1153478 - (CVE-2015-2713) heap-use-after-free in SetBreaks

Status: RESOLVED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Scott Bell]

Attachment: crash.html

==3799==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b000038200 at pc 0x7f555a8ac8a1 bp 0x7fff68025060 sp 0x7fff68025058
READ of size 8 at 0x62b000038200 thread T0 (Web Content)
    #0 0x7f555a8ac8a0 in SetBreaks /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:974
    #1 0x7f5556d97c92 in FlushCurrentWord /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/base/nsLineBreaker.cpp:121
    #2 0x7f5556d9c9f1 in Reset /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/base/nsLineBreaker.cpp:489
    #3 0x7f555a8518e4 in FlushLineBreaks /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:1523
    #4 0x7f555a84a423 in FlushFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:1513
    #5 0x7f555a859862 in BuildTextRuns /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:1437
    #6 0x7f555a88f4ac in ReflowText /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:8229
    #7 0x7f555a614245 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:957
    #8 0x7f555a7e4173 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:774
    #9 0x7f555a7e3084 in ReflowFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:658
    #10 0x7f555a7e1e9d in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:434
    #11 0x7f555a6141c0 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:955
    #12 0x7f555a7e4173 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:774
    #13 0x7f555a7e3084 in ReflowFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:658
    #14 0x7f555a7e1e9d in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:434
    #15 0x7f555a6141c0 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:955
    #16 0x7f555a7e4173 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:774
    #17 0x7f555a7e3084 in ReflowFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:658
    #18 0x7f555a7e1e9d in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:434
    #19 0x7f555a6141c0 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:955
    #20 0x7f555a679a71 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3959
    #21 0x7f555a6781e3 in DoReflowInlineFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3761
    #22 0x7f555a66f682 in ReflowInlineFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3627
    #23 0x7f555a66119b in ReflowLine /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:2713
    #24 0x7f555a659d24 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:1160
    #25 0x7f555a675894 in ReflowBlock /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockReflowContext.cpp:291
    #26 0x7f555a66cd1c in ReflowBlockFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3354
    #27 0x7f555a6611bb in ReflowLine /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:2710
    #28 0x7f555a659d24 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:1160
    #29 0x7f555a6c1c25 in ReflowChild /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsContainerFrame.cpp:963
    #30 0x7f555a6a7a39 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsCanvasFrame.cpp:672
    #31 0x7f555a7501d1 in ReflowChild /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsContainerFrame.cpp:963
    #32 0x7f555a751729 in ReflowContents /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsGfxScrollFrame.cpp:621
    #33 0x7f555a753ac5 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsGfxScrollFrame.cpp:856
    #34 0x7f555a6c1fbe in ReflowChild /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsContainerFrame.cpp:1005
    #35 0x7f555a8a66ff in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsViewportFrame.cpp:217
    #36 0x7f555a5bc49a in DoReflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/nsPresShell.cpp:9159
    #37 0x7f555a5d0e48 in ProcessReflowCommands /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/nsPresShell.cpp:9319
    #38 0x7f555a5d02ca in FlushPendingNotifications /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/nsPresShell.cpp:4320
    #39 0x7f555a34cae3 in Tick /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/nsRefreshDriver.cpp:1663
    #40 0x7f555a3556a0 in TickDriver /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/nsRefreshDriver.cpp:198
    #41 0x7f555a354f0d in RunRefreshDrivers /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/base/nsRefreshDriver.cpp:440
    #42 0x7f555abb7140 in RecvNotify /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/ipc/VsyncChild.cpp:63
    #43 0x7f55557ed52c in OnMessageReceived /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/ipc/ipdl/./PVsyncChild.cpp:224
    #44 0x7f555539a53c in OnMessageReceived /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/ipc/ipdl/./PBackgroundChild.cpp:1082
    #45 0x7f5555329dc2 in DispatchAsyncMessage /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/glue/MessageChannel.cpp:1237
    #46 0x7f5555327856 in DispatchMessage /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/glue/MessageChannel.cpp:1164
    #47 0x7f555531bc94 in OnMaybeDequeueOne /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/glue/MessageChannel.cpp:1148
    #48 0x7f55552bf914 in RunTask /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:361
    #49 0x7f55552c09c7 in DoWork /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:456
    #50 0x7f5555331062 in Run /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/glue/MessagePump.cpp:233
    #51 0x7f5554a76d04 in ProcessNextEvent /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/threads/nsThread.cpp:866
    #52 0x7f5554ad90ea in NS_ProcessNextEvent /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:265
    #53 0x7f55553307a8 in Run /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/glue/MessagePump.cpp:140
    #54 0x7f55552be49c in RunInternal /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:233
    #55 0x7f5559d3ad17 in Run /builds/slave/m-cen-l64-asan-000000000000000/build/src/widget/nsBaseAppShell.cpp:164
    #56 0x7f555b8c9d72 in XRE_RunAppShell /builds/slave/m-cen-l64-asan-000000000000000/build/src/toolkit/xre/nsEmbedFunctions.cpp:738
    #57 0x7f55552be49c in RunInternal /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:233
    #58 0x7f555b8c93e2 in XRE_InitChildProcess /builds/slave/m-cen-l64-asan-000000000000000/build/src/toolkit/xre/nsEmbedFunctions.cpp:575
    #59 0x48ce81 in content_process_main /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/app/../contentproc/plugin-container.cpp:222
    #60 0x7f55525d8ec4 in __libc_start_main /build/buildd/eglibc-2.19/csu/libc-start.c:287
    #61 0x48c24c in _start ??:?

