Assertion failure: !mDoneCreating, at /builds/worker/checkouts/gecko/dom/html/HTMLInputElement.cpp:6410
Categories
(Core :: DOM: Core & HTML, defect, P3)
Tracking
()
People
(Reporter: tsmith, Assigned: emilio)
References
(Blocks 2 open bugs, )
Details
(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])
Attachments
(2 files)
Found while fuzzing m-c 20260215-7edce67f9460 (--enable-debug --enable-fuzzing)
To reproduce via Grizzly Replay:
$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>
Assertion failure: !mDoneCreating, at /builds/worker/checkouts/gecko/dom/html/HTMLInputElement.cpp:6410
0|0|xul.dll|mozilla::dom::HTMLInputElement::DoneCreatingElement()|git:github.com/mozilla-firefox/firefox:dom/html/HTMLInputElement.cpp:cced10961b53e0d29e22e635404fec37728b2644|6410|0x24e
0|1|xul.dll|nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int, bool)|git:github.com/mozilla-firefox/firefox:dom/xml/nsXMLContentSink.cpp:cced10961b53e0d29e22e635404fec37728b2644|1053|0x43c
0|2|xul.dll|nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, unsigned int)|git:github.com/mozilla-firefox/firefox:dom/xml/nsXMLContentSink.cpp:cced10961b53e0d29e22e635404fec37728b2644|984|0x26
0|3|xul.dll|nsExpatDriver::HandleStartElement(rlbox::rlbox_sandbox<rlbox::rlbox_wasm2c_sandbox>&, rlbox::tainted<void *,rlbox::rlbox_wasm2c_sandbox>, rlbox::tainted<const char16_t *,rlbox::rlbox_wasm2c_sandbox>, rlbox::tainted<const char16_t **,rlbox::rlbox_wasm2c_sandbox>)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsExpatDriver.cpp:cced10961b53e0d29e22e635404fec37728b2644|478|0x2fd
0|4|xul.dll|w2c_rlbox_doContent(w2c_rlbox*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int)|s3:gecko-generated-sources:470521566d146ee2ccb5f925050cadd16577938c982c45c52b6104cddd094609e8084d0fb8cbab839507a2175914613c42fcd7ebc7bc3268527ec50b508ce515/security/rlbox/rlbox.wasm.c:|106927|0x15c0
0|5|xul.dll|wrap_w2c_rlbox_contentProcessor(void*, unsigned int, unsigned int, unsigned int, unsigned int)|s3:gecko-generated-sources:470521566d146ee2ccb5f925050cadd16577938c982c45c52b6104cddd094609e8084d0fb8cbab839507a2175914613c42fcd7ebc7bc3268527ec50b508ce515/security/rlbox/rlbox.wasm.c:|6145|0x5f
0|6|xul.dll|w2c_rlbox_callProcessor(w2c_rlbox*, unsigned int, unsigned int, unsigned int, unsigned int)|s3:gecko-generated-sources:470521566d146ee2ccb5f925050cadd16577938c982c45c52b6104cddd094609e8084d0fb8cbab839507a2175914613c42fcd7ebc7bc3268527ec50b508ce515/security/rlbox/rlbox.wasm.c:|100255|0x161
0|7|xul.dll|w2c_rlbox_XML_Parse_0(w2c_rlbox*, unsigned int, unsigned int, unsigned int, unsigned int)|s3:gecko-generated-sources:470521566d146ee2ccb5f925050cadd16577938c982c45c52b6104cddd094609e8084d0fb8cbab839507a2175914613c42fcd7ebc7bc3268527ec50b508ce515/security/rlbox/rlbox.wasm.c:|99954|0x207
0|8|xul.dll|nsExpatDriver::ParseChunk(char16_t const*, unsigned int, nsExpatDriver::ChunkOrBufferIsFinal, unsigned int*, unsigned long*)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsExpatDriver.cpp:cced10961b53e0d29e22e635404fec37728b2644|1239|0x293
0|9|xul.dll|nsExpatDriver::ResumeParse(nsScanner&, bool)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsExpatDriver.cpp:cced10961b53e0d29e22e635404fec37728b2644|1343|0x45b
0|10|xul.dll|nsParser::ResumeParse(bool, bool, bool)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsParser.cpp:cced10961b53e0d29e22e635404fec37728b2644|708|0x13f
0|11|xul.dll|nsParser::Parse(nsTSubstring<char16_t> const&, bool)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsParser.cpp:cced10961b53e0d29e22e635404fec37728b2644|562|0x2f0
