1235469 - Heap-buffer-overflow [@ gldBlitFramebufferData] with canvas, shadow, drawImage(HTMLVideoElement)

Status: RESOLVED INCOMPLETE

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Attachment: testcase (may crash Firefox) (requires path adjustment)

Same testcase as bug 1225250, crashes again on mozilla-central, at least with ASan. I haven't gotten non-ASan builds to crash with this testcase.

You'll need to adjust the testcase so it points to your copy of layout/reftests/webm-video/frames.webm (in your mozilla-central tree or tests zip). Any other video file will probably crash too, but an image file won't.

Comment 1

[Jesse Ruderman]

Attachment: ASan stacks

Comment 2

[Lee Salzman [:lsalzman]]

I tried to reproduce this on Linux with accelerated Skia on an ASan build, but I was not able to get it to reproduce at all.

I'm CC'ing this over to Mason to see if he wants to test it on OS X and can get it to reproduce for him.

Comment 3

[Mason Chang [Inactive] [:mchang]]

From https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer, it looks like mac ASAN builds aren't really supported at the moment, and only linux builds are. There are some instructions on how to build ASAN on OS X here - https://bugzilla.mozilla.org/show_bug.cgi?id=1026162#c7. How are you building ASAN builds?

Comment 4

[Al Billings [:abillings - ex-MoCo]]

Mason,

The fuzzing team builds Mac ASAN every day. 

AFAIK, https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer#Adjusting_the_build_configuration is the instruction set. 

CC'ing Decoder.

Comment 5

[Mason Chang [Inactive] [:mchang]]

Attachment: Compile error log

I'm getting a lot of linker errors with an ASAN build from following the instructions at https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer#Adjusting_the_build_configuration. I also compiled my own LLVM / Clang to get the llvm-symbolizer working and that didn't seem to fix the compile error.

Comment 6

[Al Billings [:abillings - ex-MoCo]]

Traditionally, ASAN compilation has been very sensitive to clang revisions. What version of LLVM are you using?

Comment 7

[Mason Chang [Inactive] [:mchang]]

(In reply to Mason Chang [:mchang] from comment #5)
> Created attachment 8720590 [details]
> Compile error log
> 
> I'm getting a lot of linker errors with an ASAN build from following the
> instructions at
> https://developer.mozilla.org/en-US/docs/Mozilla/Testing/
> Firefox_and_Address_Sanitizer#Adjusting_the_build_configuration. I also
> compiled my own LLVM / Clang to get the llvm-symbolizer working and that
> didn't seem to fix the compile error.

I've tried both with clang that comes with OS X El Capitan:

clang --version
Apple LLVM version 7.0.2 (clang-700.1.81)
Target: x86_64-apple-darwin15.3.0
Thread model: posix

And locally built:
./clang --version
clang version 3.7.1 (tags/RELEASE_371/final)
Target: x86_64-apple-darwin15.3.0
Thread model: posix

Comment 8

[Al Billings [:abillings - ex-MoCo]]

At https://developer.mozilla.org/en-US/docs/Mozilla/Testing/Firefox_and_Address_Sanitizer it suggests:

REV=200213

with a big bold note that says:

It is NOT advised to use system-supplied versions of clang for ASAN builds; they may have issues or instabilities when used to build/test Firefox.  The versions given are known to work.

Comment 9

[Mason Chang [Inactive] [:mchang]]

Attachment: Compile error with in tree asan config

Comment 10

[Mason Chang [Inactive] [:mchang]]

Attachment: Compile error with clang version 3.6.0 (trunk 214699)

Some new different errors even using the specific clang version:

 # For MacOSX, please use at least r214699.

I also downloaded the 10.8 SDK since I'm on 10.11, same error.

Comment 11

[Milan Sreckovic [:milan] (needinfo for best results)]

Peter, can somebody in Taipei do the ASAN build?

Comment 12

[Peter Chang[:pchang]]

(In reply to Milan Sreckovic [:milan] from comment #11)
> Peter, can somebody in Taipei do the ASAN build?

I can try to build ASAN build on OSX first.

Comment 13

[Peter Chang[:pchang]]

(In reply to Jesse Ruderman from comment #0)
> Created attachment 8702419 [details]
> testcase (may crash Firefox) (requires path adjustment)
> 
> Same testcase as bug 1225250, crashes again on mozilla-central, at least
> with ASan. I haven't gotten non-ASan builds to crash with this testcase.
> 
> You'll need to adjust the testcase so it points to your copy of
> layout/reftests/webm-video/frames.webm (in your mozilla-central tree or
> tests zip). Any other video file will probably crash too, but an image file
> won't.

I just built the ASAN build on OSX but I couldn't reproduce this issue after modifying video path. 
Jesse, are you able to reproduce this issue?

Comment 14

[Milan Sreckovic [:milan] (needinfo for best results)]

Assigning while Peter is looking into this.

Comment 15

[Peter Chang[:pchang]]

Jesse, as comment in 13, are you able to reproduce this issue now?

Comment 16

[Al Billings [:abillings - ex-MoCo]]

Schwartzentruber, can you look at this?

Comment 17

[Jesse Schwartzentruber (:truber)]

I'm also unable to reproduce, but... the crash is in the Geforce driver, which I don't have.

Comment 18

[Al Billings [:abillings - ex-MoCo]]

No way forward and there isn't further information to reproduce this. Closing as incomplete. If someone finds a way to reproduce it, please re-open.