0x62b000038200 is located 0 bytes inside of 26492-byte region [0x62b000038200,0x62b00003e97c)
freed by thread T0 (Web Content) here:
    #0 0x474661 in __interceptor_free _asan_rtl_
    #1 0x7f555a857387 in AssignTextRun /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:2584
    #2 0x7f555a8504be in BuildTextRunForFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:2255
    #3 0x7f555a84a7a0 in FlushFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:1508
    #4 0x7f555a859862 in BuildTextRuns /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:1437
    #5 0x7f555a88f4ac in ReflowText /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:8229
    #6 0x7f555a614245 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:957
    #7 0x7f555a7e4173 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:774
    #8 0x7f555a7e3084 in ReflowFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:658
    #9 0x7f555a7e1e9d in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:434
    #10 0x7f555a6141c0 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:955
    #11 0x7f555a7e4173 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:774
    #12 0x7f555a7e3084 in ReflowFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:658
    #13 0x7f555a7e1e9d in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:434
    #14 0x7f555a6141c0 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:955
    #15 0x7f555a7e4173 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:774
    #16 0x7f555a7e3084 in ReflowFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:658
    #17 0x7f555a7e1e9d in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:434
    #18 0x7f555a6141c0 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:955
    #19 0x7f555a679a71 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3959
    #20 0x7f555a6781e3 in DoReflowInlineFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3761
    #21 0x7f555a66f682 in ReflowInlineFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3627
    #22 0x7f555a66119b in ReflowLine /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:2713
    #23 0x7f555a659d24 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:1160
    #24 0x7f555a675894 in ReflowBlock /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockReflowContext.cpp:291
    #25 0x7f555a66cd1c in ReflowBlockFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3354
    #26 0x7f555a6611bb in ReflowLine /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:2710
    #27 0x7f555a659d24 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:1160
    #28 0x7f555a6c1c25 in ReflowChild /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsContainerFrame.cpp:963
    #29 0x7f555a6a7a39 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsCanvasFrame.cpp:672

previously allocated by thread T0 (Web Content) here:
    #0 0x474861 in __interceptor_malloc _asan_rtl_
    #1 0x7f55567778fe in AllocateStorageForTextRun /builds/slave/m-cen-l64-asan-000000000000000/build/src/gfx/thebes/gfxTextRun.cpp:109
    #2 0x7f555a8502aa in MakeTextRun<unsigned char> /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:581
    #3 0x7f555a84a7a0 in FlushFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:1508
    #4 0x7f555a859862 in BuildTextRuns /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:1437
    #5 0x7f555a88f4ac in ReflowText /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsTextFrame.cpp:8229
    #6 0x7f555a614245 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:957
    #7 0x7f555a7e4173 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:774
    #8 0x7f555a7e3084 in ReflowFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:658
    #9 0x7f555a7e1e9d in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:434
    #10 0x7f555a6141c0 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:955
    #11 0x7f555a7e4173 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:774
    #12 0x7f555a7e3084 in ReflowFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:658
    #13 0x7f555a7e1e9d in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:434
    #14 0x7f555a6141c0 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:955
    #15 0x7f555a7e4173 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:774
    #16 0x7f555a7e3084 in ReflowFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:658
    #17 0x7f555a7e1e9d in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsInlineFrame.cpp:434
    #18 0x7f555a6141c0 in ReflowFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsLineLayout.cpp:955
    #19 0x7f555a679a71 in ReflowInlineFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3959
    #20 0x7f555a6781e3 in DoReflowInlineFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3761
    #21 0x7f555a66f682 in ReflowInlineFrames /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3627
    #22 0x7f555a66119b in ReflowLine /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:2713
    #23 0x7f555a659d24 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:1160
    #24 0x7f555a675894 in ReflowBlock /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockReflowContext.cpp:291
    #25 0x7f555a66cd1c in ReflowBlockFrame /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:3354
    #26 0x7f555a6611bb in ReflowLine /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:2710
    #27 0x7f555a659d24 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsBlockFrame.cpp:1160
    #28 0x7f555a6c1c25 in ReflowChild /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsContainerFrame.cpp:963
    #29 0x7f555a6a7a39 in Reflow /builds/slave/m-cen-l64-asan-000000000000000/build/src/layout/generic/nsCanvasFrame.cpp:672

