1314027 - Crash [@ mozilla::dom::DOMIntersectionObserver::Update ]

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: crash report Windows 7 32bit

Found on Bughunter as a highly exploitable crash on Windows x86. Reproduced on Nightly Windows 7, Windows 10, Fedora 24, Ubuntu 16 and reproduced locally on Linux x86_64 with bp-ead1d1a1-d7fb-48fe-96ed-b30f52161031 on Linux x86_64. Also crashes Linux asan builds.

Reproduced with http://www.cda.pl/gry-online/34264f0/Fabryka-Factory-Idle and 16 other urls with EXCEPTION_ACCESS_VIOLATION_EXEC and EXCEPTION_ACCESS_VIOLATION_READ

Other urls:

https://it.yahoo.com/
https://www.olx.pl/szczytno/q-radio/
http://www.bankier.pl/forum/forum_o_elektrim%2C6%2C21%2C56.html

Comment 1

[Bob Clary [:bc] (inactive)]

Attachment: asan crash report

opt asan crash report for http://video.thebiglead.com/feature/russell-westbrook-will-be-unleashed-like-never-before-.html

Comment 2

[Andrew McCreight [:mccr8]]

The ASan report just says this is a null deref crash, so I'm clearing the sec-critical flag for now.

Comment 3

[Bob Clary [:bc] (inactive)]

exploitable reported high for the Windows 32bit crashes combined with the EXCEPTION_ACCESS_VIOLATION_EXEC reason leads me to think this is sec-critical.

Comment 4

[Tobias Schneider [:tobytailor]]

Should have been fixed via bug 1314032. Bob, can you confirm?

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: asan crash report after

Still getting asan crashes along with null ptr crashes. No exploitable high crashes but still see some exploitable low on debug Windows 32 bit builds.

Comment 6

[Bob Clary [:bc] (inactive)]

url for last asan report was:
https://www.olx.pl/oferty/q-gospodarstwo/?page=8

Comment 7

[Bob Clary [:bc] (inactive)]

Attachment: windows 10 debug crash report after

http://www.dagbladet.no/kultur/bergensere-har-en-veldig-pastaelig-dialekt-mange-hoyprofilerte-bergensere-som-hans-wilhelm-steinfeld-og-davy-wathne-er-jo-litt-brautende/64031140 also crashes asan and shows a low exploitable on windows 10 32bit debug build.

Comment 8

[Bob Clary [:bc] (inactive)]

Attachment: windows 7 debug crash report (assertion) after

Windows 7 32bit debug

Assertion failure: mRawPtr != 0 (You can't dereference a NULL RefPtr with operator->().), at c:\builds\moz2_slave\m-cen-w32-d-000000000000000000\build\src\obj-firefox\dist\include\mozilla/RefPtr.h:307

https://www.olx.pl/dom-ogrod/krakow/q-rolety/?page=2

Comment 9

[Andrew McCreight [:mccr8]]

The ASan report after is crashing on 0x0187c005e338, which is not null any more, so I'll bump this back up to critical. ;)

Comment 10

[Tobias Schneider [:tobytailor]]

Attachment: Avoid uninitialized pointers

Fixes crash by making sure pointers are initialized properly.

Comment 11

[Carsten Book [:Tomcat]]

http://www.b.dk/ is another live web example where the topsite tests crashed today with this signature

Comment 12

[Markus Stange [:mstange]]

Comment on attachment 8806616 [details] [diff] [review]
Avoid uninitialized pointers

Review of attachment 8806616 [details] [diff] [review]:
-----------------------------------------------------------------

I can't believe I didn't catch that.

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9beb0764b238011e6b35a06185978fb01957c2d2

Comment 14

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/9beb0764b238