Closed Bug 1427748 Opened 5 years ago Closed 5 years ago

AddressSanitizer: use-after-poison [@ SetFrameIsModified] with READ of size 2

Categories

(Core :: Web Painting, defect)

Product:
Core
Component:
Web Painting
Version:
59 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox57 --- unaffected
firefox58 --- fixed
firefox59 --- fixed

People

(Reporter: jkratzer, Assigned: MatsPalmgren_bugz)

References

(Blocks 2 open bugs)

Details

(4 keywords, Whiteboard: [fixed by bug 1427221][post-critsmash-triage])

Attachments

(2 files)

trigger_part_1.html
737 bytes, text/html
Details
trigger_part_2.xhtml
335 bytes, application/xhtml+xml
Details 
Found while fuzzing mozilla-inbound rev ba12a841ef93.  Currently minimizing the testcase.  Will update once complete.

==12912==ERROR: AddressSanitizer: use-after-poison on address 0x625001f6b326 at pc 0x7fce75ad1e70 bp 0x7ffd786eb7c0 sp 0x7ffd786eb7b8
READ of size 2 at 0x625001f6b326 thread T0 (file:// Content)
    #0 0x7fce75ad1e6f in SetFrameIsModified /builds/worker/workspace/build/src/layout/generic/nsIFrame.h:4129:69
    #1 0x7fce75ad1e6f in nsIFrame::MarkNeedsDisplayItemRebuild() /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:1036
    #2 0x7fce75afc8e0 in InvalidateFrameInternal(nsIFrame*, bool) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:6963:11
    #3 0x7fce75a80172 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7007:3
    #4 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #5 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #6 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #7 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #8 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #9 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #10 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #11 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #12 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #13 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #14 0x7fce75a80352 in nsIFrame::InvalidateFrameSubtree(unsigned int) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:7022:26
    #15 0x7fce758b1475 in InvalidateCanvasIfNeeded /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:8733:14
    #16 0x7fce758b1475 in nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:8508
    #17 0x7fce7589dc39 in nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:9832:7
    #18 0x7fce757bab0d in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/workspace/build/src/layout/base/RestyleManager.cpp:1514:25
    #19 0x7fce758378d3 in mozilla::ServoRestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:1161:9
    #20 0x7fce757f20ae in ProcessPendingRestyles /builds/worker/workspace/build/src/layout/base/ServoRestyleManager.cpp:1237:3
    #21 0x7fce757f20ae in ProcessPendingRestyles /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RestyleManagerInlines.h:44
    #22 0x7fce757f20ae in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:4225
    #23 0x7fce70e972a5 in FlushPendingNotifications /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIPresShell.h:575:5
    #24 0x7fce70e972a5 in nsDocument::FlushPendingNotifications(mozilla::FlushType, mozilla::FlushTarget) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8230
    #25 0x7fce70c43900 in GetPrimaryFrame /builds/worker/workspace/build/src/dom/base/Element.cpp:2374:10
    #26 0x7fce70c43900 in mozilla::dom::Element::GetBoundingClientRect() /builds/worker/workspace/build/src/dom/base/Element.cpp:1084
    #27 0x7fce72851ee2 in mozilla::dom::ElementBinding::getBoundingClientRect(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Element*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/ElementBinding.cpp:2712:59
    #28 0x7fce72e2ef37 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3042:13
    #29 0x7fce799ecbb4 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:291:15
    #30 0x7fce799ecbb4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:473
    #31 0x7fce799d7be6 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:528:12
    #32 0x7fce799d7be6 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3096
    #33 0x7fce799be580 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:12
    #34 0x7fce799efb51 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:706:15
    #35 0x7fce79a440da in EvalKernel(JSContext*, JS::Handle<JS::Value>, EvalType, js::AbstractFramePtr, JS::Handle<JSObject*>, unsigned char*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:323:12
    #36 0x7fce79a435f3 in js::IndirectEval(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:416:12
    #37 0x7fce26e3f355  (<unknown module>)

0x625001f6b326 is located 2598 bytes inside of 8192-byte region [0x625001f6a900,0x625001f6c900)
allocated by thread T0 (file:// Content) here:
    #0 0x4c31d3 in malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3
    #1 0x7fce6dbb5f10 in AllocateChunk /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:193:15
    #2 0x7fce6dbb5f10 in InternalAllocate /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:228
    #3 0x7fce6dbb5f10 in Allocate /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:75
    #4 0x7fce6dbb5f10 in mozilla::ArenaAllocator<8192ul, 8ul>::Allocate(unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ArenaAllocator.h:80
    #5 0x7fce75a051ff in AllocateByFrameID /builds/worker/workspace/build/src/layout/base/nsPresArena.h:39:12
    #6 0x7fce75a051ff in AllocateFrame /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIPresShell.h:206
    #7 0x7fce75a051ff in operator new /builds/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:34
    #8 0x7fce75a051ff in NS_NewViewportFrame(nsIPresShell*, nsStyleContext*) /builds/worker/workspace/build/src/layout/generic/ViewportFrame.cpp:31
    #9 0x7fce7588646b in nsCSSFrameConstructor::ConstructRootFrame() /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:2819:5
    #10 0x7fce757d5a7d in mozilla::PresShell::Initialize(int, int) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:1777:36
    #11 0x7fce70dcd50f in nsContentSink::StartLayout(bool) /builds/worker/workspace/build/src/dom/base/nsContentSink.cpp:1277:26
    #12 0x7fce74b034af in nsXMLContentSink::HandleStartElement(char16_t const*, char16_t const**, unsigned int, unsigned int, bool) /builds/worker/workspace/build/src/dom/xml/nsXMLContentSink.cpp:1046:7
    #13 0x7fce6fc55705 in nsExpatDriver::HandleStartElement(char16_t const*, char16_t const**) /builds/worker/workspace/build/src/parser/htmlparser/nsExpatDriver.cpp:324:7
    #14 0x7fce773b119b in doContent /builds/worker/workspace/build/src/parser/expat/lib/xmlparse.c:2442:11
    #15 0x7fce773a5c7a in contentProcessor /builds/worker/workspace/build/src/parser/expat/lib/xmlparse.c:2098:27
    #16 0x7fce773a5c7a in doProlog /builds/worker/workspace/build/src/parser/expat/lib/xmlparse.c:4078
    #17 0x7fce7739bf33 in prologProcessor /builds/worker/workspace/build/src/parser/expat/lib/xmlparse.c:3812:10
    #18 0x7fce7739bf33 in prologInitProcessor /builds/worker/workspace/build/src/parser/expat/lib/xmlparse.c:3629
    #19 0x7fce7739a336 in MOZ_XML_Parse /builds/worker/workspace/build/src/parser/expat/lib/xmlparse.c:1530:17
    #20 0x7fce6fc5b71d in nsExpatDriver::ParseBuffer(char16_t const*, unsigned int, bool, unsigned int*) /builds/worker/workspace/build/src/parser/htmlparser/nsExpatDriver.cpp:887:16
    #21 0x7fce6fc5ca2f in nsExpatDriver::ConsumeToken(nsScanner&, bool&) /builds/worker/workspace/build/src/parser/htmlparser/nsExpatDriver.cpp:985:5
    #22 0x7fce6fc68a0c in nsParser::Tokenize(bool) /builds/worker/workspace/build/src/parser/htmlparser/nsParser.cpp:1539:30
    #23 0x7fce6fc64579 in nsParser::ResumeParse(bool, bool, bool) /builds/worker/workspace/build/src/parser/htmlparser/nsParser.cpp:1056:41
    #24 0x7fce6fc69b37 in nsParser::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned long, unsigned int) /builds/worker/workspace/build/src/parser/htmlparser/nsParser.cpp:1437:12
    #25 0x7fce6e65c6ed in DoOnDataAvailable /builds/worker/workspace/build/src/netwerk/protocol/http/HttpChannelChild.cpp:971:28
    #26 0x7fce6e65c6ed in mozilla::net::HttpChannelChild::OnTransportAndData(nsresult const&, nsresult const&, unsigned long const&, unsigned int const&, nsTString<char> const&) /builds/worker/workspace/build/src/netwerk/protocol/http/HttpChannelChild.cpp:897
    #27 0x7fce6e85829b in mozilla::net::ChannelEventQueue::FlushQueue() /builds/worker/workspace/build/src/netwerk/ipc/ChannelEventQueue.cpp:93:12
    #28 0x7fce6e862920 in MaybeFlushQueue /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/net/ChannelEventQueue.h:324:5
    #29 0x7fce6e862920 in CompleteResume /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/net/ChannelEventQueue.h:306
    #30 0x7fce6e862920 in mozilla::net::ChannelEventQueue::ResumeInternal()::CompleteResumeRunnable::Run() /builds/worker/workspace/build/src/netwerk/ipc/ChannelEventQueue.cpp:160
    #31 0x7fce6dbdef50 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:395:25
    #32 0x7fce6dc057c6 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1039:14
    #33 0x7fce6dc212b0 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:510:10
    #34 0x7fce6dc04222 in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:796:22)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:323:25
    #35 0x7fce6dc04222 in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:796
    #36 0x7fce7386cc9a in mozilla::MediaStreamGraphShutdownThreadRunnable::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:139:14
    #37 0x7fce6dbe1b8b in mozilla::EventTargetWrapper::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:150:32
    #38 0x7fce6dbdef50 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:395:25
    #39 0x7fce6dc057c6 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1039:14
    #40 0x7fce6dc212b0 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:510:10
    #41 0x7fce6dc04222 in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:796:22)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:323:25
    #42 0x7fce6dc04222 in nsThread::Shutdown() /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:796

