2018695 - Assertion failure: mDocument->GetReadyStateEnum() == Document::READYSTATE_INTERACTIVE (Bad readyState), at /builds/worker/checkouts/gecko/dom/xslt/xslt/txMozillaTextOutput.cpp:85

Status: NEW

(Core :: XSLT, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260220-d46c04335970 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: mDocument->GetReadyStateEnum() == Document::READYSTATE_INTERACTIVE (Bad readyState), at /builds/worker/checkouts/gecko/dom/xslt/xslt/txMozillaTextOutput.cpp:85

#0 0x72c6c24b62a7 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
#1 0x72c6c24b62a7 in txMozillaTextOutput::endDocument(nsresult) /builds/worker/checkouts/gecko/dom/xslt/xslt/txMozillaTextOutput.cpp:83:5
#2 0x72c6c24c25cd in txMozillaXSLTProcessor::TransformToFragment(nsINode&, mozilla::dom::Document&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/xslt/xslt/txMozillaXSLTProcessor.cpp:801:23
#3 0x72c6bfc09bf0 in mozilla::dom::XSLTProcessor_Binding::transformToFragment(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./XSLTProcessorBinding.cpp:1056:83
#4 0x72c6c00502c6 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3310:13
#5 0x72c6c4c23654 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:490:13
#6 0x72c6c4c22eff in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:586:12
#7 0x72c6c4c33be2 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:658:10
#8 0x72c6c4c33be2 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3272:16
#9 0x72c6c4c2257a in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:460:13
#10 0x72c6c4c258e0 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:850:10
#11 0x72c6c4c25d9e in js::Execute(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:880:10
#12 0x72c6c4e82881 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:548:10
#13 0x72c6c4e82a63 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>) /builds/worker/checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:572:10
#14 0x72c6c25f9d5b in ExecuteCompiledScript /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:3010:8
#15 0x72c6c25f9d5b in mozilla::dom::ScriptLoader::EvaluateScript(nsIGlobalObject*, JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:3611:5
#16 0x72c6c25f8c6e in mozilla::dom::ScriptLoader::EvaluateScriptElement(JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:3115:10
#17 0x72c6c25f52c6 in mozilla::dom::ScriptLoader::ProcessRequest(JS::loader::ScriptLoadRequest*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:2522:17
#18 0x72c6c25f3829 in mozilla::dom::ScriptLoader::ProcessInlineScript(nsIScriptElement*, JS::loader::ScriptKind, nsTSubstring<char16_t> const&) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:1790:10
#19 0x72c6c25e5b96 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*, nsTSubstring<char16_t> const&) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:1321:10
#20 0x72c6c25e557c in mozilla::dom::ScriptElement::MaybeProcessScript(nsTSubstring<char16_t> const&) /builds/worker/checkouts/gecko/dom/script/ScriptElement.cpp:289:18
#21 0x72c6c25e4f0d in mozilla::dom::ScriptElement::MaybeProcessScript(nsCOMPtr<nsIParser>) /builds/worker/checkouts/gecko/dom/script/ScriptElement.cpp:162:18
#22 0x72c6c26081e3 in nsIScriptElement::AttemptToExecute(nsCOMPtr<nsIParser>) /builds/worker/checkouts/gecko/dom/script/nsIScriptElement.cpp:78:16
#23 0x72c6bdb6b1a4 in nsHtml5TreeOpExecutor::RunScript(nsIContent*, bool) /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:935:22
#24 0x72c6bdb6892e in nsHtml5TreeOpExecutor::RunFlushLoop() /builds/worker/checkouts/gecko/parser/html/nsHtml5TreeOpExecutor.cpp:715:7
#25 0x72c6bdb6eefc in nsHtml5ExecutorFlusher::Run() /builds/worker/checkouts/gecko/parser/html/nsHtml5StreamParser.cpp:158:18
#26 0x72c6bcb3c887 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:721:16
#27 0x72c6bcb36f54 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1342:20
#28 0x72c6bcb35bd7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1165:15
#29 0x72c6bcb36055 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:657:36
#30 0x72c6bcb45b66 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:349:37
#31 0x72c6bcb45b66 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:549:5
#32 0x72c6bcb58103 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1169:16
#33 0x72c6bcb5dd5f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
#34 0x72c6bd754b57 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#35 0x72c6bd6adf11 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:366:3
#36 0x72c6bd6adf11 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:348:3
#37 0x72c6c2857e78 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:152:27
#38 0x72c6c2923754 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:555:33
#39 0x72c6c397723b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:20
#40 0x72c6bd755a04 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#41 0x72c6bd6adf11 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:366:3
#42 0x72c6bd6adf11 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:348:3
#43 0x72c6c397699f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:590:34
#44 0x62d6473b700c in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:467:22

Comment 1

[Frederik Braun [:freddy]]

The code appears to overwrite the ready state after the assertion fails, making this a safe crash.

Comment 2

[Frederik Braun [:freddy]]

That's in https://searchfox.org/firefox-main/rev/871325b8460362073cb2069874bef7dde3170cb2/dom/base/Document.cpp#3586-3588

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260224095058-12cf317db342.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 74fc528d64f449162e2eda609969a49e96c0965b (20250225214549)
End: d46c043359705d9752844c2dcedefdeffb86dee9 (20260220162739)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 4

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 2018695 using build mozilla-central 20260220162739-d46c04335970. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 5

[Intermittent Failures Robot]

1 failures were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Table

	no_variant
android-x86_64/debug	1

For more details, see:

https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=2018695&startday=2026-10-05&endday=2026-10-11&tree=all