Closed Bug 1460865 Opened 7 years ago Closed 7 years ago

AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/dom/media/AudioMixer.h:67:17 in FinishMixing

Categories

(Core :: Graphics: Canvas2D, defect)

Product:
Core
Component:
Graphics: Canvas2D
Version:
59 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1457372

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(4 keywords)

Found while fuzzing mozilla-central rev b52b2eb81d1e. I don't currently have a usable testcase but will update this bug if one becomes available. ==3443==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110000fdc80 at pc 0x7f54517ef4fe bp 0x7f53cad19470 sp 0x7f53cad19468 READ of size 8 at 0x6110000fdc80 thread T31 (AudioIPC0) #0 0x7f54517ef4fd in FinishMixing /builds/worker/workspace/build/src/dom/media/AudioMixer.h:67:17 #1 0x7f54517ef4fd in mozilla::MediaStreamGraphImpl::Process() /builds/worker/workspace/build/src/dom/media/MediaStreamGraph.cpp:1306 #2 0x7f54517efadc in mozilla::MediaStreamGraphImpl::OneIteration(long) /builds/worker/workspace/build/src/dom/media/MediaStreamGraph.cpp:1356:3 #3 0x7f5451595a5e in mozilla::AudioCallbackDriver::DataCallback(float const*, float*, long) /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:975:35 #4 0x7f5458d2e08c in _$LT$audioipc_client..stream..CallbackServer$u20$as$u20$audioipc..rpc..server..Server$GT$::process::_$u7b$$u7b$closure$u7d$$u7d$::h255ef58a06b976d7 /builds/worker/workspace/build/src/media/audioipc/client/src/stream.rs:98 #5 0x7f5458d2e08c in _$LT$futures..future..lazy..Lazy$LT$F$C$$u20$R$GT$$GT$::get::he81f30bda4372db6 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/lazy.rs:64 #6 0x7f5458d2e08c in _$LT$futures..future..lazy..Lazy$LT$F$C$$u20$R$GT$$u20$as$u20$futures..future..Future$GT$::poll::hc7d3753076f4c2b4 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/lazy.rs:82 #7 0x7f5458d2e08c in futures::future::catch_unwind::_$LT$impl$u20$futures..future..Future$u20$for$u20$std..panic..AssertUnwindSafe$LT$F$GT$$GT$::poll::hfc82a99a53b85aa4 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/catch_unwind.rs:49 #8 0x7f5458d2e08c in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::_$u7b$$u7b$closure$u7d$$u7d$::h42ede3b71abb5754 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/catch_unwind.rs:32 #9 0x7f5458d2e08c in std::panicking::try::do_call::h8947529258b9184a /checkout/src/libstd/panicking.rs:480 #10 0x7f5458d2e08c in __rust_maybe_catch_panic /checkout/src/libpanic_abort/lib.rs:38 #11 0x7f5458d2e08c in std::panicking::try::h86be82cc111cf4a4 /checkout/src/libstd/panicking.rs:459 #12 0x7f5458d2e08c in std::panic::catch_unwind::h4e7cb1cde312e0d8 /checkout/src/libstd/panic.rs:365 #13 0x7f5458d2e08c in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::hc0a139277a4c2850 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/catch_unwind.rs:32 #14 0x7f5458d2e08c in _$LT$futures_cpupool..MySender$LT$F$C$$u20$core..result..Result$LT$$LT$F$u20$as$u20$futures..future..Future$GT$..Item$C$$u20$$LT$F$u20$as$u20$futures..future..Future$GT$..Error$GT$$GT$$u20$as$u20$futures..future..Future$GT$::poll::h7241a9199d4e8186 /builds/worker/workspace/build/src/third_party/rust/futures-cpupool/src/lib.rs:325 #15 0x7f5458d4054e in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::hef8bd2de4bf79d01 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/mod.rs:113 #16 0x7f5458d4054e in _$LT$futures..task_impl..Spawn$LT$T$GT$$GT$::poll_future_notify::_$u7b$$u7b$closure$u7d$$u7d$::hcd4766cff7f42aaf /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/mod.rs:289 #17 0x7f5458d4054e in _$LT$futures..task_impl..Spawn$LT$T$GT$$GT$::enter::_$u7b$$u7b$closure$u7d$$u7d$::hd8d6e2b5a1290ea4 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/mod.rs:363 #18 0x7f5458d4054e in futures::task_impl::std::set::he185d5ee772f8476 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/std/mod.rs:78 #19 0x7f5458d4054e in _$LT$futures..task_impl..Spawn$LT$T$GT$$GT$::enter::hd0619d29abd021b9 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/mod.rs:363 #20 0x7f5458d4054e in _$LT$futures..task_impl..Spawn$LT$T$GT$$GT$::poll_future_notify::h4c5d0c4fac5b8449 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/mod.rs:289 #21 0x7f5458d4054e in futures::task_impl::std::Run::run::hcd87035f17c3eba8 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/std/mod.rs:450 #22 0x7f5458d4054e in futures_cpupool::Inner::work::h2a7fea8576a09348 /builds/worker/workspace/build/src/third_party/rust/futures-cpupool/src/lib.rs:257 #23 0x7f5458d4054e in futures_cpupool::Builder::create::_$u7b$$u7b$closure$u7d$$u7d$::he49fe1c37e6f3937 /builds/worker/workspace/build/src/third_party/rust/futures-cpupool/src/lib.rs:427 #24 0x7f5458d4054e in std::sys_common::backtrace::__rust_begin_short_backtrace::hbaa0bfa0b267eb5e /checkout/src/libstd/sys_common/backtrace.rs:133 #25 0x7f5458d3f65b in std::thread::Builder::spawn::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hf8f6b25d8360e7a4 /checkout/src/libstd/thread/mod.rs:406 #26 0x7f5458d3f65b in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h8c0df1bb9b89c35d /checkout/src/libstd/panic.rs:300 #27 0x7f5458d3f65b in std::panicking::try::do_call::ha320786fe0e95bf0 /checkout/src/libstd/panicking.rs:480 #28 0x7f5458d3f65b in __rust_maybe_catch_panic /checkout/src/libpanic_abort/lib.rs:38 #29 0x7f5458d3f65b in std::panicking::try::ha16e16d3bf07c8eb /checkout/src/libstd/panicking.rs:459 #30 0x7f5458d3f65b in std::panic::catch_unwind::h5af12cea0e16f260 /checkout/src/libstd/panic.rs:365 #31 0x7f5458d3f65b in std::thread::Builder::spawn::_$u7b$$u7b$closure$u7d$$u7d$::h8341ff335d15fac7 /checkout/src/libstd/thread/mod.rs:405 #32 0x7f5458d3f65b in _$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hd9f2045bf4e2fd53 /checkout/src/liballoc/boxed.rs:815 #33 0x7f54592d2fb3 in _$LT$alloc..boxed..Box$LT$alloc..boxed..FnBox$LT$A$C$$u20$Output$u3d$R$GT$$u20$$u2b$$u20$$u27$a$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::hf6357ae8c4e17346 /checkout/src/liballoc/boxed.rs:825 #34 0x7f54592d2fb3 in std::sys_common::thread::start_thread::hebf0035ba4789615 /checkout/src/libstd/sys_common/thread.rs:24 #35 0x7f54592d2fb3 in std::sys::unix::thread::Thread::new::thread_start::hd71cb092e75e9bed /checkout/src/libstd/sys/unix/thread.rs:90 #36 0x7f546bb926b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) #37 0x7f546ac0f41c in clone /build/glibc-Cl5G7W/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109 0x6110000fdc80 is located 64 bytes inside of 224-byte region [0x6110000fdc40,0x6110000fdd20) freed by thread T163 (CubebOp~tion #3) here: #0 0x4c5172 in __interceptor_free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:68:3 #1 0x7f545158ebd7 in Release /builds/worker/workspace/build/src/dom/media/GraphDriver.h:118:3 #2 0x7f545158ebd7 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:41 #3 0x7f545158ebd7 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:398 #4 0x7f545158ebd7 in assign_assuming_AddRef /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:66 #5 0x7f545158ebd7 