Testcase found while fuzzing mozilla-central rev 0ec836eceb96.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/dom/base/nsIGlobalObject.cpp:33:22 in nsIGlobalObject::PrincipalOrNull()
==23330==ABORTING
=================================================================
==23910==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f5c34e9cc02 bp 0x7ffeb8138550 sp 0x7ffeb8138540 T0)
==23910==The signal is caused by a READ memory access.
==23910==Hint: address points to the zero page.
#0 0x7f5c34e9cc01 in nsIGlobalObject::PrincipalOrNull() /builds/worker/workspace/build/src/dom/base/nsIGlobalObject.cpp:33:22
#1 0x7f5c381d3049 in mozilla::WebGLContext::InitAndValidateGL(mozilla::WebGLContext::FailureReason*) /builds/worker/workspace/build/src/dom/canvas/WebGLContextValidate.cpp:481:51
#2 0x7f5c38174994 in mozilla::WebGLContext::CreateAndInitGL(bool, std::vector<mozilla::WebGLContext::FailureReason, std::allocator<mozilla::WebGLContext::FailureReason> >*) /builds/worker/workspace/build/src/dom/canvas/WebGLContext.cpp:622:8
#3 0x7f5c3817847a in mozilla::WebGLContext::SetDimensions(int, int) /builds/worker/workspace/build/src/dom/canvas/WebGLContext.cpp:843:8
#4 0x7f5c380966af in mozilla::dom::CanvasRenderingContextHelper::UpdateContext(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/canvas/CanvasRenderingContextHelper.cpp:216:24
#5 0x7f5c38095ff3 in mozilla::dom::CanvasRenderingContextHelper::GetContext(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/canvas/CanvasRenderingContextHelper.cpp:174:19
#6 0x7f5c381148a6 in mozilla::dom::OffscreenCanvas::GetContext(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/canvas/OffscreenCanvas.cpp:113:62
#7 0x7f5c35b17ad1 in mozilla::dom::OffscreenCanvas_Binding::getContext(JSContext*, JS::Handle<JSObject*>, mozilla::dom::OffscreenCanvas*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/OffscreenCanvasBinding.cpp:201:49
#8 0x7f5c37f194f2 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3153:13
#9 0x7f5c3f7c6150 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:443:13
#10 0x7f5c3f7c6150 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535
#11 0x7f5c3f7a68b4 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:594:10
#12 0x7f5c3f7a68b4 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3080
#13 0x7f5c3f790388 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:10
#14 0x7f5c3f7c6ac3 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:563:13
#15 0x7f5c3f7c8742 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:606:8
#16 0x7f5c40436ae8 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2636:10
#17 0x7f5c37d99075 in mozilla::dom::IntersectionCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Sequence<mozilla::OwningNonNull<mozilla::dom::DOMIntersectionObserverEntry> > const&, mozilla::dom::DOMIntersectionObserver&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/IntersectionObserverBinding.cpp:836:8
#18 0x7f5c347269ad in Call<mozilla::dom::DOMIntersectionObserver *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/IntersectionObserverBinding.h:486:12
#19 0x7f5c347269ad in Call<mozilla::dom::DOMIntersectionObserver *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/IntersectionObserverBinding.h:508
#20 0x7f5c347269ad in mozilla::dom::DOMIntersectionObserver::Notify() /builds/worker/workspace/build/src/dom/base/DOMIntersectionObserver.cpp:465
#21 0x7f5c34b4e7db in mozilla::dom::Document::NotifyIntersectionObservers() /builds/worker/workspace/build/src/dom/base/Document.cpp:11813:17
#22 0x7f5c34bf79ab in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1122:12
#23 0x7f5c34bf79ab in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1128
#24 0x7f5c34bf79ab in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1174
#25 0x7f5c306182c1 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1180:14
#26 0x7f5c3061fee4 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
#27 0x7f5c3197e80f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:88:21
#28 0x7f5c3185798e in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
#29 0x7f5c3185798e in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
#30 0x7f5c3185798e in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
#31 0x7f5c3af00b43 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
#32 0x7f5c3f1c8da0 in nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:270:30
#33 0x7f5c3f4d9027 in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4584:22
#34 0x7f5c3f4dba44 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4722:8
#35 0x7f5c3f4dd299 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4803:21
#36 0x55b17c4c63da in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:212:22
#37 0x55b17c4c63da in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:291
#38 0x7f5c54683b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
#39 0x55b17c3e7e1c in _start (/home/forb1dden/builds/mc-asan/firefox+0x2fe1c)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/dom/base/nsIGlobalObject.cpp:33:22 in nsIGlobalObject::PrincipalOrNull()
==23910==ABORTING
Bug 1547073 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Testcase found while fuzzing mozilla-central rev 0ec836eceb96.
