Closed Bug 1281164 Opened 10 years ago Closed 10 years ago

use-after-poison in NS_NewStyleContext

Categories

(Core :: Layout, defect)

Product:
Core
Component:
Layout
Version:
49 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1277908
Tracking Flags:
Tracking Status
firefox47 --- unaffected
firefox48 --- unaffected
firefox49 --- affected
firefox-esr45 --- unaffected
firefox50 --- affected

People

(Reporter: nils, Unassigned)

References

Details

(5 keywords)

Attachments

(1 file)

testcase from comment 0
842 bytes, text/html
Details
use-after-poinson in NS_NewStyleContext The testcase crashes the latest asan build of Firefox (BuildID=20160617030217) as follows. <script> function start() { o28=document.createElement('a'); o28.href='javascript:x()'; o115=document.createElement('tr'); o116=document.createElement('th'); o116.innerHTML="<style>{}\n*{ display: table;> </style><style>@keyframes key8 { from{ left; background-position-x: 128vw}to{}label}\n*{ animation-name: key8; animation-duration: 0.001s"; document.documentElement.appendChild(o28); document.documentElement.appendChild(o115); document.documentElement.appendChild(o116); o213=document.createElement('input'); o115.appendChild(o213); o216=document.createElement('style'); o217=document.createTextNode("*{ text-shadow: 196608rem -3px"); o216.appendChild(o217); o213.appendChild(o216); } </script> <body onload="start()"></body> Asan ouput: ================================================================= ==10164==ERROR: AddressSanitizer: use-after-poison on address 0x625000308428 at pc 0x7fa367061c50 bp 0x7ffcf0c86e30 sp 0x7ffcf0c86e28 READ of size 4 at 0x625000308428 thread T0 (Web Content) #0 0x7fa367061c4f in AddRef /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleSet.h:576:14 #1 0x7fa367061c4f in AddRef /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:36 #2 0x7fa367061c4f in AddRef /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:374 #3 0x7fa367061c4f in RefPtr /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:110 #4 0x7fa367061c4f in NS_NewStyleContext(nsStyleContext*, nsIAtom*, mozilla::CSSPseudoElementType, nsRuleNode*, bool) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleContext.cpp:1313 #5 0x7fa36706d310 in nsStyleSet::GetContext(nsStyleContext*, nsRuleNode*, nsRuleNode*, nsIAtom*, mozilla::CSSPseudoElementType, mozilla::dom::Element*, unsigned int) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleSet.cpp:923:9 #6 0x7fa3670721b3 in nsStyleSet::ResolveStyleFor(mozilla::dom::Element*, nsStyleContext*, TreeMatchContext&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleSet.cpp:1366:10 #7 0x7fa3671e51b2 in ResolveStyleFor /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/StyleSetHandleInlines.h:93:3 #8 0x7fa3671e51b2 in nsCSSFrameConstructor::ResolveStyleContext(nsStyleContext*, nsIContent*, nsFrameConstructorState*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:4959 #9 0x7fa3671e11d0 in ResolveStyleContext /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:4928:10 #10 0x7fa3671e11d0 in ResolveStyleContext /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:4944 #11 0x7fa3671e11d0 in nsCSSFrameConstructor::AddFrameConstructionItems(nsFrameConstructorState&, nsIContent*, bool, nsCSSFrameConstructor::InsertionPoint const&, nsCSSFrameConstructor::FrameConstructionItemList&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:5574 #12 0x7fa3671c7dd3 in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsStyleContext*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:10685:9 #13 0x7fa3671c6404 in nsCSSFrameConstructor::ConstructTable(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:2130:5 #14 0x7fa3671ce230 in nsCSSFrameConstructor::ConstructDocElementFrame(mozilla::dom::Element*, nsILayoutHistoryState*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:2594:7 #15 0x7fa3671f05b7 in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsIContent*, nsILayoutHistoryState*, bool) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:7635:7 #16 0x7fa36716ffae in ContentInserted /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:7521:10 #17 0x7fa36716ffae in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, bool, nsCSSFrameConstructor::RemoveFlags, nsIContent**) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:9589 #18 0x7fa36716dd3f in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/RestyleManager.cpp:837:7 #19 0x7fa3671713dc in mozilla::RestyleManager::ComputeAndProcessStyleChange(nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/RestyleManager.cpp:4981:3 #20 0x7fa367170856 in mozilla::RestyleManager::RestyleElement(mozilla::dom::Element*, nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/RestyleManager.cpp:1080:5 #21 0x7fa36719089f in ProcessOneRestyle /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/RestyleTracker.cpp:94:5 #22 0x7fa36719089f in mozilla::RestyleTracker::DoProcessRestyles() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/RestyleTracker.cpp:262 #23 0x7fa367177f3f in ProcessRestyles /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/RestyleManager.h:536:7 #24 0x7fa367177f3f in mozilla::RestyleManager::ProcessPendingRestyles() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/RestyleManager.cpp:1807 #25 0x7fa3673a287a in ProcessPendingRestyles /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/RestyleManagerHandleInlines.h:74:3 #26 0x7fa3673a287a in PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsPresShell.cpp:4088 #27 0x7fa3670cc62c in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsRefreshDriver.cpp:1753:11 #28 0x7fa3670d818c in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsRefreshDriver.cpp:251:7 #29 0x7fa3670d7e59 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsRefreshDriver.cpp:270:5 #30 0x7fa3670d99a4 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsRefreshDriver.cpp:430:9 #31 0x7fa367a0da64 in mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/ipc/VsyncChild.cpp:64:5 #32 0x7fa3616b492a in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:240:20 #33 0x7fa3611bdd3d in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:1963:16 #34 0x7fa361105627 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/glue/MessageChannel.cpp:1658:14 #35 0x7fa36110242b in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/glue/MessageChannel.cpp:1596:17 #36 0x7fa3610f0137 in mozilla::ipc::MessageChannel::OnMaybeDequeueOne() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/glue/MessageChannel.cpp:1563:5 #37 0x7fa361120382 in applyImpl<mozilla::ipc::MessageChannel, bool (mozilla::ipc::MessageChannel::*)()> /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/nsThreadUtils.h:722:12 #38 0x7fa361120382 in apply<mozilla::ipc::MessageChannel, bool (mozilla::ipc::MessageChannel::*)()> /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/nsThreadUtils.h:728 #39 0x7fa361120382 in nsRunnableMethodImpl<bool (mozilla::ipc::MessageChannel::*)(), false, true>::Run() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/nsThreadUtils.h:756 #40 0x7fa36111f92f in Run /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/ipc/MessageChannel.h:476:22 #41 0x7fa36111f92f in mozilla::ipc::MessageChannel::DequeueTask::Run() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/ipc/MessageChannel.h:495 #42 0x7fa360328e58 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/xpcom/threads/nsThread.cpp:1029:7 #43 0x7fa3603a767c in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/xpcom/glue/nsThreadUtils.cpp:290:10 #44 0x7fa36110c9ff in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/glue/MessagePump.cpp:100:21 #45 0x7fa36107adf8 in RunInternal /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/chromium/src/base/message_loop.cc:235:3 #46 0x7fa36107adf8 in RunHandler /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/chromium/src/base/message_loop.cc:228 #47 0x7fa36107adf8 in MessageLoop::Run() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/chromium/src/base/message_loop.cc:208 #48 0x7fa366a469af in nsBaseAppShell::Run() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/widget/nsBaseAppShell.cpp:156:3 #49 0x7fa368ac9bf7 in XRE_RunAppShell /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/toolkit/xre/nsEmbedFunctions.cpp:834:12 #50 0x7fa36107adf8 in RunInternal /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/chromium/src/base/message_loop.cc:235:3 #51 0x7fa36107adf8 in RunHandler /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/chromium/src/base/message_loop.cc:228 #52 0x7fa36107adf8 in MessageLoop::Run() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/chromium/src/base/message_loop.cc:208 #53 0x7fa368ac9262 in XRE_InitChildProcess /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/toolkit/xre/nsEmbedFunctions.cpp:664:7 #54 0x4e2bc5 in content_process_main(int, char**) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/ipc/app/../contentproc/plugin-container.cpp:224:19 #55 0x7fa35d41382f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291 #56 0x41e778 in _start (/home/nils/fuzzer3/firefox/plugin-container+0x41e778) 0x625000308428 is located 4904 bytes inside of 8192-byte region [0x625000307100,0x625000309100) allocated by thread T0 (Web Content) here: #0 0x4b51eb in __interceptor_malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:52:3 #1 0x7fa36e626dd6 in PL_ArenaAllocate /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/nsprpub/lib/ds/plarena.c:210:27 #2 0x7fa3670c3959 in nsPresArena::Allocate(unsigned int, unsigned long) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsPresArena.cpp:165:3 #3 0x7fa366fc2eeb in AllocateByObjectID /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsPresArena.h:65:12 #4 0x7fa366fc2eeb in AllocateByObjectID /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsIPresShell.h:250 #5 0x7fa366fc2eeb in operator new /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsRuleNode.h:152 #6 0x7fa366fc2eeb in SetStyleData /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsRuleNode.h:303 #7 0x7fa366fc2eeb in PropagateDependentBit /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsRuleNode.cpp:1744 #8 0x7fa366fc2eeb in nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsRuleNode.cpp:2425 #9 0x7fa3670b5b5f in GetStyleTextReset<true> /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/layout/style/nsStyleStructList.h:92:1 #10 0x7fa3670b5b5f in nsStyleTextReset const* nsStyleContext::DoGetStyleTextReset<true>() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/layout/style/nsStyleStructList.h:92 #11 0x7fa36703ec1f in StyleTextReset /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/layout/style/nsStyleStructList.h:92:1 #12 0x7fa36703ec1f in nsStyleContext::SetStyleBits() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleContext.cpp:677 #13 0x7fa36703ea86 in FinishConstruction /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleContext.cpp:163:3 #14 0x7fa36703ea86 in nsStyleContext::nsStyleContext(nsStyleContext*, nsIAtom*, mozilla::CSSPseudoElementType, already_AddRefed<nsRuleNode>, bool) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleContext.cpp:121 #15 0x7fa367061aec in NS_NewStyleContext(nsStyleContext*, nsIAtom*, mozilla::CSSPseudoElementType, nsRuleNode*, bool) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleContext.cpp:1316:5 #16 0x7fa36706d310 in nsStyleSet::GetContext(nsStyleContext*, nsRuleNode*, nsRuleNode*, nsIAtom*, mozilla::CSSPseudoElementType, mozilla::dom::Element*, unsigned int) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleSet.cpp:923:9 #17 0x7fa3670729aa in nsStyleSet::ResolveStyleByAddingRules(nsStyleContext*, nsCOMArray<nsIStyleRule> const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleSet.cpp:1431:10 #18 0x7fa362b7e737 in mozilla::CreateStyleContextForAnimationValue(nsCSSProperty, mozilla::StyleAnimationValue, nsStyleContext*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/dom/animation/KeyframeUtils.cpp:933:5 #19 0x7fa362b6b79e in BuildSegmentsFromValueEntries /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/dom/animation/KeyframeUtils.cpp:1082:7 #20 0x7fa362b6b79e in mozilla::KeyframeUtils::GetAnimationPropertiesFromKeyframes(nsStyleContext*, mozilla::dom::Element*, mozilla::CSSPseudoElementType, nsTArray<mozilla::Keyframe> const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/dom/animation/KeyframeUtils.cpp:554 #21 0x7fa362b57597 in mozilla::dom::KeyframeEffectReadOnly::UpdateProperties(nsStyleContext*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/dom/animation/KeyframeEffect.cpp:516:7 #22 0x7fa366e526a5 in CSSAnimationBuilder::Build(nsPresContext*, mozilla::StyleAnimation const&, nsCSSKeyframesRule const*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsAnimationManager.cpp:644:3 #23 0x7fa366e51018 in nsAnimationManager::BuildAnimations(nsStyleContext*, mozilla::dom::Element*, mozilla::AnimationCollection<mozilla::dom::CSSAnimation>*, nsTArray<RefPtr<mozilla::dom::CSSAnimation> >&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsAnimationManager.cpp:1091:33 #24 0x7fa366e503cc in nsAnimationManager::UpdateAnimations(nsStyleContext*, mozilla::dom::Element*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsAnimationManager.cpp:405:5 #25 0x7fa36706d73f in nsStyleSet::GetContext(nsStyleContext*, nsRuleNode*, nsRuleNode*, nsIAtom*, mozilla::CSSPseudoElementType, mozilla::dom::Element*, unsigned int) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleSet.cpp:949:7 #26 0x7fa3670721b3 in nsStyleSet::ResolveStyleFor(mozilla::dom::Element*, nsStyleContext*, TreeMatchContext&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleSet.cpp:1366:10 #27 0x7fa3671e51b2 in ResolveStyleFor /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/StyleSetHandleInlines.h:93:3 #28 0x7fa3671e51b2 in nsCSSFrameConstructor::ResolveStyleContext(nsStyleContext*, nsIContent*, nsFrameConstructorState*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:4959 #29 0x7fa3671e11d0 in ResolveStyleContext /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:4928:10 #30 0x7fa3671e11d0 in ResolveStyleContext /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:4944 #31 0x7fa3671e11d0 in nsCSSFrameConstructor::AddFrameConstructionItems(nsFrameConstructorState&, nsIContent*, bool, nsCSSFrameConstructor::InsertionPoint const&, nsCSSFrameConstructor::FrameConstructionItemList&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:5574 #32 0x7fa3671f4c51 in nsCSSFrameConstructor::ContentAppended(nsIContent*, nsIContent*, bool) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:7372:5 #33 0x7fa3671f0178 in nsCSSFrameConstructor::CreateNeededFrames(nsIContent*) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:7047:5 #34 0x7fa367173608 in nsCSSFrameConstructor::CreateNeededFrames() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsCSSFrameConstructor.cpp:7069:5 #35 0x7fa367177e42 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/RestyleManager.cpp:1766:3 #36 0x7fa3673a287a in ProcessPendingRestyles /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/obj-firefox/dist/include/mozilla/RestyleManagerHandleInlines.h:74:3 #37 0x7fa3673a287a in PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsPresShell.cpp:4088 #38 0x7fa3670cc62c in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsRefreshDriver.cpp:1753:11 #39 0x7fa3670d818c in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsRefreshDriver.cpp:251:7 #40 0x7fa3670d7e59 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsRefreshDriver.cpp:270:5 #41 0x7fa3670d99a4 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/base/nsRefreshDriver.cpp:430:9 #42 0x7fa367a0da64 in mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/ipc/VsyncChild.cpp:64:5 SUMMARY: AddressSanitizer: use-after-poison /builds/slave/m-cen-l64-asan-ntly-0000000000/build/src/layout/style/nsStyleSet.h:576:14 in AddRef Shadow bytes around the buggy address: 0x0c4a80059030: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80059040: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80059050: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a80059060: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 00 00 0x0c4a80059070: 00 00 00 00 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 =>0x0c4a80059080: f7 f7 f7 f7 f7[f7]00 00 00 00 00 00 00 00 00 00 0x0c4a80059090: 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c4a800590a0: f7 f7 f7 f7 f7 f7 00 00 00 00 00 00 00 00 00 00 0x0c4a800590b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a800590c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4a800590d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==10164==ABORTING
Neither opt nor debug builds crash or even emit an assertion so we'll have to track this down using ASAN builds.
Group: core-security → layout-core-security
Keywords: csectype-uaf, regressionwindow-wanted
Summary: use-after-poinson in NS_NewStyleContext → use-after-poison in NS_NewStyleContext
Flags: sec-bounty?
It crashes my local debug build on Linux (non-ASAN). We're crashing on a destroyed nsRuleNode (frame-poisoned): (rr) up #3 0x00007f64f0a78827 in nsStyleSet::GetContext (this=0x7f64d9eb2b20, aParentContext=0x7f64c2208778, aRuleNode=0x7f64cd9fe5c0, aVisitedRuleNode=0x7f64cd9fe620, aPseudoTag=0x0, aPseudoType=mozilla::NotPseudo, aElementForAnimation=0x7f64d6e896c0, aFlags=5) at layout/style/nsStyleSet.cpp:923 923 NS_NewStyleContext(parentIfVisited, aPseudoTag, aPseudoType, (rr) list 918 result = NS_NewStyleContext(aParentContext, aPseudoTag, aPseudoType, 919 aRuleNode, 920 aFlags & eSkipParentDisplayBasedStyleFixup); 921 if (aVisitedRuleNode) { 922 RefPtr<nsStyleContext> resultIfVisited = 923 NS_NewStyleContext(parentIfVisited, aPseudoTag, aPseudoType, 924 aVisitedRuleNode, 925 aFlags & eSkipParentDisplayBasedStyleFixup); 926 resultIfVisited->SetIsStyleIfVisited(); 927 result->SetStyleIfVisited(resultIfVisited.forget()); (rr) p *aVisitedRuleNode $4 = { <mozilla::LinkedListElement<nsRuleNode>> = { mNext = 0x7ffffffff0dea7ff, mPrev = 0x7ffffffff0dea7ff, mIsSentinel = 255 }, members of nsRuleNode: mPresContext = 0x7ffffffff0dea7ff, mParent = { mRawPtr = 0x7ffffffff0dea7ff }, ... It looks like a dupe of bug 1277908.
Severity: normal → critical
Depends on: 1277908
Keywords: csectype-uaf → crash, csectype-framepoisoning, sec-other, testcase
INFO: Last good revision: 5613020111ba45dda63615dfa5a791f7ad1a8e4a INFO: First bad revision: fe7766352e3eb84c9da204d866e8a25d814a09d8 INFO: Pushlog: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=5613020111ba45dda63615dfa5a791f7ad1a8e4a&tochange=fe7766352e3eb84c9da204d866e8a25d814a09d8 INFO: Looks like the following bug has the changes which introduced the regression: https://bugzilla.mozilla.org/show_bug.cgi?id=1166500
Blocks: 1166500
status-firefox47: --- → unaffected
status-firefox48: --- → unaffected
status-firefox49: --- → affected
status-firefox-esr45: --- → unaffected
tracking-firefox49: --- → ?
tracking-firefox50: --- → ?
Flags: in-testsuite?
Keywords: regressionwindow-wanted
Version: 50 Branch → 49 Branch
This is identical to the symptoms of bug 1277908 and I've verified that the fix from that bug fixes this too.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
Flags: sec-bounty? → sec-bounty-
We can track for 49/50 in the duplicate bug.
tracking-firefox49: ? → ---
tracking-firefox50: ? → ---
Group: layout-core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: