Closed Bug 1399572 Opened 6 years ago Closed 6 years ago

AddressSanitizer: heap-use-after-free [@ remove] with WRITE of size 8 in include/mozilla/LinkedList.h:246:18

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1399091

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(4 keywords) 

Found while fuzzing mozilla-central rev 20170912-b0e945eed81d.  A reproducible testcase is not currently available.  I will update this bug once one is found.

==1951==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030015193f8 at pc 0x7ff0663d7874 bp 0x7ffda72254b0 sp 0x7ffda72254a8
WRITE of size 8 at 0x6030015193f8 thread T0
    #0 0x7ff0663d7873 in remove /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:246:18
    #1 0x7ff0663d7873 in ~LinkedListElement /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:198
    #2 0x7ff0663d7873 in nsRange::~nsRange() /builds/worker/workspace/build/src/dom/base/nsRange.cpp:259
    #3 0x7ff0663d789d in nsRange::~nsRange() /builds/worker/workspace/build/src/dom/base/nsRange.cpp:254:1
    #4 0x7ff0635a3e97 in SnowWhiteKiller::~SnowWhiteKiller() /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2695:25
    #5 0x7ff0635ae594 in FreeSnowWhite /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2883:3
    #6 0x7ff0635ae594 in nsCycleCollector_doDeferredDeletion() /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:4267
    #7 0x7ff064ebf153 in AsyncFreeSnowWhite::Run() /builds/worker/workspace/build/src/js/xpconnect/src/XPCJSRuntime.cpp:124:34
    #8 0x7ff063721d6f in IdleRunnableWrapper::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:345:22
    #9 0x7ff063723361 in IdleRunnableWrapper::TimedOut(nsITimer*, void*) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:353:15
    #10 0x7ff06372a6e6 in nsTimerImpl::Fire(int) /builds/worker/workspace/build/src/xpcom/threads/nsTimerImpl.cpp:514:7
    #11 0x7ff0636fd086 in nsTimerEvent::Run() /builds/worker/workspace/build/src/xpcom/threads/TimerThread.cpp:286:11
    #12 0x7ff06370bd5d in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1039:14
    #13 0x7ff063711a88 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:521:10
    #14 0x7ff06d483e8f in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpfe/appshell/nsXULWindow.cpp:2007:24)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:323:25
    #15 0x7ff06d483e8f in nsXULWindow::CreateNewContentWindow(int, nsITabParent*, mozIDOMWindowProxy*, unsigned long, nsIXULWindow**) /builds/worker/workspace/build/src/xpfe/appshell/nsXULWindow.cpp:2007
    #16 0x7ff06dd2ee7f in nsAppStartup::CreateChromeWindow2(nsIWebBrowserChrome*, unsigned int, nsITabParent*, mozIDOMWindowProxy*, unsigned long, bool*, nsIWebBrowserChrome**) /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:661:18
    #17 0x7ff06de76184 in nsWindowWatcher::CreateChromeWindow(nsTSubstring<char> const&, nsIWebBrowserChrome*, unsigned int, nsITabParent*, mozIDOMWindowProxy*, unsigned long, nsIWebBrowserChrome**) /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:496:21
    #18 0x7ff06de73c5f in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsIDocShellLoadInfo*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:965:14
    #19 0x7ff06de75eaf in OpenWindow2 /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:444:10
    #20 0x7ff06de75eaf in non-virtual thunk to nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, nsIDocShellLoadInfo*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:416
    #21 0x7ff065f663d8 in nsGlobalWindow::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsIDocShellLoadInfo*, bool, nsPIDOMWindowOuter**) /builds/worker/workspace/build/src/dom/base/nsGlobalWindow.cpp:12951:21
    #22 0x7ff065f6496f in OpenJS /builds/worker/workspace/build/src/dom/base/nsGlobalWindow.cpp:9005:10
    #23 0x7ff065f6496f in nsGlobalWindow::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsGlobalWindow.cpp:8967
    #24 0x7ff065f64dfd in nsGlobalWindow::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsGlobalWindow.cpp:8976:3
    #25 0x7ff0675265f8 in mozilla::dom::WindowBinding::open(JSContext*, JS::Handle<JSObject*>, nsGlobalWindow*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:2414:56
    #26 0x7ff067524a15 in mozilla::dom::WindowBinding::genericMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:15498:13
    #27 0x7ff06e3f9f34 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:293:15
    #28 0x7ff06e3f9f34 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495
    #29 0x7ff06e3e37a9 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:546:12
    #30 0x7ff06e3e37a9 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3084
    #31 0x7ff06e3cad0b in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:435:12
    #32 0x7ff06e3fc847 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:724:15
    #33 0x7ff06e44c75e in EvalKernel(JSContext*, JS::Handle<JS::Value>, EvalType, js::AbstractFramePtr, JS::Handle<JSObject*>, unsigned char*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:327:12
    #34 0x7ff06e44aea3 in js::IndirectEval(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:420:12
    #35 0x1f6ba8be0467  (<unknown module>)