==23910==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f5c34e9cc02 bp 0x7ffeb8138550 sp 0x7ffeb8138540 T0)
==23910==The signal is caused by a READ memory access.
==23910==Hint: address points to the zero page.
#0 0x7f5c34e9cc01 in nsIGlobalObject::PrincipalOrNull() /builds/worker/workspace/build/src/dom/base/nsIGlobalObject.cpp:33:22
#1 0x7f5c381d3049 in mozilla::WebGLContext::InitAndValidateGL(mozilla::WebGLContext::FailureReason*) /builds/worker/workspace/build/src/dom/canvas/WebGLContextValidate.cpp:481:51
#2 0x7f5c38174994 in mozilla::WebGLContext::CreateAndInitGL(bool, std::vector<mozilla::WebGLContext::FailureReason, std::allocator<mozilla::WebGLContext::FailureReason> >*) /builds/worker/workspace/build/src/dom/canvas/WebGLContext.cpp:622:8
#3 0x7f5c3817847a in mozilla::WebGLContext::SetDimensions(int, int) /builds/worker/workspace/build/src/dom/canvas/WebGLContext.cpp:843:8
#4 0x7f5c380966af in mozilla::dom::CanvasRenderingContextHelper::UpdateContext(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/canvas/CanvasRenderingContextHelper.cpp:216:24
#5 0x7f5c38095ff3 in mozilla::dom::CanvasRenderingContextHelper::GetContext(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/canvas/CanvasRenderingContextHelper.cpp:174:19
#6 0x7f5c381148a6 in mozilla::dom::OffscreenCanvas::GetContext(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/canvas/OffscreenCanvas.cpp:113:62
#7 0x7f5c35b17ad1 in mozilla::dom::OffscreenCanvas_Binding::getContext(JSContext*, JS::Handle<JSObject*>, mozilla::dom::OffscreenCanvas*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/OffscreenCanvasBinding.cpp:201:49
#8 0x7f5c37f194f2 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3153:13
#9 0x7f5c3f7c6150 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:443:13
#10 0x7f5c3f7c6150 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535
#11 0x7f5c3f7a68b4 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:594:10
#12 0x7f5c3f7a68b4 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3080
#13 0x7f5c3f790388 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:10
#14 0x7f5c3f7c6ac3 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:563:13
#15 0x7f5c3f7c8742 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:606:8
#16 0x7f5c40436ae8 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2636:10
#17 0x7f5c37d99075 in mozilla::dom::IntersectionCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Sequence<mozilla::OwningNonNull<mozilla::dom::DOMIntersectionObserverEntry> > const&, mozilla::dom::DOMIntersectionObserver&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/IntersectionObserverBinding.cpp:836:8
#18 0x7f5c347269ad in Call<mozilla::dom::DOMIntersectionObserver *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/IntersectionObserverBinding.h:486:12
#19 0x7f5c347269ad in Call<mozilla::dom::DOMIntersectionObserver *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/IntersectionObserverBinding.h:508
#20 0x7f5c347269ad in mozilla::dom::DOMIntersectionObserver::Notify() /builds/worker/workspace/build/src/dom/base/DOMIntersectionObserver.cpp:465
#21 0x7f5c34b4e7db in mozilla::dom::Document::NotifyIntersectionObservers() /builds/worker/workspace/build/src/dom/base/Document.cpp:11813:17
#22 0x7f5c34bf79ab in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1122:12
#23 0x7f5c34bf79ab in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1128
#24 0x7f5c34bf79ab in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1174
#25 0x7f5c306182c1 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1180:14
#26 0x7f5c3061fee4 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
#27 0x7f5c3197e80f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:88:21
#28 0x7f5c3185798e in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
#29 0x7f5c3185798e in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
#30 0x7f5c3185798e in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
#31 0x7f5c3af00b43 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
#32 0x7f5c3f1c8da0 in nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:270:30
#33 0x7f5c3f4d9027 in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4584:22
#34 0x7f5c3f4dba44 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4722:8
#35 0x7f5c3f4dd299 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4803:21
#36 0x55b17c4c63da in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:212:22
#37 0x55b17c4c63da in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:291
#38 0x7f5c54683b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
#39 0x55b17c3e7e1c in _start (/home/forb1dden/builds/mc-asan/firefox+0x2fe1c)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/dom/base/nsIGlobalObject.cpp:33:22 in nsIGlobalObject::PrincipalOrNull()
==23910==ABORTING