0|12|xul.dll|nsParser::ParseFragment(nsTSubstring<char16_t> const&, nsTArray<nsTString<char16_t> >&)|git:github.com/mozilla-firefox/firefox:parser/htmlparser/nsParser.cpp:cced10961b53e0d29e22e635404fec37728b2644|616|0x303
0|13|xul.dll|nsContentUtils::ParseFragmentXML(nsTSubstring<char16_t> const&, mozilla::dom::Document*, nsTArray<nsTString<char16_t> >&, bool, int, mozilla::dom::DocumentFragment**)|git:github.com/mozilla-firefox/firefox:dom/base/nsContentUtils.cpp:cced10961b53e0d29e22e635404fec37728b2644|6480|0x2ed
0|14|xul.dll|nsContentUtils::CreateContextualFragment(nsINode*, nsTSubstring<char16_t> const&, bool, mozilla::ErrorResult&)|git:github.com/mozilla-firefox/firefox:dom/base/nsContentUtils.cpp:cced10961b53e0d29e22e635404fec37728b2644|6112|0x5d2
0|15|xul.dll|mozilla::dom::FragmentOrElement::SetInnerHTMLInternal(nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|git:github.com/mozilla-firefox/firefox:dom/base/FragmentOrElement.cpp:cced10961b53e0d29e22e635404fec37728b2644|2016|0x3a9
0|16|xul.dll|mozilla::dom::Element::SetInnerHTML(mozilla::dom::TrustedHTMLOrNullIsEmptyString const&, nsIPrincipal*, mozilla::ErrorResult&)|git:github.com/mozilla-firefox/firefox:dom/base/Element.cpp:cced10961b53e0d29e22e635404fec37728b2644|5078|0xe7
0|17|xul.dll|mozilla::dom::Element_Binding::set_innerHTML(JSContext*, JS::Handle<JSObject *>, void*, JSJitSetterCallArgs)|s3:gecko-generated-sources:691c53f4ba56fda048bcbb770983c1ad7b6ac85b333891aa06c04cdb0c93e8d999e7bae72bc918afb29dd1de4faa137c92a546edb310d7f5529edfc46f4b4069/dom/bindings/ElementBinding.cpp:|5067|0x1ac
0|18|xul.dll|mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*)|git:github.com/mozilla-firefox/firefox:dom/bindings/BindingUtils.cpp:cced10961b53e0d29e22e635404fec37728b2644|3254|0x1c6
0|19|xul.dll|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|490|0xf2
0|20|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|586|0x1e3
0|21|xul.dll|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|685|0x12c
0|22|xul.dll|js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|816|0xc5
0|23|xul.dll|SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject *>, js::PropertyResult const&, JS::ObjectOpResult&)|git:github.com/mozilla-firefox/firefox:js/src/vm/NativeObject.cpp:cced10961b53e0d29e22e635404fec37728b2644|2756|0x283
0|24|xul.dll|js::NativeSetProperty<1>(JSContext*, JS::Handle<js::NativeObject *>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)|git:github.com/mozilla-firefox/firefox:js/src/vm/NativeObject.cpp:cced10961b53e0d29e22e635404fec37728b2644|2791|0x171
0|25|xul.dll|js::SetProperty(JSContext*, JS::Handle<JSObject *>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)|git:github.com/mozilla-firefox/firefox:js/src/vm/ObjectOperations-inl.h:cced10961b53e0d29e22e635404fec37728b2644|291|0x89
0|26|xul.dll|js::Interpret(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|3018|0x8f3e
0|27|xul.dll|js::RunScript(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|460|0x3c7
0|28|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|618|0x2e6
0|29|xul.dll|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|685|0x12c
0|30|xul.dll|js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName *>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/vm/SelfHosting.cpp:cced10961b53e0d29e22e635404fec37728b2644|1187|0x109
0|31|xul.dll|js::jit::InterpretResume(JSContext*, JS::Handle<JSObject *>, JS::Value*, JS::MutableHandle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/jit/VMFunctions.cpp:cced10961b53e0d29e22e635404fec37728b2644|1199|0x184
0|32|||||