0x6030015193f8 is located 8 bytes inside of 24-byte region [0x6030015193f0,0x603001519408)
freed by thread T0 here:
    #0 0x4bb6fb in __interceptor_free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:47:3
    #1 0x7ff066360a49 in operator delete /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:230:12
    #2 0x7ff066360a49 in operator() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/UniquePtr.h:528
    #3 0x7ff066360a49 in reset /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/UniquePtr.h:343
    #4 0x7ff066360a49 in ~UniquePtr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/UniquePtr.h:288
    #5 0x7ff066360a49 in nsINode::nsSlots::~nsSlots() /builds/worker/workspace/build/src/dom/base/nsINode.cpp:135
    #6 0x7ff06608c80d in mozilla::dom::FragmentOrElement::nsDOMSlots::~nsDOMSlots() /builds/worker/workspace/build/src/dom/base/FragmentOrElement.cpp:761:1
    #7 0x7ff0663bc817 in nsNodeUtils::LastRelease(nsINode*) /builds/worker/workspace/build/src/dom/base/nsNodeUtils.cpp:313:5
    #8 0x7ff066048c02 in mozilla::dom::FragmentOrElement::Release() /builds/worker/workspace/build/src/dom/base/FragmentOrElement.cpp:2221:1
    #9 0x7ff063595ea3 in ~nsCOMPtr_base /builds/worker/workspace/build/src/xpcom/base/nsCOMPtr.h:313:7
    #10 0x7ff063595ea3 in ~SegmentImpl /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/SegmentedVector.h:65
    #11 0x7ff063595ea3 in mozilla::SegmentedVector<nsCOMPtr<nsISupports>, 4096ul, mozilla::MallocAllocPolicy>::PopLastN(unsigned int) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/SegmentedVector.h:249
    #12 0x7ff06358574e in mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/BindingUtils.h:2965:15
    #13 0x7ff0635867e6 in mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSRuntime.cpp:1360:17
    #14 0x7ff063586e9a in mozilla::CycleCollectedJSRuntime::FinalizeDeferredThings(mozilla::CycleCollectedJSContext::DeferredFinalizeType) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSRuntime.cpp:1431:24
    #15 0x7ff063582512 in mozilla::CycleCollectedJSRuntime::OnGC(JSContext*, JSGCStatus) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSRuntime.cpp:1481:7
    #16 0x7ff06ef4f012 in callGCCallback /builds/worker/workspace/build/src/js/src/jsgc.cpp:1641:9
    #17 0x7ff06ef4f012 in ~AutoNotifyGCActivity /builds/worker/workspace/build/src/js/src/jsgc.cpp:1669
    #18 0x7ff06ef4f012 in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) /builds/worker/workspace/build/src/js/src/jsgc.cpp:7159
    #19 0x7ff06ef52f94 in js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) /builds/worker/workspace/build/src/js/src/jsgc.cpp:7290:25
    #20 0x7ff06ef5a773 in gc /builds/worker/workspace/build/src/js/src/jsgc.cpp:7357:5
    #21 0x7ff06ef5a773 in JS::GCForReason(JSContext*, JSGCInvocationKind, JS::gcreason::Reason) /builds/worker/workspace/build/src/js/src/jsgc.cpp:8264
    #22 0x7ff064e437d7 in nsXPCComponents_Utils::ForceGC() /builds/worker/workspace/build/src/js/xpconnect/src/XPCComponents.cpp:2580:5
    #23 0x7ff063734c21 in NS_InvokeByIndex /builds/worker/workspace/build/src/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:129
    #24 0x7ff064ef2b70 in Invoke /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1996:12
    #25 0x7ff064ef2b70 in Call /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1315
    #26 0x7ff064ef2b70 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1282
    #27 0x7ff064ef9b3f in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:928:12
    #28 0x7ff06e3f9f34 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:293:15
    #29 0x7ff06e3f9f34 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495
    #30 0x7ff06e3e37a9 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:546:12
    #31 0x7ff06e3e37a9 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3084
    #32 0x7ff06e3cad0b in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:435:12
    #33 0x7ff06e3fa0cc in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:513:15
    #34 0x7ff06e3faa22 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:559:10
    #35 0x7ff06ee4b0a3 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2906:12
    #36 0x7ff064e10f8b in xpc::FunctionForwarder(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/xpconnect/src/ExportHelpers.cpp:315:18
    #37 0x7ff06e3f9f34 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:293:15
    #38 0x7ff06e3f9f34 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495
    #39 0x7ff06e3e37a9 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:546:12
    #40 0x7ff06e3e37a9 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3084
    #41 0x7ff06e3cad0b in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:435:12
    #42 0x7ff06e3fc847 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:724:15
    #43 0x7ff06e44c75e in EvalKernel(JSContext*, JS::Handle<JS::Value>, EvalType, js::AbstractFramePtr, JS::Handle<JSObject*>, unsigned char*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:327:12
    #44 0x7ff06e44aea3 in js::IndirectEval(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:420:12