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:168 #6 0x7f545158ebd7 in mozilla::AsyncCubebTask::Run() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:512 #7 0x7f544b2fa7c7 in nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:229:14 #8 0x7f544b2faf3c in non-virtual thunk to nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp #9 0x7f544b2e3f63 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1090:14 #10 0x7f544b2ffb30 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10 #11 0x7f544c1df7cc in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:364:5 #12 0x7f544c132649 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #13 0x7f544c132649 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #14 0x7f544c132649 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #15 0x7f544b2de8c8 in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:425:11 #16 0x7f546858c47e in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:201:5 #17 0x7f546bb926b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) previously allocated by thread T31 (AudioIPC0) here: #0 0x4c54b3 in malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3 #1 0x4f5f7d in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:70:17 #2 0x7f54517e734a in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:156:12 #3 0x7f54517e734a in mozilla::MediaStreamGraphImpl::OpenAudioInputImpl(int, mozilla::AudioDataListener*) /builds/worker/workspace/build/src/dom/media/MediaStreamGraph.cpp:831 #4 0x7f54517eb27a in mozilla::MediaStreamGraphImpl::RunMessagesInQueue() /builds/worker/workspace/build/src/dom/media/MediaStreamGraph.cpp:1141:20 #5 0x7f54517efa84 in mozilla::MediaStreamGraphImpl::OneIteration(long) /builds/worker/workspace/build/src/dom/media/MediaStreamGraph.cpp:1349:3 #6 0x7f5451595a5e in mozilla::AudioCallbackDriver::DataCallback(float const*, float*, long) /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:975:35 #7 0x7f5458d2e08c in _$LT$audioipc_client..stream..CallbackServer$u20$as$u20$audioipc..rpc..server..Server$GT$::process::_$u7b$$u7b$closure$u7d$$u7d$::h255ef58a06b976d7 /builds/worker/workspace/build/src/media/audioipc/client/src/stream.rs:98 #8 0x7f5458d2e08c in _$LT$futures..future..lazy..Lazy$LT$F$C$$u20$R$GT$$GT$::get::he81f30bda4372db6 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/lazy.rs:64 #9 0x7f5458d2e08c in _$LT$futures..future..lazy..Lazy$LT$F$C$$u20$R$GT$$u20$as$u20$futures..future..Future$GT$::poll::hc7d3753076f4c2b4 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/lazy.rs:82 #10 0x7f5458d2e08c in futures::future::catch_unwind::_$LT$impl$u20$futures..future..Future$u20$for$u20$std..panic..AssertUnwindSafe$LT$F$GT$$GT$::poll::hfc82a99a53b85aa4 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/catch_unwind.rs:49 #11 0x7f5458d2e08c in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::_$u7b$$u7b$closure$u7d$$u7d$::h42ede3b71abb5754 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/catch_unwind.rs:32 #12 0x7f5458d2e08c in std::panicking::try::do_call::h8947529258b9184a /checkout/src/libstd/panicking.rs:480 #13 0x7f5458d2e08c in __rust_maybe_catch_panic /checkout/src/libpanic_abort/lib.rs:38 #14 0x7f5458d2e08c in std::panicking::try::h86be82cc111cf4a4 /checkout/src/libstd/panicking.rs:459 #15 0x7f5458d2e08c in std::panic::catch_unwind::h4e7cb1cde312e0d8 /checkout/src/libstd/panic.rs:365 #16 0x7f5458d2e08c in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::hc0a139277a4c2850 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/catch_unwind.rs:32 #17 