SUMMARY: AddressSanitizer: heap-use-after-free ??:0 ??
Shadow bytes around the buggy address:
  0x0c567fffeff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c567ffff000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c567ffff010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c567ffff020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c567ffff030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c567ffff040:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c567ffff050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c567ffff060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c567ffff070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c567ffff080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c567ffff090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:
==3799==ABORTING

Comment 1

[Mats Palmgren (inactive)]

Testcase contains "writing-mode:vertical-lr;direction:rtl;".

I couldn't reproduce it in a local DEBUG asan build on Linux64.
I'll try an Opt build tomorrow.

Comment 2

[Scott Bell]

I see the following assertions in a debug build.

###!!! ASSERTION: Shouldn't be incomplete if availableBSize is UNCONSTRAINED.: 'aReflowState.AvailableBSize() != NS_UNCONSTRAINEDSIZE', file /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/layout/generic/nsBlockFrame.cpp, line 1571

###!!! ASSERTION: not in child list: 'found', file /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/layout/base/nsLayoutUtils.cpp, line 1227
Assertion failure: list && list->ContainsFrame(aChild) (aChild isn't our child or on a frame list not supported by StealFrame), at /builds/slave/m-cen-l64-asan-d-0000000000000/build/src/layout/generic/nsContainerFrame.cpp:1342

Comment 3

[Mats Palmgren (inactive)]

> ASSERTION: not in child list

This is likely the root cause.  Can you run it in gdb and attach a stack trace?

What's the BuildID of the debug build you're using?  (you can find it in the
application.ini file in the same directory as the firefox binary)

Comment 4

[Mats Palmgren (inactive)]

Fwiw, I haven't been able to reproduce it in any local build, 
nor with Mozilla asan builds, so far.
Are there any steps that makes it more reproducible for you?
(like resizing the window, reloading the page etc)
Are you using a default profile?

Comment 5

[Mats Palmgren (inactive)]

Attachment: frame dump

I finally did manage to reproduce it, luckily in a debug build as well.

So what happens here is that we have a child frame inside an inline
frame that we push to some next-in-flows, so it sits in an OverflowList
with a stale parent pointer.  Then we decide to remove this child,
which basically does aChild->GetParent()->StealFrame(aChild) which
fails since it's the wrong parent due to the "lazy reparenting"
optimization in nsInlineFrame.

http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsContainerFrame.cpp?rev=c0d778faf638#147

Comment 6

[Scott Bell]

Attachment: prefs.js

Cool. So I'm using the following build with the attached prefs.js in my profile.
Version=40.0a1
BuildID=20150410122440

Comment 7

[Mats Palmgren (inactive)]

Thanks.

Comment 8

[Mats Palmgren (inactive)]

Attachment: fix

See comment 5 for a description of the root cause:
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsContainerFrame.cpp#150

So that results in a destroyed nsInlineFrame in the tree.
How this leads to the crash in SetBreaks is still unknown.
What I do know is that somehow we end up with a text frame
in two flows and then we call AssignTextRun with the stack:

