Crash [@nsStyleBorder::CalcDifference]

RESOLVED FIXED in Firefox -esr52

Status

()

defect
--
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: jkratzer, Assigned: heycam)

Tracking

(Blocks 1 bug, {crash, csectype-nullptr, testcase})

unspecified
mozilla56
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr52 fixed, firefox55 fixed, firefox56 fixed)

Details

Attachments

(1 attachment)

Reporter

Description

2 years ago
Posted file testcase
Testcase found by fuzzing on mozilla-central rev 20170302-d29f84406483.

This may be related to bug 1341319.

ASAN:DEADLYSIGNAL
=================================================================
==29908==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f37e51b9cfa bp 0x7fff76ddc650 sp 0x7fff76ddc540 T0)
    #0 0x7f37e51b9cf9 in nsStyleBorder::CalcDifference(nsStyleBorder const&) const /home/worker/workspace/build/src/layout/style/nsStyleStruct.cpp:449:34
    #1 0x7f37e5187dae in nsChangeHint nsStyleContext::CalcStyleDifferenceInternal<nsStyleContext>(nsStyleContext*, nsChangeHint, unsigned int*, unsigned int*) /home/worker/workspace/build/src/layout/style/nsStyleContext.cpp:1140:3
    #2 0x7f37e526814d in mozilla::ElementRestyler::CaptureChange(nsStyleContext*, nsStyleContext*, nsChangeHint, unsigned int*, unsigned int*) /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:1266:5
    #3 0x7f37e5270811 in mozilla::ElementRestyler::RestyleSelf(nsIFrame*, nsRestyleHint, unsigned int*, nsTArray<mozilla::ElementRestyler::SwapInstruction>&) /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:2653:7
    #4 0x7f37e526c557 in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:1807:7
    #5 0x7f37e5276fb7 in mozilla::ElementRestyler::RestyleContentChildren(nsIFrame*, nsRestyleHint) /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:3407:13
    #6 0x7f37e52741cd in mozilla::ElementRestyler::RestyleChildren(nsRestyleHint) /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:2928:7
    #7 0x7f37e526cdd8 in mozilla::ElementRestyler::Restyle(nsRestyleHint) /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:1961:5
    #8 0x7f37e5279b64 in mozilla::ElementRestyler::ComputeStyleChangeFor(nsIFrame*, nsStyleChangeList*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&, nsTArray<mozilla::ElementRestyler::ContextToClear>&, nsTArray<RefPtr<nsStyleContext> >&) /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:3071:7
    #9 0x7f37e5261d24 in mozilla::GeckoRestyleManager::ComputeAndProcessStyleChange(nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&) /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:3482:3
    #10 0x7f37e5261214 in mozilla::GeckoRestyleManager::RestyleElement(mozilla::dom::Element*, nsIFrame*, nsChangeHint, mozilla::RestyleTracker&, nsRestyleHint, mozilla::RestyleHintData const&) /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:152:5
    #11 0x7f37e52ee16e in ProcessOneRestyle /home/worker/workspace/build/src/layout/base/RestyleTracker.cpp:95:5
    #12 0x7f37e52ee16e in mozilla::RestyleTracker::DoProcessRestyles() /home/worker/workspace/build/src/layout/base/RestyleTracker.cpp:262
    #13 0x7f37e526551f in ProcessRestyles /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/GeckoRestyleManager.h:386:7
    #14 0x7f37e526551f in mozilla::GeckoRestyleManager::ProcessPendingRestyles() /home/worker/workspace/build/src/layout/base/GeckoRestyleManager.cpp:505
    #15 0x7f37e52b1c10 in ProcessPendingRestyles /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RestyleManagerInlines.h:44:3
Flags: in-testsuite?
Fixed by bug 1353312.
Assignee: nobody → cam
Status: NEW → RESOLVED
Closed: 2 years ago
Depends on: CVE-2017-7753
Flags: needinfo?(ryanvm)
Resolution: --- → FIXED
Target Milestone: --- → mozilla56
Flags: needinfo?(ryanvm)
Flags: in-testsuite?
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.