2068066 - Hit MOZ_CRASH(ElementAt(aIndex = 255, aLength = 0)) at checkouts/gecko/mfbt/Assertions.cpp:51

Status: VERIFIED FIXED

(Core :: Web Speech, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev a7cfaf6198b0 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build a7cfaf6198b0 --asan --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(ElementAt(aIndex = 255, aLength = 0)) at checkouts/gecko/mfbt/Assertions.cpp:51

    =================================================================
    ==3053558==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x61746779dd91 bp 0x7ffec3989050 sp 0x7ffec3989040 T0)
    ==3053558==The signal is caused by a WRITE memory access.
    ==3053558==Hint: address points to the zero page.
        #0 0x61746779dd91 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
        #1 0x61746779dd91 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:402:3
        #2 0x61746779dd91 in mozilla::detail::InvalidArrayIndex_CRASH(unsigned long, unsigned long) /builds/worker/workspace/obj-build/mfbt/./../../../checkouts/gecko/mfbt/Assertions.cpp:50:3
        #3 0x72f3d5c9028a in ElementAt /builds/worker/workspace/obj-build/dist/include/nsTArray.h:1026:7
        #4 0x72f3d5c9028a in mozilla::dom::SpeechGrammarList::Item(unsigned int, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/media/webspeech/recognition/./../../../../../../checkouts/gecko/dom/media/webspeech/recognition/SpeechGrammarList.cpp:45:41
        #5 0x72f3d181b931 in mozilla::dom::SpeechGrammarList_Binding::item(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./SpeechGrammarListBinding.cpp:141:80
        #6 0x72f3d2546b38 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./../../../../checkouts/gecko/dom/bindings/BindingUtils.cpp:3212:13
        #7 0x72f3dbc1c433 in CallJSNative /js/src/vm/Interpreter.cpp:526:13
        #8 0x72f3dbc1c433 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:622:12
        #9 0x72f3dacca2f4 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/obj-build/js/src/jit/./../../../../../checkouts/gecko/js/src/jit/BaselineIC.cpp:1717:10
        #10 0x3ab6c81479d3  ([anon:js-executable-memory]+0x29d3)
    
    ==3053558==Register values:
    rax = 0x0000000000000001  rbx = 0x000061746820d020  rcx = 0x0000000000000033  rdx = 0x0000000000000000
    rdi = 0x00006174678c9dc0  rsi = 0x00007ffec3988ff8  rbp = 0x00007ffec3989050  rsp = 0x00007ffec3989040
     r8 = 0x0000000000000000   r9 = 0xffffff0000000000  r10 = 0xefffffffffffffff  r11 = 0x4000000000000000
    r12 = 0x000074d3f2fe4880  r13 = 0x00000fffd8731214  r14 = 0x0000000000000000  r15 = 0x00007353f31756e0
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV (/home/jkratzer/builds/m-c-20260901040856-fuzzing-asan-opt/firefox+0x1c9d91) (BuildId: caaee1b971e4df3ed247915f03064cbfdf0fb0a6)
    ==3053558==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260901103215-8a5eb3c1adf6.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: af222f790798d269286ae636efcb5e26c43b5e88 (20250902210651)
End: a7cfaf6198b081f33480560abb63a03353903bfe (20260901040856)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 3

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:padenot, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Paul Adenot (:padenot)]

Attachment: Bug 2068066 - Return null from *List.item() in Web Speech when the index is out of range. r?#media-playback-reviewers

item() indexed straight into the array, so an out-of-range index crashed.
Blink's item() returns nullptr there and its bindings hand that to JS as
null, so make the WebIDL return type nullable and do the same.

https://github.com/WebAudio/web-speech-api/pull/212 aligns the spec.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/15e65f9002f4
https://hg.mozilla.org/integration/autoland/rev/7345f092b989
Return null from *List.item() in Web Speech when the index is out of range. r=media-playback-reviewers,webidl,smaug,alwu

Comment 6

[Paul Adenot (:padenot)]

Attachment: Bug 2068066 - Disable SpeechGrammarList-item.https.html on Android.

SpeechGrammarList is not built there, so the test can only fail.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/3c4c7764886e
https://hg.mozilla.org/integration/autoland/rev/ad7d6c889447
Disable SpeechGrammarList-item.https.html on Android.

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/62566 for changes under testing/web-platform/tests

Comment 9

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/7345f092b989
https://hg.mozilla.org/mozilla-central/rev/ad7d6c889447

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260909162955-a093d32a3d8b.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 11

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot