1404572 - fsanitize=enum (ubsan) runtime errors for ReferrerPolicy in gfxUserFontSet.h

Status: RESOLVED FIXED

(Core :: Graphics: Text, defect, P3)

Description

[Arthur Edelstein [:arthur]]

When I run a gcc -fsanitize=enum through the Mozilla automated tests, I get the following error and stack trace:

> /builds/worker/workspace/build/src/gfx/thebes/gfxUserFontSet.h:41:8: runtime error: load of value 3857049061, which is not a valid value for type 'ReferrerPolicy'
> #0 0xf056af81 in gfxFontFaceSrc* nsTArray_Impl<gfxFontFaceSrc, nsTArrayInfallibleAllocator>::ReplaceElementsAt<gfxFontFaceSrc, nsTArrayInfallibleAllocator>(unsigned int, unsigned int, gfxFontFaceSrc const*, unsigned int) (/builds/worker/workspace/build/application/firefox/libxul.so+0x12b2f81)
> #1 0xf056b07b in gfxUserFontEntry::gfxUserFontEntry(gfxUserFontSet*, nsTArray<gfxFontFaceSrc> const&, unsigned int, int, unsigned char, nsTArray<gfxFontFeature> const&, unsigned int, gfxCharacterMap*, unsigned char) (/builds/worker/workspace/build/application/firefox/libxul.so+0x12b307b)
> #2 0xf19deceb in mozilla::dom::FontFaceSet::UserFontSet::CreateUserFontEntry(nsTArray<gfxFontFaceSrc> const&, unsigned int, int, unsigned char, nsTArray<gfxFontFeature> const&, unsigned int, gfxCharacterMap*, unsigned char) (/builds/worker/workspace/build/application/firefox/libxul.so+0x2726ceb)
> #3 0xf05649c3 in gfxUserFontSet::FindOrCreateUserFontEntry(nsTSubstring<char16_t> const&, nsTArray<gfxFontFaceSrc> const&, unsigned int, int, unsigned char, nsTArray<gfxFontFeature> const&, unsigned int, gfxCharacterMap*, unsigned char) (/builds/worker/workspace/build/application/firefox/libxul.so+0x12ac9c3)
> #4 0xf19f64dd in mozilla::dom::FontFaceSet::FindOrCreateUserFontEntryFromFontFace(nsTSubstring<char16_t> const&, mozilla::dom::FontFace*, mozilla::SheetType) (/builds/worker/workspace/build/application/firefox/libxul.so+0x273e4dd)
> #5 0xf19f6e03 in mozilla::dom::FontFaceSet::FindOrCreateUserFontEntryFromFontFace(mozilla::dom::FontFace*) (/builds/worker/workspace/build/application/firefox/libxul.so+0x273ee03)
> #6 0xf19f6e45 in mozilla::dom::FontFace::CreateUserFontEntry() (/builds/worker/workspace/build/application/firefox/libxul.so+0x273ee45)
> #7 0xf19f6e91 in mozilla::dom::FontFace::DoLoad() (/builds/worker/workspace/build/application/firefox/libxul.so+0x273ee91)
> #8 0xf19f7156 in mozilla::dom::FontFace::Constructor(mozilla::dom::GlobalObject const&, nsTSubstring<char16_t> const&, mozilla::dom::StringOrArrayBufferOrArrayBufferView const&, mozilla::dom::FontFaceDescriptors const&, mozilla::ErrorResult&) (/builds/worker/workspace/build/application/firefox/libxul.so+0x273f156)
> #9 0xf0de9d07 in mozilla::dom::FontFaceBinding::_constructor(JSContext*, unsigned int, JS::Value*) (/builds/worker/workspace/build/application/firefox/libxul.so+0x1b31d07)
> #10 0xf2e8285b in InternalConstruct(JSContext*, js::AnyConstructArgs const&) (/builds/worker/workspace/build/application/firefox/libxul.so+0x3bca85b)
> #11 0xf2e7d1b2 in Interpret(JSContext*, js::RunState&) (/builds/worker/workspace/build/application/firefox/libxul.so+0x3bc51b2)
> #12 0xf2e81d4d in js::RunScript(JSContext*, js::RunState&) [clone .part.427] (/builds/worker/workspace/build/application/firefox/libxul.so+0x3bc9d4d)
> #13 0xf2e8233a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (/builds/worker/workspace/build/application/firefox/libxul.so+0x3bca33a)
> #14 0xf2e82e76 in js::CallFromStack(JSContext*, JS::CallArgs const&) (/builds/worker/workspace/build/application/firefox/libxul.so+0x3bcae76)
> #15 0xf2f1e7c9 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) (/builds/worker/workspace/build/application/firefox/libxul.so+0x3c667c9)
> #16 0x23ae7841  (<unknown module>)

Comment 1

[Arthur Edelstein [:arthur]]

Attachment: 0001-Bug-1404572-Fix-ubsan-runtime-error-for-ReferrerPoli.patch

I saw several runtime errors in the automated tests with -fsanitize=enum. Here's a patch that eliminates them.

Try results (third patch from top):
https://treeherder.mozilla.org/#/jobs?repo=try&revision=f21afcdcb815

Comment 2

[Arthur Edelstein [:arthur]]

Thanks for the review.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9b0b7aea865e
Fix ubsan runtime error for ReferrerPolicy enum in FontFaceSet.cpp. r=jfkthame

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/9b0b7aea865e