1375050 - Crash @[GetExistingSlots /home/worker/workspace/build/src/dom/base/nsINode.h:1905:12]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Testcase found while fuzzing mozilla-central rev 20170621-2b07ef4f3381.

ASAN:DEADLYSIGNAL
=================================================================
==15867==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 (pc 0x7f7e60474ce0 bp 0x7ffd8f1428f0 sp 0x7ffd8f142840 T0)
==15867==The signal is caused by a READ memory access.
==15867==Hint: address points to the zero page.
    #0 0x7f7e60474cdf in GetExistingSlots /home/worker/workspace/build/src/dom/base/nsINode.h:1905:12
    #1 0x7f7e60474cdf in RemoveMutationObserver /home/worker/workspace/build/src/dom/base/nsINode.h:1059
    #2 0x7f7e60474cdf in nsLabelsNodeList::MaybeResetRoot(nsINode*) /home/worker/workspace/build/src/dom/base/nsContentList.cpp:1169
    #3 0x7f7e626e3566 in nsGenericHTMLElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /home/worker/workspace/build/src/dom/html/nsGenericHTMLElement.cpp:519:25
    #4 0x7f7e626ef51e in nsGenericHTMLFormElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /home/worker/workspace/build/src/dom/html/nsGenericHTMLElement.cpp:1896:39
    #5 0x7f7e625ac38c in mozilla::dom::HTMLInputElement::BindToTree(nsIDocument*, nsIContent*, nsIContent*, bool) /home/worker/workspace/build/src/dom/html/HTMLInputElement.cpp:4852:52
    #6 0x7f7e6060ac66 in nsINode::doInsertChildAt(nsIContent*, unsigned int, bool, nsAttrAndChildArray&) /home/worker/workspace/build/src/dom/base/nsINode.cpp:1608:14
    #7 0x7f7e60611390 in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) /home/worker/workspace/build/src/dom/base/nsINode.cpp:2514:14
    #8 0x7f7e60c656c9 in InsertBefore /home/worker/workspace/build/src/dom/base/nsINode.h:1795:12
    #9 0x7f7e60c656c9 in AppendChild /home/worker/workspace/build/src/dom/base/nsINode.h:1799
    #10 0x7f7e60c656c9 in mozilla::dom::NodeBinding::appendChild(JSContext*, JS::Handle<JSObject*>, nsINode*, JSJitMethodCallArgs const&) /home/worker/workspace/build/src/obj-firefox/dom/bindings/NodeBinding.cpp:856
    #11 0x7f7e61f56dbe in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /home/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:2960:13
    #12 0x7f7e6842a4a3 in CallJSNative /home/worker/workspace/build/src/js/src/jscntxtinlines.h:293:15
    #13 0x7f7e6842a4a3 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /home/worker/workspace/build/src/js/src/vm/Interpreter.cpp:470
    #14 0x7f7e68644dde in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /home/worker/workspace/build/src/js/src/jit/BaselineIC.cpp:2458:14
    #15 0x7f7e0ca12df6  (<unknown module>)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/worker/workspace/build/src/dom/base/nsINode.h:1905:12 in GetExistingSlots
==15867==ABORTING
[Exit code: -6]

Comment 1

[Andrew Overholt [:overholt]]

Catalin, you've been looking at nsINode recently, right? :)

Comment 2

[Cătălin Badea (:catalinb)]

Attachment: Fix crash in nsLabelsNodeList::MaybeResetRoot

Comment 3

[John Dai[:jdai]]

Comment on attachment 8884783 [details] [diff] [review]
Fix crash in nsLabelsNodeList::MaybeResetRoot

Review of attachment 8884783 [details] [diff] [review]:
-----------------------------------------------------------------

The change is fine but I'd like to see crash test included before setting r+ flag, thank you!

Comment 4

[Cătălin Badea (:catalinb)]

Attachment: Fix crash in nsLabelsNodeList::MaybeResetRoot

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/54b1caeb09ec
Fix crash in nsLabelsNodeList::MaybeResetRoot r=jdai

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/54b1caeb09ec

Comment 7

[Ryan VanderMeulen [:RyanVM]]

mozregression says this was caused by bug 556743.