Comment 5

•

8 months ago

I think this should be safe, since even if we don't cancel, the element is accessed through a weak (not raw) pointer
https://searchfox.org/firefox-main/source/uriloader/preload/PreloaderBase.h#162

Andrew McCreight [:mccr8]

Updated

•

8 months ago

Keywords: keep-hidden

Olli Pettay [:smaug][bugs@pettay.fi]

Updated

•

8 months ago

Keywords: sec-other

Daniel Veditz [:dveditz]

Updated

•

8 months ago

status-firefox149: --- → affected

Vincent Hilla [:vhilla]

Assignee

Comment 6

•

8 months ago

Attached file (secure) — Details

Phabricator Automation

Updated

•

8 months ago

Assignee: nobody → vhilla

Status: NEW → ASSIGNED

Vincent Hilla [:vhilla]

Assignee

Comment 7

•

8 months ago

https://treeherder.mozilla.org/jobs?repo=try&revision=6f648c19b128f361d59a2850acd557ea2fe9632e

Pulsebot

Comment 8

•

8 months ago

Pushed by vhilla@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/8527273c7559 https://hg.mozilla.org/integration/autoland/rev/5380cd81a02f Don't re-evaluate old media query when updating preload. r=dom-core,smaug

Ryan VanderMeulen [:RyanVM]

Comment 9

•

8 months ago

https://hg-edge.mozilla.org/mozilla-central/rev/5380cd81a02f

Group: dom-core-security → core-security-release

Status: ASSIGNED → RESOLVED

Closed: 8 months ago

status-firefox147: --- → wontfix

status-firefox148: --- → wontfix

status-firefox149: affected → fixed

status-firefox-esr115: --- → wontfix

status-firefox-esr140: --- → wontfix

Flags: in-testsuite+

Resolution: --- → FIXED

Target Milestone: --- → 149 Branch

Bugmon [:jkratzer for issues]

Comment 10

•

8 months ago

Verified bug as fixed on rev mozilla-central 20260213212122-0d74a4189e30.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED

Keywords: bugmon

Tyson Smith [:tsmith]

Updated

•

7 months ago

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed][adv-main149-]

Daniel Veditz [:dveditz]

Updated

•

1 month ago

Group: core-security-release

Keywords: keep-hidden

Detailed Crash Information 8 months ago Jason Kratzer [:jkratzer] 12.68 KB, text/plain		Details
Testcase 8 months ago Jason Kratzer [:jkratzer] 4.23 KB, text/html		Details
(secure) 8 months ago Vincent Hilla [:vhilla] 48 bytes, text/x-phabricator-request		Details \| Review

Bugzilla

Assertion failure: !mPreload (Forgot to cancel the running preload), at /dom/html/HTMLLinkElement.cpp:714

Categories

(Core :: DOM: Core & HTML, defect)

Tracking

()

People

(Reporter: jkratzer, Assigned: vhilla)

References

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed][adv-main149-])

Crash Data

Security

(public)

User Story

Attachments

(3 files)

Description

Comment 1

Comment 2

Comment 3

Updated

Comment 4

Comment 5

Updated

Updated

Updated

Comment 6

Updated

Comment 7

Comment 8

Comment 9

Comment 10

Updated

Updated

Attachment

General

Description

File Name

Content Type