#1  gfxTextRun::~gfxTextRun (this=0x7fffac302000) at gfx/thebes/gfxTextRun.cpp:187
#2  gfxTextRun::~gfxTextRun (this=0x7fffac302000) at gfx/thebes/gfxTextRun.cpp:186
#3  BuildTextRunsScanner::AssignTextRun (this=0x7fffffff8d10, aTextRun=0x7fffac302000, aInflation=1) at layout/generic/nsTextFrame.cpp:2647
#4  BuildTextRunsScanner::BuildTextRunForFrames (this=0x7fffffff8d10, ...) at layout/generic/nsTextFrame.cpp:2312
#5  BuildTextRunsScanner::FlushFrames (this=0x7fffffff8d10, aFlushLineBreaks=true, aSuppressTrailingBreak=false) at layout/generic/nsTextFrame.cpp:1554
#6  BuildTextRuns (...) at layout/generic/nsTextFrame.cpp:1473
#7  nsTextFrame::EnsureTextRun (this=0x7fffb0776968, aWhichTextRun=nsTextFrame::eInflated, ... , aFlowEndInTextRun=0x7fffaafb36c4) at layout/generic/nsTextFrame.cpp:2693
#8  nsTextFrame::ReflowText (this=0x7fffb0776968, ...) at layout/generic/nsTextFrame.cpp:8292
#9  nsLineLayout::ReflowFrame (this=0x7fffffffa5f0, aFrame=0x7fffb0776968, ...) at layout/generic/nsLineLayout.cpp:957

This ClearTextRuns() call in AssignTextRun() was inlined:
http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsTextFrame.cpp#2584

The first time we process the frame F here is OK, we clear the old textrun
and then assign the new one on line 2596, all is well.  The second time
we see F in this loop, we call ClearTextRuns() and promptly delete the *new*
textrun - you can see it's the same address in the DTOR as 'aTextRun' above.
It quickly starts to go badly wrong after that of course.

The destroyed nsInlineFrame isn't involved here though and I don't know how
that caused the same text frame to be on multiple flows.  I tried to use
'rr' but it it failed to run on my platform (Ubuntu 14.something, x86-64).

Comment 9

[Mats Palmgren (inactive)]

Attachment: remove bogus assertions

With the fix above, I'm still seeing these assertions for the test.
I think they are just bogus.  It happens when you have frames like so:
A1
  x1
A2
  x2
  overflow: y

Reflowing A1 pulls x2, so now A2 is empty with an overflow list,
which is what the assertions says can't happen.  I'm not sure
why where not seeing more often actually.

Comment 10

[Mats Palmgren (inactive)]

Attachment: crashtest patch, DO NOT LAND UNTIL BUG IS PUBLIC

Comment 11

[Mats Palmgren (inactive)]

I think all branches are affected, although it's probably hard to reproduce
unless you have vertical-text enabled.  The vertical-text code seems to
cause a lot overflow lists in the tree somehow, and sometimes it's not
actually completing the reflow (as we saw in bug 1145768 comment 6).

Comment 12

[Mats Palmgren (inactive)]

I think the crash is exploitable, but it's probably hard to make it crash
without vertical-text enabled.  I think it's only enabled by default in
Nightly and Aurora, as far as I know.

Comment 13

[Robert O'Callahan (:roc) (email my personal email if necessary)]

(In reply to Mats Palmgren (:mats) from comment #8)
> The destroyed nsInlineFrame isn't involved here though and I don't know how
> that caused the same text frame to be on multiple flows.  I tried to use
> 'rr' but it it failed to run on my platform (Ubuntu 14.something, x86-64).

Please file an rr issue on that!

Comment 14

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 8592199 [details] [diff] [review]
fix

Review of attachment 8592199 [details] [diff] [review]:
-----------------------------------------------------------------

::: layout/generic/nsInlineFrame.cpp
@@ +234,5 @@
> +      }
> +    }
> +
> +    // Due to our "lazy reparenting" optimization 'aChild' might not actually
> +    // be on any of our child lists, but instead in one of our next-in-flows.

Can't it be in a prev-in-flow as well?

Comment 15

[Mats Palmgren (inactive)]

I don't think so.  We pick these children up from the prev-in-flow's overflow
list and put them on mFrames (without reparenting them!) when we start reflow:
https://dxr.mozilla.org/mozilla-central/source/layout/generic/nsInlineFrame.cpp#351
Then we reparent them as we go.  Or we push them to that frame's overflow
list which will eventually move them forward.  I don't see how they can move
before the original parent though.

Comment 16

[Mats Palmgren (inactive)]

Actually if we reflow a prev-in-flow of the original parent it may in fact
pull up an arbitrary number of children from its next-in-flows.  Hmmm.

Comment 17

[Mats Palmgren (inactive)]

I'll add a last ditch effort to search the prev-in-flows too.
It doesn't really cost anything since normal web pages should
never hit this code.

