Closed Bug 2017504 Opened 1 month ago Closed 1 month ago

Assertion failure: !mDoneCreating, at /builds/worker/checkouts/gecko/dom/html/HTMLInputElement.cpp:6410

Categories

(Core :: DOM: Core & HTML, defect, P3)

defect

Tracking

()

VERIFIED FIXED
149 Branch
Tracking Status
firefox-esr115 --- wontfix
firefox-esr140 --- wontfix
firefox148 --- wontfix
firefox149 --- fixed

People

(Reporter: tsmith, Assigned: emilio)

References

(Blocks 2 open bugs, )

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files)

Attached file testcase.html

Found while fuzzing m-c 20260215-7edce67f9460 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !mDoneCreating, at /builds/worker/checkouts/gecko/dom/html/HTMLInputElement.cpp:6410

0|0|xul.dll|mozilla::dom::HTMLInputElement::DoneCreatingElement()|git:github.com/mozilla-firefox/firefox:dom/html/HTMLInputElement.cpp:cced10961b53e0d29e22e635404fec37728b2644|6410|0x24e
0|1|xul.dll|nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int, bool)|git:github.com/mozilla-firefox/firefox:dom/xml/nsXMLContentSink.cpp:cced10961b53e0d29e22e635404fec37728b2644|1053|0x43c
0|2|xul.dll|nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int)|git:github.com/mozilla-firefox/firefox:dom/xml/nsXMLContentSink.cpp:cced10961b53e0d29e22e635404fec37728b2644|984|0x26
0|3|xul.dll|nsExpatDriver::HandleStartElement(rlbox::rlbox_sandbox<rlbox::rlbox_wasm2c_sandbox>&, rlbox::tainted<void *,rlbox::rlbox_wasm2c_sandbox>, rlbox::tainted<const char16_t *,rlbox::rlbox_wasm2c_sandbox>, rlbox::tainted<const char16_t **,rlbox::rlbox_wasm2c_sandbox>)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsExpatDriver.cpp:cced10961b53e0d29e22e635404fec37728b2644|478|0x2fd
0|4|xul.dll|w2c_rlbox_doContent(w2c_rlbox*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int)|s3:gecko-generated-sources:470521566d146ee2ccb5f925050cadd16577938c982c45c52b6104cddd094609e8084d0fb8cbab839507a2175914613c42fcd7ebc7bc3268527ec50b508ce515/security/rlbox/rlbox.wasm.c:|106927|0x15c0
0|5|xul.dll|wrap_w2c_rlbox_contentProcessor(void*, unsigned int, unsigned int, unsigned int, unsigned int)|s3:gecko-generated-sources:470521566d146ee2ccb5f925050cadd16577938c982c45c52b6104cddd094609e8084d0fb8cbab839507a2175914613c42fcd7ebc7bc3268527ec50b508ce515/security/rlbox/rlbox.wasm.c:|6145|0x5f
0|6|xul.dll|w2c_rlbox_callProcessor(w2c_rlbox*, unsigned int, unsigned int, unsigned int, unsigned int)|s3:gecko-generated-sources:470521566d146ee2ccb5f925050cadd16577938c982c45c52b6104cddd094609e8084d0fb8cbab839507a2175914613c42fcd7ebc7bc3268527ec50b508ce515/security/rlbox/rlbox.wasm.c:|100255|0x161
0|7|xul.dll|w2c_rlbox_XML_Parse_0(w2c_rlbox*, unsigned int, unsigned int, unsigned int, unsigned int)|s3:gecko-generated-sources:470521566d146ee2ccb5f925050cadd16577938c982c45c52b6104cddd094609e8084d0fb8cbab839507a2175914613c42fcd7ebc7bc3268527ec50b508ce515/security/rlbox/rlbox.wasm.c:|99954|0x207
0|8|xul.dll|nsExpatDriver::ParseChunk(char16_t const*, unsigned int, nsExpatDriver::ChunkOrBufferIsFinal, unsigned int*, unsigned long*)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsExpatDriver.cpp:cced10961b53e0d29e22e635404fec37728b2644|1239|0x293
0|9|xul.dll|nsExpatDriver::ResumeParse(nsScanner&, bool)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsExpatDriver.cpp:cced10961b53e0d29e22e635404fec37728b2644|1343|0x45b
0|10|xul.dll|nsParser::ResumeParse(bool, bool, bool)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsParser.cpp:cced10961b53e0d29e22e635404fec37728b2644|708|0x13f
0|11|xul.dll|nsParser::Parse(nsTSubstring<char16_t> const&, bool)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsParser.cpp:cced10961b53e0d29e22e635404fec37728b2644|562|0x2f0
0|12|xul.dll|nsParser::ParseFragment(nsTSubstring<char16_t> const&, nsTArray<nsTString<char16_t> >&)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsParser.cpp:cced10961b53e0d29e22e635404fec37728b2644|616|0x303
0|13|xul.dll|nsContentUtils::ParseFragmentXML(nsTSubstring<char16_t> const&, mozilla::dom::Document*, nsTArray<nsTString<char16_t> >&, bool, int, mozilla::dom::DocumentFragment**)|git:github.com/mozilla-firefox/firefox:dom/base/nsContentUtils.cpp:cced10961b53e0d29e22e635404fec37728b2644|6480|0x2ed
0|14|xul.dll|nsContentUtils::CreateContextualFragment(nsINode*, nsTSubstring<char16_t> const&, bool, mozilla::ErrorResult&)|git:github.com/mozilla-firefox/firefox:dom/base/nsContentUtils.cpp:cced10961b53e0d29e22e635404fec37728b2644|6112|0x5d2
0|15|xul.dll|mozilla::dom::FragmentOrElement::SetInnerHTMLInternal(nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|git:github.com/mozilla-firefox/firefox:dom/base/FragmentOrElement.cpp:cced10961b53e0d29e22e635404fec37728b2644|2016|0x3a9
0|16|xul.dll|mozilla::dom::Element::SetInnerHTML(mozilla::dom::TrustedHTMLOrNullIsEmptyString const&, nsIPrincipal*, mozilla::ErrorResult&)|git:github.com/mozilla-firefox/firefox:dom/base/Element.cpp:cced10961b53e0d29e22e635404fec37728b2644|5078|0xe7
0|17|xul.dll|mozilla::dom::Element_Binding::set_innerHTML(JSContext*, JS::Handle<JSObject *>, void*, JSJitSetterCallArgs)|s3:gecko-generated-sources:691c53f4ba56fda048bcbb770983c1ad7b6ac85b333891aa06c04cdb0c93e8d999e7bae72bc918afb29dd1de4faa137c92a546edb310d7f5529edfc46f4b4069/dom/bindings/ElementBinding.cpp:|5067|0x1ac
0|18|xul.dll|mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*)|git:github.com/mozilla-firefox/firefox:dom/bindings/BindingUtils.cpp:cced10961b53e0d29e22e635404fec37728b2644|3254|0x1c6
0|19|xul.dll|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|490|0xf2
0|20|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|586|0x1e3
0|21|xul.dll|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|685|0x12c
0|22|xul.dll|js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|816|0xc5
0|23|xul.dll|SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject *>, js::PropertyResult const&, JS::ObjectOpResult&)|git:github.com/mozilla-firefox/firefox:js/src/vm/NativeObject.cpp:cced10961b53e0d29e22e635404fec37728b2644|2756|0x283
0|24|xul.dll|js::NativeSetProperty<1>(JSContext*, JS::Handle<js::NativeObject *>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)|git:github.com/mozilla-firefox/firefox:js/src/vm/NativeObject.cpp:cced10961b53e0d29e22e635404fec37728b2644|2791|0x171
0|25|xul.dll|js::SetProperty(JSContext*, JS::Handle<JSObject *>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)|git:github.com/mozilla-firefox/firefox:js/src/vm/ObjectOperations-inl.h:cced10961b53e0d29e22e635404fec37728b2644|291|0x89
0|26|xul.dll|js::Interpret(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|3018|0x8f3e
0|27|xul.dll|js::RunScript(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|460|0x3c7
0|28|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|618|0x2e6
0|29|xul.dll|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|685|0x12c
0|30|xul.dll|js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName *>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/vm/SelfHosting.cpp:cced10961b53e0d29e22e635404fec37728b2644|1187|0x109
0|31|xul.dll|js::jit::InterpretResume(JSContext*, JS::Handle<JSObject *>, JS::Value*, JS::MutableHandle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/jit/VMFunctions.cpp:cced10961b53e0d29e22e635404fec37728b2644|1199|0x184
0|32|||||
0|33|nss3.dll|_MD_CURRENT_THREAD()|git:github.com/mozilla-firefox/firefox:nsprpub/pr/src/md/windows/w95thred.c:cced10961b53e0d29e22e635404fec37728b2644|318|0xf
0|34|nss3.dll|PR_GetThreadPrivate(unsigned int)|git:github.com/mozilla-firefox/firefox:nsprpub/pr/src/threads/prtpd.c:cced10961b53e0d29e22e635404fec37728b2644|190|0x14
0|35|||||
0|36|xul.dll|js::jit::MaybeEnterJit(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/jit/Jit.cpp:cced10961b53e0d29e22e635404fec37728b2644|255|0x48c
0|37|xul.dll|js::RunScript(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|450|0x3ae
