Jason Kratzer [:jkratzer] Reporter
	Description • 6 years ago

Testcase found while fuzzing mozilla-central rev 5866d6685849.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007fd10d3672dd   rbx = 0x00007ffd9fbb6d18
rsi = 0x00007fd10d636770   rdi = 0x00007fd10d635540
rbp = 0x00007ffd9fbb6cb0   rsp = 0x00007ffd9fbb6c50
r8 = 0x00007fd10d636770    r9 = 0x00007fd10e712740
r10 = 0x0000000000000037   r11 = 0x0000000000000000
r12 = 0x00007fd10d0ee7e0   r13 = 0x0000000000000000
r14 = 0x00007ffd9fbb6cd0   r15 = 0x0000000000000000
rip = 0x00007fd0fc6558ee
OS|Linux|0.0.0 Linux 4.4.0-103-generic #126-Ubuntu SMP Mon Dec 4 16:23:28 UTC 2017 x86_64
CPU|amd64|family 6 model 60 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::AnimationEffect::GetComputedTimingAt|hg:hg.mozilla.org/mozilla-central:dom/animation/AnimationEffect.cpp:5866d6685849311f057e7e229b9ace63a2641c29|111|0x18
0|1|libxul.so|mozilla::dom::AnimationEffect::GetComputedTiming|hg:hg.mozilla.org/mozilla-central:dom/animation/AnimationEffect.cpp:5866d6685849311f057e7e229b9ace63a2641c29|267|0x13
0|2|libxul.so|mozilla::dom::AnimationEffect::IsInEffect|hg:hg.mozilla.org/mozilla-central:dom/animation/AnimationEffect.cpp:5866d6685849311f057e7e229b9ace63a2641c29|55|0x8
0|3|libxul.so|mozilla::dom::Animation::UpdateRelevance|hg:hg.mozilla.org/mozilla-central:dom/animation/Animation.h:5866d6685849311f057e7e229b9ace63a2641c29|323|0xa
0|4|libxul.so|mozilla::dom::Animation::UpdateEffect|hg:hg.mozilla.org/mozilla-central:dom/animation/Animation.cpp:5866d6685849311f057e7e229b9ace63a2641c29|1411|0x5
0|5|libxul.so|mozilla::dom::Animation::UpdateTiming|hg:hg.mozilla.org/mozilla-central:dom/animation/Animation.cpp:5866d6685849311f057e7e229b9ace63a2641c29|1344|0x8
0|6|libxul.so|mozilla::dom::Animation::PlayNoUpdate|hg:hg.mozilla.org/mozilla-central:dom/animation/Animation.cpp:5866d6685849311f057e7e229b9ace63a2641c29|1206|0x13
0|7|libxul.so|mozilla::dom::Animation::Play|hg:hg.mozilla.org/mozilla-central:dom/animation/Animation.cpp:5866d6685849311f057e7e229b9ace63a2641c29|597|0x5
0|8|libxul.so|mozilla::dom::Element::Animate|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:5866d6685849311f057e7e229b9ace63a2641c29|3698|0x19
0|9|libxul.so|mozilla::dom::Element::Animate|hg:hg.mozilla.org/mozilla-central:dom/base/Element.cpp:5866d6685849311f057e7e229b9ace63a2641c29|3637|0xe
0|10|libxul.so|mozilla::dom::ElementBinding::animate|s3:gecko-generated-sources:8d8efad138e788edd838ecadcad5d9739c8b35ee849925b66318e9e8eaaa74387c5d031eaf8e6e6dddea69f941f4e4e4329fb392fcdf71f90fac31b10edbf246/dom/bindings/ElementBinding.cpp:|4246|0x12
0|11|libxul.so|mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:5866d6685849311f057e7e229b9ace63a2641c29|3285|0x9
0|12|libxul.so|js::CallJSNative|hg:hg.mozilla.org/mozilla-central:js/src/vm/JSContext-inl.h:5866d6685849311f057e7e229b9ace63a2641c29|279|0x6
0|13|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5866d6685849311f057e7e229b9ace63a2641c29|471|0xf
0|14|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5866d6685849311f057e7e229b9ace63a2641c29|520|0xd
0|15|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5866d6685849311f057e7e229b9ace63a2641c29|526|0xf
0|16|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5866d6685849311f057e7e229b9ace63a2641c29|421|0xb
0|17|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5866d6685849311f057e7e229b9ace63a2641c29|493|0xf
0|18|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5866d6685849311f057e7e229b9ace63a2641c29|520|0xd
0|19|libxul.so|js::Call|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5866d6685849311f057e7e229b9ace63a2641c29|539|0x5
0|20|libxul.so|JS::Call|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5866d6685849311f057e7e229b9ace63a2641c29|2981|0x20
0|21|libxul.so|mozilla::dom::EventListener::HandleEvent|s3:gecko-generated-sources:ccbadb8791154c00d5d9f3f34300a418cdfa4b3b0b60424e60394883162a95118b3edbfce81cbc7a5b48193d5a2618fc449143e250bd5c61dd1340709a3af189/dom/bindings/EventListenerBinding.cpp:|51|0x5
0|22|libxul.so|mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>|s3:gecko-generated-sources:0502cca494d7ae0441ada14535523caade9340fdd09934cf6d31cc421267c319ae3d6f5b43b2730d0b36ae1c87480f3b426c5fa4fec57d51047d83a51acde602/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|23|libxul.so|mozilla::EventListenerManager::HandleEventSubType|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:5866d6685849311f057e7e229b9ace63a2641c29|1121|0x26
