Closed Bug 1337052 Opened 8 years ago Closed 8 years ago

Crash in nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Version:
52 Branch
Platform:
Unspecified
Windows 10
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1337814
Tracking Flags:
Tracking Status
firefox53 --- unaffected
firefox54 --- affected

People

(Reporter: calixte, Unassigned)

References

Details

(Keywords: crash, csectype-wildptr, sec-critical)

Crash Data

This bug was filed from the Socorro interface and is report bp-232aa120-f1f7-433d-b69f-789a32170206. ============================================================= There are 61 crashes in nightly with build-id 20170205030206.
Flags: needinfo?(bugs)
There are 51 crashes with signature "@0x0 | nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable" and 4 with signature "xul.dll@0x25bd9c8 | nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable"
Crash Signature: [@ nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable] → [@ nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable] [@ @0x0 | nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable ] [@ xul.dll@0x25bd9c8 | nsTArray_Impl<T>::RemoveEl…
per calixte, this is a wild ptr (or UAF) exec crash in 54, during cycle collection.
Group: core-security
Keywords: csectype-wildptr, sec-critical
All the stacks have something weird after the call in FireForgetSkippable. Memory corruption?
Crash Signature: nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable ] → nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable ] [@ xul.dll@0x25b0450 | nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable ]
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → DUPLICATE
Flags: needinfo?(bugs)
We should make sure these signatures actually go away, of course.
sure, especially because couple of other interesting patches landed around the same time we started to see these crashes.
I guess I'll leave it unduplicated for now.
Status: RESOLVED → REOPENED
status-firefox53: --- → unaffected
Depends on: 1337814
Resolution: DUPLICATE → ---
Group: core-security → dom-core-security
I don't see any crashes on builds newer than 2-5.
Status: REOPENED → RESOLVED
Closed: 8 years ago → 8 years ago
Resolution: --- → DUPLICATE
Component: DOM → DOM: Core & HTML
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.