0|38|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|618|0x2e6
0|39|xul.dll|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|685|0x12c
0|40|xul.dll|js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName *>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/vm/SelfHosting.cpp:cced10961b53e0d29e22e635404fec37728b2644|1187|0x109
0|41|xul.dll|AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject *>, ResumeKind, JS::Handle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/vm/AsyncFunction.cpp:cced10961b53e0d29e22e635404fec37728b2644|157|0x323
0|42|xul.dll|JS::RunJSMicroTask(JSContext*, JS::Handle<JSObject *>)|git:github.com/mozilla-firefox/firefox:js/src/builtin/Promise.cpp:cced10961b53e0d29e22e635404fec37728b2644|7460|0xf12
0|43|xul.dll|mozilla::MustConsumeMicroTask::RunAndConsumeJSMicroTask(JSContext*)|git:github.com/mozilla-firefox/firefox:xpcom/base/CycleCollectedJSContext.h:cced10961b53e0d29e22e635404fec37728b2644|237|0x67
0|44|xul.dll|mozilla::RunMicroTask(JSContext*, JS::MutableHandle<mozilla::MustConsumeMicroTask>)|git:github.com/mozilla-firefox/firefox:xpcom/base/CycleCollectedJSContext.cpp:cced10961b53e0d29e22e635404fec37728b2644|858|0x6be
0|45|xul.dll|mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool)|git:github.com/mozilla-firefox/firefox:xpcom/base/CycleCollectedJSContext.cpp:cced10961b53e0d29e22e635404fec37728b2644|991|0x1af
0|46|xul.dll|mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int)|git:github.com/mozilla-firefox/firefox:xpcom/base/CycleCollectedJSContext.cpp:cced10961b53e0d29e22e635404fec37728b2644|527|0x18
0|47|xul.dll|XPCJSContext::AfterProcessTask(unsigned int)|git:github.com/mozilla-firefox/firefox:js/xpconnect/src/XPCJSContext.cpp:cced10961b53e0d29e22e635404fec37728b2644|1535|0x374
0|48|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThread.cpp:cced10961b53e0d29e22e635404fec37728b2644|1224|0xbfa
0|49|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThreadUtils.cpp:cced10961b53e0d29e22e635404fec37728b2644|461|0x70
0|50|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:cced10961b53e0d29e22e635404fec37728b2644|85|0xb7
0|51|xul.dll|MessageLoop::RunHandler()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:cced10961b53e0d29e22e635404fec37728b2644|366|0x3e
0|52|xul.dll|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:cced10961b53e0d29e22e635404fec37728b2644|348|0x6e
0|53|xul.dll|nsBaseAppShell::Run()|git:github.com/mozilla-firefox/firefox:widget/nsBaseAppShell.cpp:cced10961b53e0d29e22e635404fec37728b2644|152|0x27
0|54|xul.dll|nsAppShell::Run()|git:github.com/mozilla-firefox/firefox:widget/windows/nsAppShell.cpp:cced10961b53e0d29e22e635404fec37728b2644|673|0x17d
0|55|xul.dll|XRE_RunAppShell()|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsEmbedFunctions.cpp:cced10961b53e0d29e22e635404fec37728b2644|652|0x78
0|56|xul.dll|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:cced10961b53e0d29e22e635404fec37728b2644|235|0x39
0|57|xul.dll|MessageLoop::RunHandler()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:cced10961b53e0d29e22e635404fec37728b2644|366|0x3e
0|58|xul.dll|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:cced10961b53e0d29e22e635404fec37728b2644|348|0x6e
0|59|xul.dll|XRE_InitChildProcess(int, char**, XREChildData const*)|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsEmbedFunctions.cpp:cced10961b53e0d29e22e635404fec37728b2644|590|0x9e8
0|60|firefox.exe|NS_internal_main(int, char**, char**)|git:github.com/mozilla-firefox/firefox:browser/app/nsBrowserApp.cpp:cced10961b53e0d29e22e635404fec37728b2644|465|0x235
0|61|firefox.exe|wmain(int, wchar_t**)|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsWindowsWMain.cpp:cced10961b53e0d29e22e635404fec37728b2644|150|0x246
0|62|firefox.exe|__scrt_common_main_seh()|/builds/worker/workspace/obj-build/browser/app/D:/a/_work/1/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl|288|0x10b
Flags: in-testsuite?