0|24|libxul.so|mozilla::EventListenerManager::HandleEventInternal|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:5866d6685849311f057e7e229b9ace63a2641c29|1298|0x15
0|25|libxul.so|mozilla::EventTargetChainItem::HandleEvent|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:5866d6685849311f057e7e229b9ace63a2641c29|393|0xa
0|26|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:5866d6685849311f057e7e229b9ace63a2641c29|620|0x12
0|27|libxul.so|mozilla::EventDispatcher::Dispatch|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:5866d6685849311f057e7e229b9ace63a2641c29|1087|0xb
0|28|libxul.so|nsDocumentViewer::LoadComplete|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:5866d6685849311f057e7e229b9ace63a2641c29|1166|0x2c
0|29|libxul.so|nsDocShell::EndPageLoad|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:5866d6685849311f057e7e229b9ace63a2641c29|7161|0x18
0|30|libxul.so|nsDocShell::OnStateChange|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:5866d6685849311f057e7e229b9ace63a2641c29|6954|0x18
0|31|libxul.so|nsDocLoader::DoFireOnStateChange|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:5866d6685849311f057e7e229b9ace63a2641c29|1309|0x2b
0|32|libxul.so|nsDocLoader::doStopDocumentLoad|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:5866d6685849311f057e7e229b9ace63a2641c29|852|0x22
0|33|libxul.so|nsDocLoader::DocLoaderIsEmpty|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:5866d6685849311f057e7e229b9ace63a2641c29|741|0xf
0|34|libxul.so|nsDocLoader::OnStopRequest|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:5866d6685849311f057e7e229b9ace63a2641c29|627|0x16
0|35|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:5866d6685849311f057e7e229b9ace63a2641c29|629|0x1f
0|36|libxul.so|nsIDocument::DoUnblockOnload|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5866d6685849311f057e7e229b9ace63a2641c29|8347|0x20
0|37|libxul.so|nsDocument::UnblockOnload|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5866d6685849311f057e7e229b9ace63a2641c29|8269|0x8
0|38|libxul.so|nsIDocument::DispatchContentLoadedEvents|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:5866d6685849311f057e7e229b9ace63a2641c29|5224|0x11
0|39|libxul.so|mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0u>::Run|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:5866d6685849311f057e7e229b9ace63a2641c29|1165|0x13
0|40|libxul.so|mozilla::SchedulerGroup::Runnable::Run|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:5866d6685849311f057e7e229b9ace63a2641c29|337|0x15
0|41|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:5866d6685849311f057e7e229b9ace63a2641c29|1088|0x15
0|42|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:5866d6685849311f057e7e229b9ace63a2641c29|519|0x11
0|43|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:5866d6685849311f057e7e229b9ace63a2641c29|97|0xa
0|44|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:5866d6685849311f057e7e229b9ace63a2641c29|326|0x17
0|45|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:5866d6685849311f057e7e229b9ace63a2641c29|319|0x8
0|46|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:5866d6685849311f057e7e229b9ace63a2641c29|157|0xd
0|47|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:5866d6685849311f057e7e229b9ace63a2641c29|893|0x11
0|48|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:5866d6685849311f057e7e229b9ace63a2641c29|269|0x5
0|49|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:5866d6685849311f057e7e229b9ace63a2641c29|326|0x17
0|50|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:5866d6685849311f057e7e229b9ace63a2641c29|319|0x8
0|51|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:5866d6685849311f057e7e229b9ace63a2641c29|719|0x8
0|52|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:5866d6685849311f057e7e229b9ace63a2641c29|50|0x14
0|53|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:5866d6685849311f057e7e229b9ace63a2641c29|282|0x11
0|54|libc-2.23.so||||0x20830
0|55|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:5866d6685849311f057e7e229b9ace63a2641c29|164|0x5