0|33|nss3.dll|_MD_CURRENT_THREAD()|git:github.com/mozilla-firefox/firefox:nsprpub/pr/src/md/windows/w95thred.c:cced10961b53e0d29e22e635404fec37728b2644|318|0xf
0|34|nss3.dll|PR_GetThreadPrivate(unsigned int)|git:github.com/mozilla-firefox/firefox:nsprpub/pr/src/threads/prtpd.c:cced10961b53e0d29e22e635404fec37728b2644|190|0x14
0|35|||||
0|36|xul.dll|js::jit::MaybeEnterJit(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/jit/Jit.cpp:cced10961b53e0d29e22e635404fec37728b2644|255|0x48c
0|37|xul.dll|js::RunScript(JSContext*, js::RunState&)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|450|0x3ae
0|38|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|618|0x2e6
0|39|xul.dll|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla-firefox/firefox:js/src/vm/Interpreter.cpp:cced10961b53e0d29e22e635404fec37728b2644|685|0x12c
0|40|xul.dll|js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName *>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/vm/SelfHosting.cpp:cced10961b53e0d29e22e635404fec37728b2644|1187|0x109
0|41|xul.dll|AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject *>, ResumeKind, JS::Handle<JS::Value>)|git:github.com/mozilla-firefox/firefox:js/src/vm/AsyncFunction.cpp:cced10961b53e0d29e22e635404fec37728b2644|157|0x323
0|42|xul.dll|JS::RunJSMicroTask(JSContext*, JS::Handle<JSObject *>)|git:github.com/mozilla-firefox/firefox:js/src/builtin/Promise.cpp:cced10961b53e0d29e22e635404fec37728b2644|7460|0xf12
0|43|xul.dll|mozilla::MustConsumeMicroTask::RunAndConsumeJSMicroTask(JSContext*)|git:github.com/mozilla-firefox/firefox:xpcom/base/CycleCollectedJSContext.h:cced10961b53e0d29e22e635404fec37728b2644|237|0x67
0|44|xul.dll|mozilla::RunMicroTask(JSContext*, JS::MutableHandle<mozilla::MustConsumeMicroTask>)|git:github.com/mozilla-firefox/firefox:xpcom/base/CycleCollectedJSContext.cpp:cced10961b53e0d29e22e635404fec37728b2644|858|0x6be
0|45|xul.dll|mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool)|git:github.com/mozilla-firefox/firefox:xpcom/base/CycleCollectedJSContext.cpp:cced10961b53e0d29e22e635404fec37728b2644|991|0x1af
0|46|xul.dll|mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int)|git:github.com/mozilla-firefox/firefox:xpcom/base/CycleCollectedJSContext.cpp:cced10961b53e0d29e22e635404fec37728b2644|527|0x18
0|47|xul.dll|XPCJSContext::AfterProcessTask(unsigned int)|git:github.com/mozilla-firefox/firefox:js/xpconnect/src/XPCJSContext.cpp:cced10961b53e0d29e22e635404fec37728b2644|1535|0x374
0|48|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThread.cpp:cced10961b53e0d29e22e635404fec37728b2644|1224|0xbfa
0|49|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThreadUtils.cpp:cced10961b53e0d29e22e635404fec37728b2644|461|0x70
0|50|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:cced10961b53e0d29e22e635404fec37728b2644|85|0xb7
0|51|xul.dll|MessageLoop::RunHandler()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:cced10961b53e0d29e22e635404fec37728b2644|366|0x3e
0|52|xul.dll|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:cced10961b53e0d29e22e635404fec37728b2644|348|0x6e
0|53|xul.dll|nsBaseAppShell::Run()|git:github.com/mozilla-firefox/firefox:widget/nsBaseAppShell.cpp:cced10961b53e0d29e22e635404fec37728b2644|152|0x27
0|54|xul.dll|nsAppShell::Run()|git:github.com/mozilla-firefox/firefox:widget/windows/nsAppShell.cpp:cced10961b53e0d29e22e635404fec37728b2644|673|0x17d
0|55|xul.dll|XRE_RunAppShell()|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsEmbedFunctions.cpp:cced10961b53e0d29e22e635404fec37728b2644|652|0x78
0|56|xul.dll|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:cced10961b53e0d29e22e635404fec37728b2644|235|0x39
