Tested Version: Ubuntu 64-bit memory 8G + linux64-fuzzing-asan-opt(94.0.2 (64-bit)) => linux64-fuzzing-asan-opt
Loading poc.html into the firefox browser to create a new tab(Using the grizzly tool(allow pop-ups)),I feel that this is a conditional competition vulnerability, This poc is not 100% stable, and I can only trigger it in the docker container,if it fails, please repeat more times. the crash report is as follows:
=========================================================================================================================================
==239309==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c0001c0100 at pc 0x7f44482fcb3a bp 0x7ffd9fa08970 sp 0x7ffd9fa08968
READ of size 8 at 0x61c0001c0100 thread T0 (Web Content)
#0 0x7f44482fcb39 in nsCOMPtr /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:928:7
#1 0x7f44482fcb39 in CompleteResumeRunnable /builds/worker/checkouts/gecko/netwerk/ipc/ChannelEventQueue.cpp:145:13
#2 0x7f44482fcb39 in mozilla::net::ChannelEventQueue::ResumeInternal() /builds/worker/checkouts/gecko/netwerk/ipc/ChannelEventQueue.cpp:160:34
#3 0x7f44482fc665 in mozilla::net::ChannelEventQueue::Resume() /builds/worker/checkouts/gecko/netwerk/ipc/ChannelEventQueue.cpp:117:3
#4 0x7f444a77a876 in mozilla::dom::Document::UnsuppressEventHandlingAndFireEvents(bool) /builds/worker/checkouts/gecko/dom/base/Document.cpp:12460:16
#5 0x7f444a55c7d7 in nsGlobalWindowInner::FreeInnerObjects() /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:1189:13
#6 0x7f444a5b3c9c in nsGlobalWindowOuter::DetachFromDocShell(bool) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:2700:12
#7 0x7f4452131ce6 in nsDocShell::Destroy() /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:4438:20
#8 0x7f44527be8ed in nsWebBrowser::SetDocShell(nsDocShell*) /builds/worker/checkouts/gecko/toolkit/components/browser/nsWebBrowser.cpp:1122:18
#9 0x7f44527bdc0c in nsWebBrowser::InternalDestroy() /builds/worker/checkouts/gecko/toolkit/components/browser/nsWebBrowser.cpp:175:3
#10 0x7f44527c35ec in Destroy /builds/worker/checkouts/gecko/toolkit/components/browser/nsWebBrowser.cpp:855:3
#11 0x7f44527c35ec in non-virtual thunk to nsWebBrowser::Destroy() /builds/worker/checkouts/gecko/toolkit/components/browser/nsWebBrowser.cpp
#12 0x7f444e3fe510 in mozilla::dom::BrowserChild::DestroyWindow() /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:899:31
#13 0x7f444e4168c8 in mozilla::dom::BrowserChild::RecvDestroy() /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:2632:3
#14 0x7f44492c1a7d in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBrowserChild.cpp:6620:56
#15 0x7f4448906bfc in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8200:32
#16 0x7f44486a18e9 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2043:25
#17 0x7f444869e756 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1968:9
#18 0x7f444869ff22 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1827:3
#19 0x7f44486a0867 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1855:14
#20 0x7f444726888a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:467:16
#21 0x7f4447234f62 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:770:26
#22 0x7f4447232798 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:606:15
#23 0x7f4447232ec0 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:390:36
#24 0x7f444726ff54 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:126:37
#25 0x7f444726ff54 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:531:5
#26 0x7f444725150b in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1148:16
#27 0x7f444725b42c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
#28 0x7f444e3a02ac in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_8>(mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_8&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:93:25
#29 0x7f444e39d2fb in mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/ContentChild.cpp:1227:5
#30 0x7f444e3fd899 in mozilla::dom::BrowserChild::ProvideWindow(nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:851:14
#31 0x7f4452cc2ff9 in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsIArray*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:842:24
#32 0x7f4452cc7188 in nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsISupports*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:376:10
#33 0x7f444a5cd0c9 in nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsGlobalWindowOuter::PrintKind, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:7172:21
#34 0x7f444a5d1fef in nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5805:10
#35 0x7f444a5d1b48 in nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5769:17
#36 0x7f444a579873 in nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:3991:3
#37 0x7f444bc2d0c9 in mozilla::dom::Window_Binding::open(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:2704:59
#38 0x7f444c40aead in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3300:13
#39 0x1a94d8ac48bf (<unknown module>)
0x61c0001c0100 is located 128 bytes inside of 1824-byte region [0x61c0001c0080,0x61c0001c07a0)
freed by thread T0 (Web Content) here:
#0 0x5578b600f8a2 in free /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:127:3
