Crash [@nsFrame::DidSetStyleContext]

RESOLVED FIXED in Firefox -esr52

Status

()

defect
P2
critical
RESOLVED FIXED
3 years ago
3 months ago

People

(Reporter: jkratzer, Assigned: heycam)

Tracking

(Blocks 1 bug, {crash, csectype-nullptr, testcase})

unspecified
mozilla56
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr52 fixed, firefox55 fixed, firefox56 fixed)

Details

Attachments

(1 attachment)

Posted file index.html
Testcase found by fuzzing on mozilla-central rev 20170215-ec3ef9f77a52.

ASAN:DEADLYSIGNAL
=================================================================
==18074==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f20bf782fed bp 0x7ffd11c864b0 sp 0x7ffd11c86360 T0)
    #0 0x7f20bf782fec in GetType /home/worker/workspace/build/src/layout/style/nsStyleStruct.h:447:12
    #1 0x7f20bf782fec in GetBorderImageRequest /home/worker/workspace/build/src/layout/style/nsStyleStruct.h:1386
    #2 0x7f20bf782fec in nsFrame::DidSetStyleContext(nsStyleContext*) /home/worker/workspace/build/src/layout/generic/nsFrame.cpp:892
    #3 0x7f20bf77bfe1 in nsFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /home/worker/workspace/build/src/layout/generic/nsFrame.cpp:606:3
    #4 0x7f20bf970191 in nsSplittableFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /home/worker/workspace/build/src/layout/generic/nsSplittableFrame.cpp:22:3
    #5 0x7f20bf779ce1 in nsContainerFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /home/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:58:3
    #6 0x7f20bf8dfcad in nsFirstLineFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /home/worker/workspace/build/src/layout/generic/nsInlineFrame.cpp:1039:3
    #7 0x7f20bf5a92d6 in nsCSSFrameConstructor::InitAndRestoreFrame(nsFrameConstructorState const&, nsIContent*, nsContainerFrame*, nsIFrame*, bool) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:4966:3
    #8 0x7f20bf5ebd76 in nsCSSFrameConstructor::WrapFramesInFirstLineFrame(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsFirstLineFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:11007:5
    #9 0x7f20bf5aaee5 in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, nsStyleContext*, nsContainerFrame*, bool, nsFrameItems&, bool, PendingBinding*, nsIFrame*) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10900:5
    #10 0x7f20bf5b38d3 in nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, nsStyleContext*, nsContainerFrame**, nsFrameItems&, nsIFrame*, PendingBinding*) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:11901:3
    #11 0x7f20bf5c26a5 in ConstructNonScrollableBlockWithConstructor /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:4943:3
    #12 0x7f20bf5c26a5 in nsCSSFrameConstructor::ConstructNonScrollableBlock(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:4907
    #13 0x7f20bf5bdb74 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:3880:7
    #14 0x7f20bf5c9986 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameItems&) /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:6189:3
    #15 0x7f20bf5aae18 in ConstructFramesFromItemList /home/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10685:5
Flags: in-testsuite?
Blocks: domino
No longer blocks: fuzz
In a debug build I get this:
Assertion failure: !(mConditionalBits & GetBitForSID(aSID)) (rule node should not have unconditional and conditional style data for a given struct), at layout/style/nsRuleNode.h:190

Perhaps we could fix this by fixing bug 759996?
OS: Unspecified → All
Priority: -- → P2
Hardware: Unspecified → All
This appears to have been fixed by bug 1353312. Was that expected, Cam? If so, would it be worth landing the testcase here as a crashtest still?

INFO: First good revision: c5507f94e8fee7a8c91210d228826cbc3e8eb698
INFO: Last bad revision: f433b516c2d83f8fa93915a8860a9e4e338fb1ea
INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=f433b516c2d83f8fa93915a8860a9e4e338fb1ea&tochange=c5507f94e8fee7a8c91210d228826cbc3e8eb698
Assignee: nobody → cam
Status: NEW → RESOLVED
Closed: 2 years ago
Depends on: CVE-2017-7753
Flags: needinfo?(cam)
Resolution: --- → FIXED
Target Milestone: --- → mozilla56
Yes, given the assertion Mats mentions in comment 1 it makes sense that this was fixed by bug 1353312.  Landing the test sounds like a good idea.
Flags: needinfo?(cam)
Flags: needinfo?(ryanvm)
Since bug 1353312 hasn't been opened up yet, and we didn't land a crashtest there yet, I wonder if we should hold off.
Group: core-security
Duplicate of this bug: 1341319
Group: core-security → core-security-release
Group: core-security-release
Flags: needinfo?(ryanvm)
Flags: in-testsuite?
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.