0|57|xul.dll|MessageLoop::RunHandler()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:cced10961b53e0d29e22e635404fec37728b2644|366|0x3e
0|58|xul.dll|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:cced10961b53e0d29e22e635404fec37728b2644|348|0x6e
0|59|xul.dll|XRE_InitChildProcess(int, char**, XREChildData const*)|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsEmbedFunctions.cpp:cced10961b53e0d29e22e635404fec37728b2644|590|0x9e8
0|60|firefox.exe|NS_internal_main(int, char**, char**)|git:github.com/mozilla-firefox/firefox:browser/app/nsBrowserApp.cpp:cced10961b53e0d29e22e635404fec37728b2644|465|0x235
0|61|firefox.exe|wmain(int, wchar_t**)|git:github.com/mozilla-firefox/firefox:toolkit/xre/nsWindowsWMain.cpp:cced10961b53e0d29e22e635404fec37728b2644|150|0x246
0|62|firefox.exe|__scrt_common_main_seh()|/builds/worker/workspace/obj-build/browser/app/D:/a/_work/1/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl|288|0x10b
| Reporter | ||
Comment 1•1 month ago
|
||
This has also been reported via live site testing.
| Assignee | ||
Updated•1 month ago
|
Comment 2•1 month ago
|
||
Verified bug as reproducible on mozilla-central 20260218044552-96c5619a38c8.
The bug appears to have been introduced in the following build range:
Start: 1ec7212ec5c8aa30ecc017a6d150820033d7504b (20260215140345)
End: 7edce67f9460fe9b691970ba3deb341819de3e2a (20260215194036)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1ec7212ec5c8aa30ecc017a6d150820033d7504b&tochange=7edce67f9460fe9b691970ba3deb341819de3e2a
Comment 3•1 month ago
|
||
Based on comment #2, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.
:emilio, since you are the author of the changes in the range, if possible, could you fill the Regressed by field and investigate this regression?
For more information, please visit BugBot documentation.
| Assignee | ||
Comment 4•1 month ago
|
||
Right now it was doing something extremely weird where it notified as
parser created of some things (like DoneCreatingElement()) but not
others (like DoneAddingChildren()).
Updated•1 month ago
|
| Assignee | ||
Updated•1 month ago
|
Updated•1 month ago
|
| Assignee | ||
Comment 6•1 month ago
|
||
The regressing bug didn't change this test-case's behavior (but it added the assertion that's now firing)
Comment 10•1 month ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/ecc39c378f04
https://hg.mozilla.org/mozilla-central/rev/f9d1f1faa99b
Comment 11•1 month ago
|
||
Testcase crashes using the initial build (mozilla-central 20260215214423-7edce67f9460) but not with tip (mozilla-central 20260221090124-501ded2d35df.)
The bug appears to have been fixed in the following build range:
Start: 50bc2a950f309482bc4bddf6aa536c8fb25d6724 (20260220111208)
End: 90a4df5cc2f64540f934abc4e163a4ac3118d768 (20260220121640)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=50bc2a950f309482bc4bddf6aa536c8fb25d6724&tochange=90a4df5cc2f64540f934abc4e163a4ac3118d768
emilio, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
| Assignee | ||
Comment 12•1 month ago
|
||
I mean, it includes the patch on this bug, so yeah. Jason do you know if that ni? is expected?
Updated•1 month ago
|
| Comment hidden (Intermittent Failures Robot) |
Comment 15•1 month ago
|
||
(In reply to Emilio Cobos Álvarez [:emilio] from comment #12)
I mean, it includes the patch on this bug, so yeah. Jason do you know if that ni? is expected?
Yes. Unfortunately it looks like it's a race with when the bug was fetched and when the patch was landed. I'll file an issue for it.
Description
•