#1 0x7f4447fd266b in operator delete /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:51:10
#2 0x7f4447fd266b in mozilla::net::HttpChannelChild::Release() /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelChild.cpp:199:7
#3 0x7f444800334e in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
#4 0x7f444800334e in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
#5 0x7f444800334e in assign_assuming_AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:69:7
#6 0x7f444800334e in operator= /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:168:5
#7 0x7f444800334e in Revoke /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:760:24
#8 0x7f444800334e in Revoke /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1214:15
#9 0x7f444800334e in ~RunnableMethodImpl /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1174:35
#10 0x7f444800334e in mozilla::detail::RunnableMethodImpl<mozilla::net::HttpChannelChild*, void (mozilla::net::HttpChannelChild::*)(), true, (mozilla::RunnableKind)0>::~RunnableMethodImpl() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1174:33
#11 0x7f444723ec85 in mozilla::Runnable::Release() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:60:1
#12 0x7f44472688cc in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
#13 0x7f44472688cc in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
#14 0x7f44472688cc in assign_assuming_AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:69:7
#15 0x7f44472688cc in operator= /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:168:5
#16 0x7f44472688cc in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:468:15
#17 0x7f4447234f62 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:770:26
#18 0x7f4447232798 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:606:15
#19 0x7f4447232ec0 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:390:36
#20 0x7f444726ff54 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:126:37
#21 0x7f444726ff54 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:531:5
#22 0x7f444725150b in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1148:16
#23 0x7f444725b42c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
#24 0x7f444e3a02ac in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_8>(mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_8&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:93:25
#25 0x7f444e39d2fb in mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/ContentChild.cpp:1227:5
#26 0x7f444e3fd899 in mozilla::dom::BrowserChild::ProvideWindow(nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:851:14
#27 0x7f4452cc2ff9 in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsIArray*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:842:24
#28 0x7f4452cc7188 in nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsISupports*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:376:10
#29 0x7f444a5cd0c9 in nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsGlobalWindowOuter::PrintKind, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:7172:21
#30 0x7f444a5d1fef in nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5805:10
#31 0x7f444a5d1b48 in nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5769:17
#32 0x7f444a579873 in nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:3991:3
previously allocated by thread T0 (Web Content) here:
#0 0x5578b600fb0d in malloc /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
#1 0x5578b6049b4d in moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52:15
#2 0x7f4447e943f1 in operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33:10
#3 0x7f4447e943f1 in mozilla::net::nsHttpHandler::NewProxiedChannel(nsIURI*, nsIProxyInfo*, unsigned int, nsIURI*, nsILoadInfo*, nsIChannel**) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpHandler.cpp:2067:19
#4 0x7f444754ae6a in mozilla::net::nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI*, nsIURI*, unsigned int, nsILoadInfo*, nsIChannel**) /builds/worker/checkouts/gecko/netwerk/base/nsIOService.cpp:1106:15
#5 0x7f444754a93a in mozilla::net::nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI*, nsIURI*, unsigned int, nsINode*, nsIPrincipal*, nsIPrincipal*, mozilla::Maybe<mozilla::dom::ClientInfo> const&, mozilla::Maybe<mozilla::dom::ServiceWorkerDescriptor> const&, unsigned int, nsIContentPolicy::nsContentPolicyType, unsigned int, nsIChannel**) /builds/worker/checkouts/gecko/netwerk/base/nsIOService.cpp:1078:10
#6 0x7f444754a879 in mozilla::net::nsIOService::NewChannelFromURIWithClientAndController(nsIURI*, nsINode*, nsIPrincipal*, nsIPrincipal*, mozilla::Maybe<mozilla::dom::ClientInfo> const&, mozilla::Maybe<mozilla::dom::ServiceWorkerDescriptor> const&, unsigned int, nsIContentPolicy::nsContentPolicyType, unsigned int, nsIChannel**) /builds/worker/checkouts/gecko/netwerk/base/nsIOService.cpp:1050:10
#7 0x7f4447573ec4 in NS_NewChannelInternal(nsIChannel**, nsIURI*, nsINode*, nsIPrincipal*, nsIPrincipal*, mozilla::Maybe<mozilla::dom::ClientInfo> const&, mozilla::Maybe<mozilla::dom::ServiceWorkerDescriptor> const&, unsigned int, nsIContentPolicy::nsContentPolicyType, nsICookieJarSettings*, mozilla::dom::PerformanceStorage*, nsILoadGroup*, nsIInterfaceRequestor*, unsigned int, nsIIOService*, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp:426:20
