Closed Bug 1334790 Opened 9 years ago Closed 9 years ago

heap-use-after free in FontEntry

Categories

(Core :: Graphics: Canvas2D, defect)

Product:
Core
Component:
Graphics: Canvas2D
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1334876
Tracking Flags:
Tracking Status
firefox54 --- affected

People

(Reporter: nils, Unassigned)

Details

(Keywords: csectype-uaf)

The following testcase crashes the latest ASAN build of Firefox. <script> function start() { //o0=window.document; o19=document.createElement('canvas').getContext('2d'); o23=document.fonts; o104=document.createElement('style'); document.documentElement.appendChild(o104); o23.onloading=fun1; o104.textContent="@font-face{ font-family: font9; src: url('/s/fonts/RobotoMono-Regular.ttf'),url('/s/fonts/RobotoMono-Italic.ttf'),local('Courier'),url('/s/fonts/Junction-webfont.eot'"; o19.font=" small font9"; o19.measureText("a"); } function fun1() { document.documentElement.textContent=''; o19.measureText("b"); } </script> <body onload="start()"></body> ================================================================= ==23470==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110002fbd98 at pc 0x7fad896b44bd bp 0x7ffc9c5f60c0 sp 0x7ffc9c5f60b8 READ of size 1 at 0x6110002fbd98 thread T0 (Web Content) #0 0x7fad896b44bc in FontEntry /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.h:1022:20 #1 0x7fad896b44bc in CheckState /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.cpp:1721 #2 0x7fad896b44bc in gfxFontGroup::GetFirstValidFont(unsigned int) /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.cpp:1876 #3 0x7fad896e0272 in void gfxFontGroup::InitScriptRun<char16_t>(mozilla::gfx::DrawTarget*, gfxTextRun*, char16_t const*, unsigned int, unsigned int, mozilla::unicode::Script, gfxMissingFontRecorder*) /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.cpp:2304:25 #4 0x7fad896b8c5e in void gfxFontGroup::InitTextRun<char16_t>(mozilla::gfx::DrawTarget*, gfxTextRun*, char16_t const*, unsigned int, gfxMissingFontRecorder*) /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.cpp:2237:17 #5 0x7fad896b82ef in gfxFontGroup::MakeTextRun(char16_t const*, unsigned int, gfxTextRunFactory::Parameters const*, unsigned int, gfxMissingFontRecorder*) /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.cpp:2103:5 #6 0x7fad8b8dd036 in MakeTextRun<char16_t> /home/worker/workspace/build/src/obj-firefox/dist/include/gfxTextRun.h:830:16 #7 0x7fad8b8dd036 in mozilla::dom::CanvasBidiProcessor::SetText(char16_t const*, int, nsBidiDirection) /home/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:3935 #8 0x7fad8dce97b7 in nsBidiPresUtils::ProcessText(char16_t const*, int, unsigned char, nsPresContext*, nsBidiPresUtils::BidiProcessor&, nsBidiPresUtils::Mode, nsBidiPositionResolve*, int, int*, nsBidi*) /home/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:2055:7 #9 0x7fad8b851024 in mozilla::dom::CanvasRenderingContext2D::DrawOrMeasureText(nsAString_internal const&, float, float, mozilla::dom::Optional<double> const&, mozilla::dom::CanvasRenderingContext2D::TextDrawOperation, float*) /home/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:4263:8 #10 0x7fad8b852796 in mozilla::dom::CanvasRenderingContext2D::MeasureText(nsAString_internal const&, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:3796:12 #11 0x7fad8ab97772 in mozilla::dom::CanvasRenderingContext2DBinding::measureText(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitMethodCallArgs const&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:5854:57 #12 0x7fad8b75f790 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2915:13 #13 0x7fad911ab31c in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15 #14 0x7fad911ab31c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:460 #15 0x7fad911910ae in CallFromStack /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:511:12 #16 0x7fad911910ae in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2957 #17 0x7fad91174fa1 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:406:12 #18 0x7fad911ab59c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:478:15 #19 0x7fad911abc52 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:524:10 #20 0x7fad919e575d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:2847:12 #21 0x7fad8b2bd86f in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:259:37 #22 0x7fad8bbe2cf7 in Call<nsISupports *> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:361:12 #23 0x7fad8bbe2cf7 in mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) /home/worker/workspace/build/src/dom/events/JSEventHandler.cpp:214 #24 0x7fad8bbace6d in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1136:16 #25 0x7fad8bbae9ec in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1318:20 #26 0x7fad8bb99433 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:465:5 #27 0x7fad8bb9cd24 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:822:9 #28 0x7fad8dd5ece9 in nsDocumentViewer::LoadComplete(nsresult) /home/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:1044:7 #29 0x7fad8ec1041e in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7628:5 #30 0x7fad8ec0c354 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7432:7 #31 0x7fad8ec138ff in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7329:13 #32 0x7fad88d2b0a0 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1256:3 #33 0x7fad88d2a038 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:841:5 #34 0x7fad88d26d96 in nsDocLoader::DocLoaderIsEmpty(bool) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:731:9 #35 0x7fad88d28e94 in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:613:5 #36 0x7fad88d29a4c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:469:14 #37 0x7fad8750b54b in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /home/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:633:18 #38 0x7fad89d43afb in nsDocument::DoUnblockOnload() /home/worker/workspace/build/src/dom/base/nsDocument.cpp:8805:7 #39 0x7fad89dede4f in nsUnblockOnloadEvent::Run() /home/worker/workspace/build/src/dom/base/nsDocument.cpp:8756:5 #40 0x7fad8735a95b in nsThread::ProcessNextEvent(bool, bool*) /home/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1261:7 #41 0x7fad873572b0 in NS_ProcessNextEvent(nsIThread*, bool) /home/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:394:10 #42 0x7fad881615df in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /home/worker/workspace/build/src/ipc/glue/MessagePump.cpp:96:21 #43 0x7fad880d3868 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:238:3 #44 0x7fad880d3868 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:231 #45 0x7fad880d3868 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:211 #46 0x7fad8d52881f in nsBaseAppShell::Run() /home/worker/workspace/build/src/widget/nsBaseAppShell.cpp:156:3 #47 0x7fad8f7224d7 in XRE_RunAppShell() /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:927:12 #48 0x7fad880d3868 in RunInternal /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:238:3 #49 0x7fad880d3868 in RunHandler /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:231 #50 0x7fad880d3868 in MessageLoop::Run() /home/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:211 #51 0x7fad8f721cfd in XRE_InitChildProcess(int, char**, XREChildData const*) /home/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:759:7 #52 0x4df933 in content_process_main /home/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:115:19 #53 0x4df933 in main /home/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:284 #54 0x7fada272882f in __libc_start_main /build/glibc-t3gR2i/glibc-2.23/csu/../csu/libc-start.c:291 #55 0x41ba58 in _start (/home/nils/fuzzer3/firefox/firefox+0x41ba58) 0x6110002fbd98 is located 24 bytes inside of 256-byte region [0x6110002fbd80,0x6110002fbe80) freed by thread T0 (Web Content) here: #0 0x4b21ab in __interceptor_free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:38:3 #1 0x7fad87112071 in Free /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:199:34 #2 0x7fad87112071 in nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::ShrinkCapacity(unsigned long, unsigned long) /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:230 #3 0x7fad896bf6a2 in ShiftData<nsTArrayInfallibleAllocator> /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:261:5 #4 0x7fad896bf6a2 in RemoveElementsAt /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2087 #5 0x7fad896bf6a2 in Clear /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1768 #6 0x7fad896bf6a2 in gfxFontGroup::UpdateUserFonts() /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.cpp:3044 #7 0x7fad8b8dceee in mozilla::dom::CanvasBidiProcessor::SetText(char16_t const*, int, nsBidiDirection) /home/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:3927:5 #8 0x7fad8dce97b7 in nsBidiPresUtils::ProcessText(char16_t const*, int, unsigned char, nsPresContext*, nsBidiPresUtils::BidiProcessor&, nsBidiPresUtils::Mode, nsBidiPositionResolve*, int, int*, nsBidi*) /home/worker/workspace/build/src/layout/base/nsBidiPresUtils.cpp:2055:7 #9 0x7fad8b851024 in mozilla::dom::CanvasRenderingContext2D::DrawOrMeasureText(nsAString_internal const&, float, float, mozilla::dom::Optional<double> const&, mozilla::dom::CanvasRenderingContext2D::TextDrawOperation, float*) /home/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:4263:8 #10 0x7fad8b852796 in mozilla::dom::CanvasRenderingContext2D::MeasureText(nsAString_internal const&, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:3796:12 #11 0x7fad8ab97772 in mozilla::dom::CanvasRenderingContext2DBinding::measureText(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitMethodCallArgs const&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:5854:57 #12 0x7fad8b75f790 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2915:13 #13 0x7fad911ab31c in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15 #14 0x7fad911ab31c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:460 #15 0x7fad911910ae in CallFromStack /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:511:12 #16 0x7fad911910ae in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2957 #17 0x7fad91174fa1 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:406:12 #18 0x7fad911ab59c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:478:15 #19 0x7fad911abc52 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:524:10 #20 0x7fad919e575d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:2847:12 #21 0x7fad8b2bd86f in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:259:37 #22 0x7fad8bbe2cf7 in Call<nsISupports *> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:361:12 #23 0x7fad8bbe2cf7 in mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) /home/worker/workspace/build/src/dom/events/JSEventHandler.cpp:214 #24 0x7fad8bbace6d in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1136:16 #25 0x7fad8bbae9ec in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1318:20 #26 0x7fad8bb99433 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:465:5 #27 0x7fad8bb9cd24 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:822:9 #28 0x7fad8bb9f027 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:891:12 #29 0x7fad8bb55def in mozilla::DOMEventTargetHelper::DispatchEvent(nsIDOMEvent*, bool*) /home/worker/workspace/build/src/dom/events/DOMEventTargetHelper.cpp:279:5 #30 0x7fad8bb2c49b in mozilla::AsyncEventDispatcher::Run() /home/worker/workspace/build/src/dom/events/AsyncEventDispatcher.cpp:54:3 #31 0x7fad8993e5b3 in AddScriptRunner /home/worker/workspace/build/src/dom/base/nsContentUtils.cpp:5296:3 #32 0x7fad8993e5b3 in nsContentUtils::AddScriptRunner(nsIRunnable*) /home/worker/workspace/build/src/dom/base/nsContentUtils.cpp:5303 #33 0x7fad8bb2ce63 in mozilla::AsyncEventDispatcher::RunDOMEventWhenSafe() /home/worker/workspace/build/src/dom/events/AsyncEventDispatcher.cpp:88:3 #34 0x7fad8d8cac86 in mozilla::dom::FontFaceSet::CheckLoadingStarted() /home/worker/workspace/build/src/layout/style/FontFaceSet.cpp:1504:3 #35 0x7fad8d8bf28d in mozilla::dom::FontFace::SetStatus(mozilla::dom::FontFaceLoadStatus) /home/worker/workspace/build/src/layout/style/FontFace.cpp:448:5 #36 0x7fad8d8c2d5c in mozilla::dom::FontFace::Entry::SetLoadState(gfxUserFontEntry::UserFontLoadState) /home/worker/workspace/build/src/layout/style/FontFace.cpp:774:5 #37 0x7fad896c3612 in gfxUserFontEntry::LoadNextSrc() /home/worker/workspace/build/src/gfx/thebes/gfxUserFontSet.cpp:420:9 previously allocated by thread T0 (Web Content) here: #0 0x4b281e in realloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:71:3 #1 0x4e0b5d in moz_xrealloc /home/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:105:20 #2 0x7fad871129a6 in Realloc /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:211:12 #3 0x7fad871129a6 in nsTArrayInfallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned long, unsigned long) /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:183 #4 0x7fad896b0ad8 in AppendElement<gfxFontGroup::FamilyFace &, nsTArrayInfallibleAllocator> /home/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2216:32 #5 0x7fad896b0ad8 in gfxFontGroup::AddFamilyToFontList(gfxFontFamily*) /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.cpp:1654 #6 0x7fad896af508 in gfxFontGroup::BuildFontList() /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.cpp:1613:9 #7 0x7fad896aeced in gfxFontGroup::gfxFontGroup(mozilla::FontFamilyList const&, gfxFontStyle const*, gfxTextPerfMetrics*, gfxUserFontSet*, double) /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.cpp:1565:5 #8 0x7fad8958e72d in gfxPlatformGtk::CreateFontGroup(mozilla::FontFamilyList const&, gfxFontStyle const*, gfxTextPerfMetrics*, gfxUserFontSet*, double) /home/worker/workspace/build/src/gfx/thebes/gfxPlatformGtk.cpp:307:20 #9 0x7fad890a1a5b in nsFontMetrics::nsFontMetrics(nsFont const&, nsFontMetrics::Params const&, nsDeviceContext*) /home/worker/workspace/build/src/gfx/src/nsFontMetrics.cpp:142:18 #10 0x7fad8907afd9 in