Crash [@mozilla::dom::WindowBinding::get_customElements]

RESOLVED FIXED in Firefox 54

Status

()

Core
DOM: Core & HTML
--
critical
RESOLVED FIXED
8 months ago
8 months ago

People

(Reporter: jkratzer, Assigned: edgar)

Tracking

(Blocks: 1 bug, {crash, csectype-nullptr, testcase})

unspecified
mozilla54
crash, csectype-nullptr, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox52 disabled, firefox-esr52 disabled, firefox53 disabled, firefox54 fixed)

Details

(Whiteboard: dom-ce-m1)

Attachments

(2 attachments, 1 obsolete attachment)

(Reporter)

Description

8 months ago
Created attachment 8839993 [details]
index.html

Testcase found by fuzzing on mozilla-central rev 20170216-a9ec72f82299.  Testcase requires the following pref in order to crash:

//user_pref("dom.webcomponents.enabled", true);

==25071==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x7fe5f40c9570 bp 0x7ffc3ec3d4d0 sp 0x7ffc3ec3d4b0 T0)
    #0 0x7fe5f40c956f in HasWrapperFlag /home/worker/workspace/build/src/obj-firefox/dist/include/nsWrapperCache.h:312:15
    #1 0x7fe5f40c956f in IsDOMBinding /home/worker/workspace/build/src/obj-firefox/dist/include/nsWrapperCache.h:155
    #2 0x7fe5f40c956f in CouldBeDOMBinding /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/BindingUtils.h:717
    #3 0x7fe5f40c956f in DoGetOrCreateDOMReflector<mozilla::dom::CustomElementRegistry, mozilla::dom::binding_detail::GetOrCreateReflectorWrapBehavior::eWrapIntoContextCompartment> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/BindingUtils.h:908
    #4 0x7fe5f40c956f in GetOrCreateDOMReflector<mozilla::dom::CustomElementRegistry> /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/BindingUtils.h:992
    #5 0x7fe5f40c956f in mozilla::dom::WindowBinding::get_customElements(JSContext*, JS::Handle<JSObject*>, nsGlobalWindow*, JSJitGetterCallArgs) /home/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:1441
    #6 0x7fe5f40c65dd in mozilla::dom::WindowBinding::genericGetter(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:15660:13
    #7 0x7fe5fa320e24 in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:281:15
    #8 0x7fe5fa320e24 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:463
    #9 0x7fe5fa3223be in InternalCall /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:508:12
    #10 0x7fe5fa3223be in Call /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:527
    #11 0x7fe5fa3223be in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:641
    #12 0x7fe5fb23e1e7 in CallGetter /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:1806:16
    #13 0x7fe5fb23e1e7 in GetExistingProperty<js::AllowGC::CanGC> /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:1854
    #14 0x7fe5fb23e1e7 in NativeGetPropertyInline<js::AllowGC::CanGC> /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2083
    #15 0x7fe5fb23e1e7 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2117
Flags: in-testsuite?
(Assignee)

Updated

8 months ago
Assignee: nobody → echen
(Assignee)

Comment 1

8 months ago
The problem is:
- Removing iframe from documentElement triggers nsGlobalWindow::DetachFromDocShell() and mCustomElements be nulled out in nsGlobalWindow::CleanUp();
- Then we try to get iframe.customElements again, but CustomElementRegistry::Create() returns nullptr due to  aWindow->GetDocShell() check.
(Assignee)

Comment 2

8 months ago
Created attachment 8840370 [details] [diff] [review]
Patch, v1
(Assignee)

Comment 3

8 months ago
Created attachment 8840745 [details] [diff] [review]
Patch, v2
Attachment #8840370 - Attachment is obsolete: true
(Assignee)

Comment 4

8 months ago
Comment on attachment 8840745 [details] [diff] [review]
Patch, v2

Review of attachment 8840745 [details] [diff] [review]:
-----------------------------------------------------------------

Try result: https://treeherder.allizom.org/#/jobs?repo=try&revision=c0ff853d3283665f445cf4ca818bdc29bfb5b2a6&filter-tier=1&group_state=expanded&selectedJob=74252826
Attachment #8840745 - Flags: review?(wchen)

Updated

8 months ago
Attachment #8840745 - Flags: review?(wchen) → review+

Comment 5

8 months ago
Pushed by echen@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2dd1002e793b
Don't need to check GetDocShell() when creating CustomElementRegistry; r=wchen

Comment 6

8 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/2dd1002e793b
Status: NEW → RESOLVED
Last Resolved: 8 months ago
status-firefox54: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla54

Updated

8 months ago
Whiteboard: dom-ce-m1
status-firefox52: --- → disabled
status-firefox53: --- → disabled
status-firefox-esr52: --- → disabled
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.