#8 0x7f4447574df7 in NS_NewChannel(nsIChannel**, nsIURI*, nsINode*, unsigned int, nsIContentPolicy::nsContentPolicyType, mozilla::dom::PerformanceStorage*, nsILoadGroup*, nsIInterfaceRequestor*, unsigned int, nsIIOService*, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp:553:10
#9 0x7f444e8d87b7 in mozilla::dom::XMLHttpRequestMainThread::CreateChannel() /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:2439:10
#10 0x7f444e8d7c9b in mozilla::dom::XMLHttpRequestMainThread::Open(nsTSubstring<char> const&, nsTSubstring<char> const&, bool, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:1530:3
#11 0x7f444e8d6e8f in mozilla::dom::XMLHttpRequestMainThread::Open(nsTSubstring<char> const&, nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:1385:3
#12 0x7f444e8d6d63 in mozilla::dom::XMLHttpRequestMainThread::Open(nsTSubstring<char> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:1374:3
#13 0x7f444bd2560d in mozilla::dom::XMLHttpRequest_Binding::open(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/XMLHttpRequestBinding.cpp:989:28
#14 0x7f444c4071df in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3300:13
#15 0x7f445305df13 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:385:13
#16 0x7f445305df13 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:472:12
#17 0x7f445304a496 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:536:10
#18 0x7f445304a496 in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3239:16
#19 0x7f445302f845 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:354:13
#20 0x7f445305dff9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:504:13
#21 0x7f445305fbeb in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:549:8
#22 0x7f44532a8c07 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:928:7 in nsCOMPtr
Shadow bytes around the buggy address:
0x0c388002ffd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c388002ffe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c388002fff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3880030000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3880030010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3880030020:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==239309==ABORTING
This vuln is discovered by bo13oy of Cyber Kunlun Lab.
Thanks.
Bug 1742334 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Tested Version: Ubuntu 64-bit memory 8G + linux64-fuzzing-asan-opt(94.0.2 (64-bit)) => linux64-fuzzing-asan-opt
Loading poc.html into the firefox browser to create a new tab(Using the grizzly tool(allow pop-ups)),I feel that this is a conditional competition vulnerability, This poc is not 100% stable, and I can only trigger it in the docker container,if it fails, please repeat more times. the crash report is as follows:
```
==239309==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c0001c0100 at pc 0x7f44482fcb3a bp 0x7ffd9fa08970 sp 0x7ffd9fa08968
READ of size 8 at 0x61c0001c0100 thread T0 (Web Content)
#0 0x7f44482fcb39 in nsCOMPtr /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:928:7
#1 0x7f44482fcb39 in CompleteResumeRunnable /builds/worker/checkouts/gecko/netwerk/ipc/ChannelEventQueue.cpp:145:13
#2 0x7f44482fcb39 in mozilla::net::ChannelEventQueue::ResumeInternal() /builds/worker/checkouts/gecko/netwerk/ipc/ChannelEventQueue.cpp:160:34
#3 0x7f44482fc665 in mozilla::net::ChannelEventQueue::Resume() /builds/worker/checkouts/gecko/netwerk/ipc/ChannelEventQueue.cpp:117:3
#4 0x7f444a77a876 in mozilla::dom::Document::UnsuppressEventHandlingAndFireEvents(bool) /builds/worker/checkouts/gecko/dom/base/Document.cpp:12460:16
#5 0x7f444a55c7d7 in nsGlobalWindowInner::FreeInnerObjects() /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:1189:13
#6 0x7f444a5b3c9c in nsGlobalWindowOuter::DetachFromDocShell(bool) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:2700:12
#7 0x7f4452131ce6 in nsDocShell::Destroy() /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:4438:20
#8 0x7f44527be8ed in nsWebBrowser::SetDocShell(nsDocShell*) /builds/worker/checkouts/gecko/toolkit/components/browser/nsWebBrowser.cpp:1122:18
#9 0x7f44527bdc0c in nsWebBrowser::InternalDestroy() /builds/worker/checkouts/gecko/toolkit/components/browser/nsWebBrowser.cpp:175:3
#10 0x7f44527c35ec in Destroy /builds/worker/checkouts/gecko/toolkit/components/browser/nsWebBrowser.cpp:855:3
#11 0x7f44527c35ec in non-virtual thunk to nsWebBrowser::Destroy() /builds/worker/checkouts/gecko/toolkit/components/browser/nsWebBrowser.cpp
#12 0x7f444e3fe510 in mozilla::dom::BrowserChild::DestroyWindow() /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:899:31
#13 0x7f444e4168c8 in mozilla::dom::BrowserChild::RecvDestroy() /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:2632:3
#14 0x7f44492c1a7d in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBrowserChild.cpp:6620:56
#15 0x7f4448906bfc in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8200:32
#16 0x7f44486a18e9 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2043:25
#17 0x7f444869e756 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1968:9