This has also been reported via live site testing.

Flags: needinfo?(emilio)

Verified bug as reproducible on mozilla-central 20260218044552-96c5619a38c8.
The bug appears to have been introduced in the following build range:

Start: 1ec7212ec5c8aa30ecc017a6d150820033d7504b (20260215140345)
End: 7edce67f9460fe9b691970ba3deb341819de3e2a (20260215194036)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1ec7212ec5c8aa30ecc017a6d150820033d7504b&tochange=7edce67f9460fe9b691970ba3deb341819de3e2a

Keywords: regression
Whiteboard: [bugmon:bisected,confirmed]

Based on comment #2, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:emilio, since you are the author of the changes in the range, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Flags: needinfo?(emilio)

Right now it was doing something extremely weird where it notified as
parser created of some things (like DoneCreatingElement()) but not
others (like DoneAddingChildren()).

Assignee: nobody → emilio
Status: NEW → ASSIGNED
Flags: needinfo?(emilio)
Attachment #9546225 - Attachment description: Bug 2017504 - Make fragment content sink stop claiming that elements are not parser created. r=hsivonen → Bug 2017504 - Make XML fragment content sink stop claiming that elements are not parser created. r=hsivonen

Emilio, would you mind assigning a severity?

Flags: needinfo?(emilio)

The regressing bug didn't change this test-case's behavior (but it added the assertion that's now firing)

Severity: -- → S3
Flags: needinfo?(emilio)
Priority: -- → P3
Pushed by ealvarez@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/f0acf726a3e3 https://hg.mozilla.org/integration/autoland/rev/ecc39c378f04 Make XML fragment content sink stop claiming that elements are not parser created. r=hsivonen,dom-core
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/57926 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]
Status: ASSIGNED → RESOLVED
Closed: 1 month ago
Resolution: --- → FIXED
Target Milestone: --- → 149 Branch

Testcase crashes using the initial build (mozilla-central 20260215214423-7edce67f9460) but not with tip (mozilla-central 20260221090124-501ded2d35df.)

The bug appears to have been fixed in the following build range:

Start: 50bc2a950f309482bc4bddf6aa536c8fb25d6724 (20260220111208)
End: 90a4df5cc2f64540f934abc4e163a4ac3118d768 (20260220121640)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=50bc2a950f309482bc4bddf6aa536c8fb25d6724&tochange=90a4df5cc2f64540f934abc4e163a4ac3118d768

emilio, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Flags: needinfo?(emilio)
Keywords: bugmon

I mean, it includes the patch on this bug, so yeah. Jason do you know if that ni? is expected?

Status: RESOLVED → VERIFIED
Flags: needinfo?(emilio) → needinfo?(jkratzer)
Upstream PR merged by moz-wptsync-bot
Flags: in-testsuite? → in-testsuite+

(In reply to Emilio Cobos Álvarez [:emilio] from comment #12)

I mean, it includes the patch on this bug, so yeah. Jason do you know if that ni? is expected?

Yes. Unfortunately it looks like it's a race with when the bug was fetched and when the patch was landed. I'll file an issue for it.

Flags: needinfo?(jkratzer)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: