2015203 - Assertion failure: aLineBreak.CharAtOffsetIsLineBreak(), at /editor/libeditor/HTMLEditorDeleteHandler.cpp:564

Reporter

Description

•

9 months ago

Reproduced on mozilla-central rev ed1c0b4f0bbe (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build ed1c0b4f0bbe --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Assertion failure: aLineBreak.CharAtOffsetIsLineBreak(), at /editor/libeditor/HTMLEditorDeleteHandler.cpp:564

    ==24174==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x78bd5d88424a bp 0x7fff923e6e20 sp 0x7fff923e6d80 T24174)
    ==24174==The signal is caused by a WRITE memory access.
    ==24174==Hint: address points to the zero page.
        #0 0x78bd5d88424a in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x78bd5d88424a in mozilla::HTMLEditor::DeleteLineBreakWithTransaction(mozilla::EditorLineBreakBase<nsCOMPtr<nsIContent>> const&, short, mozilla::dom::Element const&) /editor/libeditor/HTMLEditorDeleteHandler.cpp:563:3
        #2 0x78bd5d8bf5f5 in mozilla::HTMLEditor::AutoInsertParagraphHandler::EnsureNoInvisibleLineBreakBeforePointToSplit(mozilla::dom::Element const&, mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>> const&) /editor/libeditor/HTMLEditorInsertParagraphHandler.cpp:1420:21
        #3 0x78bd5d8b9f36 in mozilla::HTMLEditor::AutoInsertParagraphHandler::SplitParagraphWithTransaction(mozilla::dom::Element&, mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent>> const&) /editor/libeditor/HTMLEditorInsertParagraphHandler.cpp:1599:7
        #4 0x78bd5d8b56c0 in mozilla::HTMLEditor::AutoInsertParagraphHandler::Run() /editor/libeditor/HTMLEditorInsertParagraphHandler.cpp:419:11
        #5 0x78bd5d83abba in mozilla::HTMLEditor::InsertParagraphSeparatorAsSubAction(mozilla::dom::Element const&) /editor/libeditor/HTMLEditorInsertParagraphHandler.cpp:105:30
        #6 0x78bd5d83a50c in mozilla::HTMLEditor::InsertParagraphSeparatorAsAction(nsIPrincipal*) /editor/libeditor/HTMLEditor.cpp:1596:7
        #7 0x78bd5d7bef0c in mozilla::InsertParagraphCommand::DoCommand(mozilla::Command, mozilla::EditorBase&, nsIPrincipal*) const /editor/libeditor/EditorCommands.cpp:886:25
        #8 0x78bd59964d26 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, mozilla::dom::TrustedHTMLOrString const&, nsIPrincipal&, mozilla::ErrorResult&) /dom/base/Document.cpp:5880:37
        #9 0x78bd5ac399ac in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./DocumentBinding.cpp:4664:36
        #10 0x78bd5ae58206 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3309:13
        #11 0x78bd5fa23694 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:490:13
        #12 0x78bd5fa22f3f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:586:12
        #13 0x78bd5fa33c22 in CallFromStack /js/src/vm/Interpreter.cpp:658:10
        #14 0x78bd5fa33c22 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3272:16
        #15 0x78bd5fa225ba in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:460:13
        #16 0x78bd5fa22f65 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #17 0x78bd5fa2433c in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
        #18 0x78bd5fc66f9b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #19 0x78bd5ad01fca in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
        #20 0x78bd5b777f42 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #21 0x78bd5b777922 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1276:43
        #22 0x78bd5b778b39 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1588:12
        #23 0x78bd5b778421 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1493:35
        #24 0x78bd5b76cdce in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:465:5
        #25 0x78bd5b76cdce in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:364:17
        #26 0x78bd5b76c49c in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:605:16
        #27 0x78bd5b76ec52 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1260:11
        #28 0x78bd5db1042a in nsDocumentViewer::LoadComplete(nsresult) /layout/base/nsDocumentViewer.cpp:968:7
        #29 0x78bd5df86040 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /docshell/base/nsDocShell.cpp:6523:13
        #30 0x78bd5df8553f in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp:5844:7
        #31 0x78bd5df86ba2 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp:0:0
        #32 0x78bd588312a9 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /uriloader/base/nsDocLoader.cpp:1527:3
        #33 0x78bd58830a62 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:1059:14
        #34 0x78bd5882e5e4 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:854:9
        #35 0x78bd5882fe0a in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:722:5
        #36 0x78bd5dfad75f in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:14923:23
        #37 0x78bd57ba76ff in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:656:22
        #38 0x78bd57ba88a6 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:540:10
        #39 0x78bd5999540c in mozilla::dom::Document::DoUnblockOnload() /dom/base/Document.cpp:12492:18
        #40 0x78bd5997b146 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8715:3
        #41 0x78bd59a47225 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:18
        #42 0x78bd59a47225 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
        #43 0x78bd59a47225 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:95:14
        #44 0x78bd59a47225 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1740:14
        #45 0x78bd59a47225 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1082:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/tuple:1751:14
        #46 0x78bd59a47225 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1081:12
        #47 0x78bd59a47225 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1132:13
        #48 0x78bd57944497 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:705:16
        #49 0x78bd5793eb64 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1325:20
        #50 0x78bd5793d7e7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1148:15
        #51 0x78bd5793dc65 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:641:36
        #52 0x78bd5794d776 in operator() /xpcom/threads/TaskController.cpp:333:37
        #53 0x78bd5794d776 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:549:5
        #54 0x78bd5795fcf3 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1168:16
        #55 0x78bd5796594f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #56 0x78bd58555287 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #57 0x78bd584ae691 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #58 0x78bd584ae691 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #59 0x78bd5d665a68 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:152:27
        #60 0x78bd5d731484 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:555:33
        #61 0x78bd5e7794eb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:652:20
        #62 0x78bd58556134 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #63 0x78bd584ae691 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #64 0x78bd584ae691 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #65 0x78bd5e778c4f in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:590:34
        #66 0x61dfdff64f8c in main /browser/app/nsBrowserApp.cpp:465:22
        #67 0x78bd6922a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #68 0x78bd6922a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #69 0x61dfdff38de8 in _start ??:0:0
    