Comment 18

[Mats Palmgren (inactive)]

Actually, nsInlineFrame::PullOneFrame already has code to reparent the
pulled up frame so that shouldn't be a problem:
https://dxr.mozilla.org/mozilla-central/source/layout/generic/nsInlineFrame.cpp#857

Comment 19

[Mats Palmgren (inactive)]

(In reply to Robert O'Callahan (:roc) (Mozilla Corporation) from comment #13)
> Please file an rr issue on that!

https://github.com/mozilla/rr/issues/1459

Comment 20

[Mats Palmgren (inactive)]

Comment on attachment 8592199 [details] [diff] [review]
fix

[Security approval request comment]
How easily could an exploit be constructed based on the patch?

Very hard.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?

No.

Which older supported branches are affected by this flaw?

All.

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?

I expect backporting to be easy.

How likely is this patch to cause regressions; how much testing does it need?

Low risk, this code is well covered by tests so if there's any problem
with the patch it should show up in the first test run.

Comment 21

[Daniel Veditz [:dveditz]]

Comment on attachment 8592199 [details] [diff] [review]
fix

sec-approval = dveditz

Comment 22

[Daniel Veditz [:dveditz]]

[Tracking Requested - why for this release]: sec-critical security bug

Comment 23

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0ca91806d2c4
https://hg.mozilla.org/integration/mozilla-inbound/rev/34a7eeb94839

Comment 24

[Sylvestre Ledru [:Sylvestre]]

Mats, can we have an uplift request to aurora & beta? Thanks

Comment 25

[Mats Palmgren (inactive)]

Comment on attachment 8592199 [details] [diff] [review]
fix

Approval Request Comment
[Feature/regressing bug #]: bug 5588
[User impact if declined]: possibly exploitable crash
[Describe test coverage new/current, TreeHerder]: we have no specific test for this edge case but the normal path in this code is well covered by existing tests
[Risks and why]: low-risk
[String/UUID change made/needed]: none

Comment 26

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/0ca91806d2c4
https://hg.mozilla.org/mozilla-central/rev/34a7eeb94839

Comment 27

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/aa1de6662e67
https://hg.mozilla.org/releases/mozilla-aurora/rev/eaf6d0499bb0

https://hg.mozilla.org/releases/mozilla-beta/rev/18b8b10f2fbd
https://hg.mozilla.org/releases/mozilla-beta/rev/e1dd0d7756c5

Comment 28

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/0ff1d2ab8c6b
https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/fe2d203b7e14

https://hg.mozilla.org/releases/mozilla-esr31/rev/a9ef6f87e1ad
https://hg.mozilla.org/releases/mozilla-esr31/rev/85917067a8d5

Comment 29

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g34_v2_1/rev/7f039f2b2f83
https://hg.mozilla.org/releases/mozilla-b2g34_v2_1/rev/4c85969741be

https://hg.mozilla.org/releases/mozilla-b2g34_v2_1s/rev/7f039f2b2f83
https://hg.mozilla.org/releases/mozilla-b2g34_v2_1s/rev/4c85969741be

https://hg.mozilla.org/releases/mozilla-b2g32_v2_0/rev/73acbd108ba2
https://hg.mozilla.org/releases/mozilla-b2g32_v2_0/rev/d82742c70f41

https://hg.mozilla.org/releases/mozilla-b2g32_v2_0m/rev/73acbd108ba2
https://hg.mozilla.org/releases/mozilla-b2g32_v2_0m/rev/d82742c70f41

https://hg.mozilla.org/releases/mozilla-b2g30_v1_4/rev/a47f9de391ee
https://hg.mozilla.org/releases/mozilla-b2g30_v1_4/rev/e71484b4420c

Comment 30

[Al Billings [:abillings - ex-MoCo]]

Ryan, if you see ESR tracking set to '?' and you check it into ESR, please set the tracking to the current version.

Comment 31

[Bogdan Maris, Desktop Test Engineering]

I was unable to reproduce this issue using an old Asan build from 2015-04-09 (also debug builds) on Ubuntu 14.04 64bit and 13.10 64bit so I can`t verify if this is fixed. 

Scott, can you please verify if 38.0 ESR and 31.7.0 ESR are fixed?
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/38.0esr-candidates/build1/
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/31.7.0esr-candidates/build2/

Comment 32

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/cce9a079d0ee
Crashtest.

Comment 33

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/cce9a079d0ee