#18 0x7f444869ff22 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1827:3
#19 0x7f44486a0867 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1855:14
#20 0x7f444726888a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:467:16
#21 0x7f4447234f62 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:770:26
#22 0x7f4447232798 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:606:15
#23 0x7f4447232ec0 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:390:36
#24 0x7f444726ff54 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:126:37
#25 0x7f444726ff54 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:531:5
#26 0x7f444725150b in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1148:16
#27 0x7f444725b42c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
#28 0x7f444e3a02ac in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_8>(mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_8&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:93:25
#29 0x7f444e39d2fb in mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/ContentChild.cpp:1227:5
#30 0x7f444e3fd899 in mozilla::dom::BrowserChild::ProvideWindow(nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:851:14
#31 0x7f4452cc2ff9 in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsIArray*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:842:24
#32 0x7f4452cc7188 in nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsISupports*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:376:10
#33 0x7f444a5cd0c9 in nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsGlobalWindowOuter::PrintKind, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:7172:21
#34 0x7f444a5d1fef in nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5805:10
#35 0x7f444a5d1b48 in nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5769:17
#36 0x7f444a579873 in nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:3991:3
#37 0x7f444bc2d0c9 in mozilla::dom::Window_Binding::open(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:2704:59
#38 0x7f444c40aead in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3300:13
#39 0x1a94d8ac48bf (<unknown module>)
0x61c0001c0100 is located 128 bytes inside of 1824-byte region [0x61c0001c0080,0x61c0001c07a0)
freed by thread T0 (Web Content) here:
#0 0x5578b600f8a2 in free /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:127:3
#1 0x7f4447fd266b in operator delete /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:51:10
#2 0x7f4447fd266b in mozilla::net::HttpChannelChild::Release() /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelChild.cpp:199:7
#3 0x7f444800334e in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
#4 0x7f444800334e in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
#5 0x7f444800334e in assign_assuming_AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:69:7
#6 0x7f444800334e in operator= /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:168:5
#7 0x7f444800334e in Revoke /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:760:24
#8 0x7f444800334e in Revoke /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1214:15
#9 0x7f444800334e in ~RunnableMethodImpl /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1174:35
#10 0x7f444800334e in mozilla::detail::RunnableMethodImpl<mozilla::net::HttpChannelChild*, void (mozilla::net::HttpChannelChild::*)(), true, (mozilla::RunnableKind)0>::~RunnableMethodImpl() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1174:33
#11 0x7f444723ec85 in mozilla::Runnable::Release() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:60:1
#12 0x7f44472688cc in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
#13 0x7f44472688cc in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
#14 0x7f44472688cc in assign_assuming_AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:69:7
#15 0x7f44472688cc in operator= /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:168:5
#16 0x7f44472688cc in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:468:15
#17 0x7f4447234f62 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:770:26
#18 0x7f4447232798 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:606:15
#19 0x7f4447232ec0 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:390:36
#20 0x7f444726ff54 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:126:37
#21 0x7f444726ff54 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:531:5
#22 0x7f444725150b in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1148:16
#23 0x7f444725b42c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
#24 0x7f444e3a02ac in bool mozilla::SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_8>(mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)::$_8&&, nsIThread*) /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:93:25
#25 0x7f444e39d2fb in mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/ContentChild.cpp:1227:5
#26 0x7f444e3fd899 in mozilla::dom::BrowserChild::ProvideWindow(nsIOpenWindowInfo*, unsigned int, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/ipc/BrowserChild.cpp:851:14
#27 0x7f4452cc2ff9 in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsIArray*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:842:24