previously allocated by thread T0 here:
    #0 0x4bba4c in malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3
    #1 0x4ecf6d in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:84:17
    #2 0x7ff0663db70f in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:206:12
    #3 0x7ff0663db70f in MakeUnique<mozilla::LinkedList<nsRange>> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/UniquePtr.h:680
    #4 0x7ff0663db70f in nsRange::RegisterCommonAncestor(nsINode*) /builds/worker/workspace/build/src/dom/base/nsRange.cpp:423
    #5 0x7ff0663d9a67 in nsRange::DoSetRange(nsRange::RangeBoundaryBase<nsINode*, nsIContent*> const&, nsRange::RangeBoundaryBase<nsINode*, nsIContent*> const&, nsINode*, bool) /builds/worker/workspace/build/src/dom/base/nsRange.cpp:999:9
    #6 0x7ff0663eb7e7 in DoSetRange /builds/worker/workspace/build/src/dom/base/nsRange.h:661:5
    #7 0x7ff0663eb7e7 in nsRange::SelectNode(nsINode&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsRange.cpp:1725
    #8 0x7ff0663ebab8 in nsRange::SelectNodeJS(nsINode&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsRange.cpp:1693:3
    #9 0x7ff066d582a5 in mozilla::dom::RangeBinding::selectNode(JSContext*, JS::Handle<JSObject*>, nsRange*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/RangeBinding.cpp:776:9
    #10 0x7ff067d91eb0 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3050:13
    #11 0x7ff06e3f9f34 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:293:15
    #12 0x7ff06e3f9f34 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495
    #13 0x7ff06e3e37a9 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:546:12
    #14 0x7ff06e3e37a9 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3084
    #15 0x7ff06e3cad0b in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:435:12
    #16 0x7ff06e3fc847 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:724:15
    #17 0x7ff06e44c75e in EvalKernel(JSContext*, JS::Handle<JS::Value>, EvalType, js::AbstractFramePtr, JS::Handle<JSObject*>, unsigned char*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:327:12
    #18 0x7ff06e44aea3 in js::IndirectEval(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:420:12
    #19 0x1f6ba85762b7  (<unknown module>)
    #20 0x621000cb67bf  (<unknown module>)
    #21 0x1f6ba8576b50  (<unknown module>)
    #22 0x6210026c321f  (<unknown module>)
    #23 0x1f6ba85038a9  (<unknown module>)
    #24 0x7ff06e6583d2 in EnterBaseline(JSContext*, js::jit::EnterJitData&) /builds/worker/workspace/build/src/js/src/jit/BaselineJIT.cpp:160:9
    #25 0x7ff06e65953c in js::jit::EnterBaselineAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/BaselineJIT.cpp:268:28
    #26 0x7ff06e3ed150 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2040:28
    #27 0x7ff06e3cad0b in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:435:12
    #28 0x7ff06e3fc847 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:724:15
    #29 0x7ff06e3fd0b2 in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:756:12
    #30 0x7ff06ee5e399 in ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4667:12
    #31 0x7ff066397989 in nsJSUtils::ExecutionContext::CompileAndExec(JS::CompileOptions&, JS::SourceBufferHolder&, JS::MutableHandle<JSScript*>) /builds/worker/workspace/build/src/dom/base/nsJSUtils.cpp:265:8
    #32 0x7ff069a742e8 in mozilla::dom::ScriptLoader::EvaluateScript(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:2244:25
    #33 0x7ff069a6f71c in mozilla::dom::ScriptLoader::ProcessRequest(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1884:10
    #34 0x7ff069a52f85 in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1585:10

SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/LinkedList.h:246:18 in remove
Shadow bytes around the buggy address:
  0x0c068029b220: 00 fa fa fa fd fd fd fd fa fa 00 00 00 00 fa fa
  0x0c068029b230: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
  0x0c068029b240: fa fa fd fd fd fd fa fa fd fd fd fa fa fa fd fd
  0x0c068029b250: fd fd fa fa fd fd fd fa fa fa fd fd fd fd fa fa
  0x0c068029b260: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
=>0x0c068029b270: fa fa 00 00 00 fa fa fa fa fa fa fa fa fa fd[fd]
  0x0c068029b280: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x0c068029b290: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fa
  0x0c068029b2a0: fa fa fd fd fd fa fa fa fd fd fd fd fa fa fd fd
  0x0c068029b2b0: fd fa fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c068029b2c0: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1951==ABORTING

[ffpuppet] Exit code: -6
Hm, this involves nsRange too. Wonder if it's related to nils' bug 1399091
Group: core-security → dom-core-security
Keywords: csectype-uaf, sec-critical
Yeah, this looks the same.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Component: DOM → DOM: Core & HTML
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.