nsFontCache::GetMetricsFor(nsFont const&, nsFontMetrics::Params const&) /home/worker/workspace/build/src/gfx/src/nsDeviceContext.cpp:145:36 #11 0x7fad8907be5d in nsDeviceContext::GetMetricsFor(nsFont const&, nsFontMetrics::Params const&) /home/worker/workspace/build/src/gfx/src/nsDeviceContext.cpp:220:12 #12 0x7fad8b84e8d7 in mozilla::dom::CanvasRenderingContext2D::SetFontInternal(nsAString_internal const&, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/canvas/CanvasRenderingContext2D.cpp:3664:5 #13 0x7fad8aba2ca9 in mozilla::dom::CanvasRenderingContext2DBinding::set_font(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CanvasRenderingContext2D*, JSJitSetterCallArgs) /home/worker/workspace/build/src/obj-firefox/dom/bindings/CanvasRenderingContext2DBinding.cpp:5906:3 #14 0x7fad8b75ef83 in mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2883:8 #15 0x7fad911ab31c in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:239:15 #16 0x7fad911ab31c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:460 #17 0x7fad911acfd6 in InternalCall /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:505:12 #18 0x7fad911acfd6 in Call /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:524 #19 0x7fad911acfd6 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:651 #20 0x7fad91f5b335 in SetExistingProperty /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2443:10 #21 0x7fad91f5b335 in js::NativeSetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::QualifiedBool, JS::ObjectOpResult&) /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2478 #22 0x7fad911896c0 in SetProperty /home/worker/workspace/build/src/js/src/vm/NativeObject.h:1514:12 #23 0x7fad911896c0 in SetPropertyOperation /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:259 #24 0x7fad911896c0 in Interpret(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2750 #25 0x7fad91174fa1 in js::RunScript(JSContext*, js::RunState&) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:406:12 #26 0x7fad911ab59c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:478:15 #27 0x7fad911abc52 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:524:10 #28 0x7fad919e575d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jsapi.cpp:2847:12 #29 0x7fad8b2bd86f in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:259:37 #30 0x7fad8bbe2cf7 in Call<nsISupports *> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:361:12 #31 0x7fad8bbe2cf7 in mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) /home/worker/workspace/build/src/dom/events/JSEventHandler.cpp:214 #32 0x7fad8bbace6d in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1136:16 #33 0x7fad8bbae9ec in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) /home/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1318:20 #34 0x7fad8bb99433 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:465:5 #35 0x7fad8bb9cd24 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /home/worker/workspace/build/src/dom/events/EventDispatcher.cpp:822:9 #36 0x7fad8dd5ece9 in nsDocumentViewer::LoadComplete(nsresult) /home/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:1044:7 #37 0x7fad8ec1041e in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7628:5 #38 0x7fad8ec0c354 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /home/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7432:7 SUMMARY: AddressSanitizer: heap-use-after-free /home/worker/workspace/build/src/gfx/thebes/gfxTextRun.h:1022:20 in FontEntry Shadow bytes around the buggy address: 0x0c2280057760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2280057770: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2280057780: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2280057790: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c22800577a0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa =>0x0c22800577b0: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd 0x0c22800577c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c22800577d0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c22800577e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c22800577f0: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2280057800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==23470==ABORTING
Group: core-security → gfx-core-security
Keywords: csectype-uaf
Possibly related to bug 1334823. Though the testcase here doesn't involve a forced cycle-collection, so maybe this one is a bit different.
Flags: needinfo?(cam)
This is the same issue as bug 1334876.
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: needinfo?(cam)
Resolution: --- → DUPLICATE
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.