    ==24174==Register values:
    rax = 0x0000000000000000  rbx = 0x000061dfe8dbcb70  rcx = 0x0000000000000234  rdx = 0x000078bd69404563
    rdi = 0x000078bd69405700  rsi = 0x0000000000000000  rbp = 0x00007fff923e6e20  rsp = 0x00007fff923e6d80
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x00007fff923e6f30  r13 = 0x000061dfe9483a90  r14 = 0x00007fff923e7500  r15 = 0x0000000000000001
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/user/workspace/browsers/m-c-20260205163736-fuzzing-debug/libxul.so+0xa88424a) (BuildId: 0b411186bb9521ab7e302998bc6191dc011c2d12)
    ==24174==ABORTING

Tyson Smith [:tsmith]

Reporter

Comment 1

•

9 months ago

Attached file Detailed Crash Information — Details

Tyson Smith [:tsmith]

Reporter

Comment 2

•

9 months ago

Attached file Testcase — Details

Tyson Smith [:tsmith]

Reporter

Updated

•

9 months ago

status-firefox149: --- → affected

Component: DOM: Core & HTML → DOM: Editor

Bugmon [:jkratzer for issues]

Comment 3

•

9 months ago

Verified bug as reproducible on mozilla-central 20260208200320-af326189e3d9.
The bug appears to have been introduced in the following build range:

Start: 401f1f9d1b457e0fe25dc233fe53b0538a66c252 (20250722024406)
End: cf0d99adfd1601cad47d7fc8a75f126532cd7ae0 (20250722053112)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=401f1f9d1b457e0fe25dc233fe53b0538a66c252&tochange=cf0d99adfd1601cad47d7fc8a75f126532cd7ae0

Keywords: regression

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 4

•

9 months ago

This just detected a usual editor bug.