SUMMARY: AddressSanitizer: use-after-poison /builds/worker/workspace/build/src/layout/generic/nsIFrame.h:4129:69 in SetFrameIsModified
Shadow bytes around the buggy address:
  0x0c4a803e5610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a803e5620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a803e5630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a803e5640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a803e5650: 00 00 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c4a803e5660: f7 f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c4a803e5670: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c4a803e5680: f7 f7 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a803e5690: 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c4a803e56a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
  0x0c4a803e56b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==12912==ABORTING
Attached file trigger_part_1.html — 

    
    

    
  

      
      
      
      

        Attached file
          
        trigger_part_2.xhtml
        — 
      

    


  

    
  
Keywords: testcase-wanted → testcase

    
    

    
  
Mats, is this just frame poisoning? (Then we could unhide it.)
Group: core-security → layout-core-security
Flags: needinfo?(mats)

    
    

    
  
Looks like we have a destroyed nsMathMLmfencedFrame in |modifiedFrames|
in nsIFrame::MarkNeedsDisplayItemRebuild:
1034        for (nsIFrame* f : *modifiedFrames) {
1035          if (f) {
1036            f->SetFrameIsModified(false);
1037          }
1038        }
Component: Layout → Layout: Web Painting
Flags: needinfo?(mats)
Keywords: csectype-framepoisoning, 
          
            sec-other
OS: Unspecified → All
Hardware: Unspecified → All

    
    

    
  
This should be fixed by bug 1427221.
Assignee: nobody → mats
Flags: in-testsuite?
Whiteboard: [fixed by bug 1427221]

    
  
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Flags: qe-verify-
Whiteboard: [fixed by bug 1427221] → [fixed by bug 1427221][post-critsmash-triage]
Group: layout-core-security → core-security-release
Group: core-security-release

          You need to log in
          before you can comment on or make changes to this bug.