#28 0x7f4452cc7188 in nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, nsTSubstring<char> const&, nsTSubstring<char> const&, nsTSubstring<char> const&, bool, bool, bool, nsISupports*, bool, bool, bool, nsPIWindowWatcher::PrintKind, nsDocShellLoadState*, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/toolkit/components/windowwatcher/nsWindowWatcher.cpp:376:10
#29 0x7f444a5cd0c9 in nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, nsGlobalWindowOuter::PrintKind, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:7172:21
#30 0x7f444a5d1fef in nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::BrowsingContext**) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5805:10
#31 0x7f444a5d1b48 in nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5769:17
#32 0x7f444a579873 in nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:3991:3
previously allocated by thread T0 (Web Content) here:
#0 0x5578b600fb0d in malloc /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
#1 0x5578b6049b4d in moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52:15
#2 0x7f4447e943f1 in operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33:10
#3 0x7f4447e943f1 in mozilla::net::nsHttpHandler::NewProxiedChannel(nsIURI*, nsIProxyInfo*, unsigned int, nsIURI*, nsILoadInfo*, nsIChannel**) /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpHandler.cpp:2067:19
#4 0x7f444754ae6a in mozilla::net::nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI*, nsIURI*, unsigned int, nsILoadInfo*, nsIChannel**) /builds/worker/checkouts/gecko/netwerk/base/nsIOService.cpp:1106:15
#5 0x7f444754a93a in mozilla::net::nsIOService::NewChannelFromURIWithProxyFlagsInternal(nsIURI*, nsIURI*, unsigned int, nsINode*, nsIPrincipal*, nsIPrincipal*, mozilla::Maybe<mozilla::dom::ClientInfo> const&, mozilla::Maybe<mozilla::dom::ServiceWorkerDescriptor> const&, unsigned int, nsIContentPolicy::nsContentPolicyType, unsigned int, nsIChannel**) /builds/worker/checkouts/gecko/netwerk/base/nsIOService.cpp:1078:10
#6 0x7f444754a879 in mozilla::net::nsIOService::NewChannelFromURIWithClientAndController(nsIURI*, nsINode*, nsIPrincipal*, nsIPrincipal*, mozilla::Maybe<mozilla::dom::ClientInfo> const&, mozilla::Maybe<mozilla::dom::ServiceWorkerDescriptor> const&, unsigned int, nsIContentPolicy::nsContentPolicyType, unsigned int, nsIChannel**) /builds/worker/checkouts/gecko/netwerk/base/nsIOService.cpp:1050:10
#7 0x7f4447573ec4 in NS_NewChannelInternal(nsIChannel**, nsIURI*, nsINode*, nsIPrincipal*, nsIPrincipal*, mozilla::Maybe<mozilla::dom::ClientInfo> const&, mozilla::Maybe<mozilla::dom::ServiceWorkerDescriptor> const&, unsigned int, nsIContentPolicy::nsContentPolicyType, nsICookieJarSettings*, mozilla::dom::PerformanceStorage*, nsILoadGroup*, nsIInterfaceRequestor*, unsigned int, nsIIOService*, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp:426:20
#8 0x7f4447574df7 in NS_NewChannel(nsIChannel**, nsIURI*, nsINode*, unsigned int, nsIContentPolicy::nsContentPolicyType, mozilla::dom::PerformanceStorage*, nsILoadGroup*, nsIInterfaceRequestor*, unsigned int, nsIIOService*, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp:553:10
#9 0x7f444e8d87b7 in mozilla::dom::XMLHttpRequestMainThread::CreateChannel() /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:2439:10
#10 0x7f444e8d7c9b in mozilla::dom::XMLHttpRequestMainThread::Open(nsTSubstring<char> const&, nsTSubstring<char> const&, bool, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:1530:3
#11 0x7f444e8d6e8f in mozilla::dom::XMLHttpRequestMainThread::Open(nsTSubstring<char> const&, nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:1385:3
#12 0x7f444e8d6d63 in mozilla::dom::XMLHttpRequestMainThread::Open(nsTSubstring<char> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:1374:3
#13 0x7f444bd2560d in mozilla::dom::XMLHttpRequest_Binding::open(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/XMLHttpRequestBinding.cpp:989:28
#14 0x7f444c4071df in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3300:13
#15 0x7f445305df13 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:385:13
#16 0x7f445305df13 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:472:12
#17 0x7f445304a496 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:536:10
#18 0x7f445304a496 in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3239:16
#19 0x7f445302f845 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:354:13
#20 0x7f445305dff9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:504:13
#21 0x7f445305fbeb in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:549:8
#22 0x7f44532a8c07 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:928:7 in nsCOMPtr
Shadow bytes around the buggy address:
0x0c388002ffd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c388002ffe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c388002fff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3880030000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3880030010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3880030020:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880030070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==239309==ABORTING
```
This vuln is discovered by bo13oy of Cyber Kunlun Lab.
Thanks.