Assignee: nobody → masayuki

Severity: -- → S3

Status: NEW → ASSIGNED

OS: Linux → All

Regressed by: 1899083

Hardware: x86_64 → All

BugBot [:suhaib / :marco]

Comment 5

•

9 months ago

Set release status flags based on info from the regressing bug 1899083

status-firefox147: --- → affected

status-firefox148: --- → affected

status-firefox-esr140: --- → unaffected

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Updated

•

9 months ago

Keywords: sec-other

Donal Meehan [:dmeehan]

Updated

•

9 months ago

status-firefox147: affected → wontfix

status-firefox-esr115: --- → unaffected

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Comment 6

•

9 months ago

Attached file (secure) — Details

WSRunScanner::ScanPreviousVisibleNodeOrBlockBoundary() returns the
position after the preceding preformatted line break. Therefore,
it needs to use offset - 1, but it uses offset as-is. So, it should
use CreateLineBreak<EditorLineBreak>() instead.

Additionally, then, the position to split may be a middle of a Text.
Therefore, WhiteSpaceVisibilityKeeper::NormalizeWhiteSpacesBefore()
is not available for the preformatted line break unless it's at start
of a Text. Instead, it needs to use
WhiteSpaceVisibilityKeeper::NormalizeWhiteSpacesToSplitAt().

Finally, WhiteSpaceVisibilityKeeper::NormalizeWhiteSpacesToSplitAt()
may delete some collapsed white-spaces before the preformatted line
break. Therefore, it needs to track EditorLineBreak with
AutoTrackLineBreak. (It forgets automatically flushing itself at
destruction. Therefore, this patch fixes it too.)

Pulsebot

Comment 7

•

9 months ago

Pushed by masayuki@d-toybox.com: https://github.com/mozilla-firefox/firefox/commit/005b916b0829 https://hg.mozilla.org/integration/autoland/rev/50de141a1471 Make `AutoInsertParagraphHandler::GetBetterPointToSplitParagraph` use the right point for creating the `EditorLineBreak` r=m_kato

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 8

•

9 months ago

https://hg.mozilla.org/mozilla-central/rev/50de141a1471

Group: dom-core-security → core-security-release

Status: ASSIGNED → RESOLVED

Closed: 9 months ago

status-firefox149: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → 149 Branch

Bugmon [:jkratzer for issues]

Comment 9

•

8 months ago

Verified bug as fixed on rev mozilla-central 20260212171528-61fb3eacd57b.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED

status-firefox149: fixed → verified

Keywords: bugmon

Ryan VanderMeulen [:RyanVM]

Updated

•

8 months ago

Flags: in-testsuite+

BugBot [:suhaib / :marco]

Comment 10

•

8 months ago

The patch landed in nightly and beta is affected.
:masayuki, is this bug important enough to require an uplift?

If yes, please nominate the patch for beta approval.
- See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
If no, please set status-firefox148 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(masayuki)

Donal Meehan [:dmeehan]

Updated

•

8 months ago

status-firefox148: affected → wontfix

Flags: needinfo?(masayuki)

Masayuki Nakano [:masayuki] (he/him)(JST, +0900)

Assignee

Updated

•

8 months ago

Blocks: 2008209

Tyson Smith [:tsmith]

Reporter

Updated

•

7 months ago

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed][adv-main149-]

Daniel Veditz [:dveditz]

Updated

•

1 month ago

Group: core-security-release

Keywords: keep-hidden

Detailed Crash Information 9 months ago Tyson Smith [:tsmith] 11.69 KB, text/plain		Details
Testcase 9 months ago Tyson Smith [:tsmith] 1.67 KB, text/html		Details
(secure) 9 months ago Masayuki Nakano [:masayuki] (he/him)(JST, +0900) 48 bytes, text/x-phabricator-request		Details \| Review