0x7f5458d2e08c in _$LT$futures_cpupool..MySender$LT$F$C$$u20$core..result..Result$LT$$LT$F$u20$as$u20$futures..future..Future$GT$..Item$C$$u20$$LT$F$u20$as$u20$futures..future..Future$GT$..Error$GT$$GT$$u20$as$u20$futures..future..Future$GT$::poll::h7241a9199d4e8186 /builds/worker/workspace/build/src/third_party/rust/futures-cpupool/src/lib.rs:325 #18 0x7f5458d4054e in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::hef8bd2de4bf79d01 /builds/worker/workspace/build/src/third_party/rust/futures/src/future/mod.rs:113 #19 0x7f5458d4054e in _$LT$futures..task_impl..Spawn$LT$T$GT$$GT$::poll_future_notify::_$u7b$$u7b$closure$u7d$$u7d$::hcd4766cff7f42aaf /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/mod.rs:289 #20 0x7f5458d4054e in _$LT$futures..task_impl..Spawn$LT$T$GT$$GT$::enter::_$u7b$$u7b$closure$u7d$$u7d$::hd8d6e2b5a1290ea4 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/mod.rs:363 #21 0x7f5458d4054e in futures::task_impl::std::set::he185d5ee772f8476 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/std/mod.rs:78 #22 0x7f5458d4054e in _$LT$futures..task_impl..Spawn$LT$T$GT$$GT$::enter::hd0619d29abd021b9 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/mod.rs:363 #23 0x7f5458d4054e in _$LT$futures..task_impl..Spawn$LT$T$GT$$GT$::poll_future_notify::h4c5d0c4fac5b8449 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/mod.rs:289 #24 0x7f5458d4054e in futures::task_impl::std::Run::run::hcd87035f17c3eba8 /builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/std/mod.rs:450 #25 0x7f5458d4054e in futures_cpupool::Inner::work::h2a7fea8576a09348 /builds/worker/workspace/build/src/third_party/rust/futures-cpupool/src/lib.rs:257 #26 0x7f5458d4054e in futures_cpupool::Builder::create::_$u7b$$u7b$closure$u7d$$u7d$::he49fe1c37e6f3937 /builds/worker/workspace/build/src/third_party/rust/futures-cpupool/src/lib.rs:427 #27 0x7f5458d4054e in std::sys_common::backtrace::__rust_begin_short_backtrace::hbaa0bfa0b267eb5e /checkout/src/libstd/sys_common/backtrace.rs:133 #28 0x7f5458d3f65b in std::thread::Builder::spawn::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hf8f6b25d8360e7a4 /checkout/src/libstd/thread/mod.rs:406 #29 0x7f5458d3f65b in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h8c0df1bb9b89c35d /checkout/src/libstd/panic.rs:300 #30 0x7f5458d3f65b in std::panicking::try::do_call::ha320786fe0e95bf0 /checkout/src/libstd/panicking.rs:480 #31 0x7f5458d3f65b in __rust_maybe_catch_panic /checkout/src/libpanic_abort/lib.rs:38 #32 0x7f5458d3f65b in std::panicking::try::ha16e16d3bf07c8eb /checkout/src/libstd/panicking.rs:459 #33 0x7f5458d3f65b in std::panic::catch_unwind::h5af12cea0e16f260 /checkout/src/libstd/panic.rs:365 #34 0x7f5458d3f65b in std::thread::Builder::spawn::_$u7b$$u7b$closure$u7d$$u7d$::h8341ff335d15fac7 /checkout/src/libstd/thread/mod.rs:405 #35 0x7f5458d3f65b in _$LT$F$u20$as$u20$alloc..boxed..FnBox$LT$A$GT$$GT$::call_box::hd9f2045bf4e2fd53 /checkout/src/liballoc/boxed.rs:815 #36 0x7f54592d2fb3 in _$LT$alloc..boxed..Box$LT$alloc..boxed..FnBox$LT$A$C$$u20$Output$u3d$R$GT$$u20$$u2b$$u20$$u27$a$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::hf6357ae8c4e17346 /checkout/src/liballoc/boxed.rs:825 #37 0x7f54592d2fb3 in std::sys_common::thread::start_thread::hebf0035ba4789615 /checkout/src/libstd/sys_common/thread.rs:24 #38 0x7f54592d2fb3 in std::sys::unix::thread::Thread::new::thread_start::hd71cb092e75e9bed /checkout/src/libstd/sys/unix/thread.rs:90 #39 0x7f546bb926b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) Thread T31 (AudioIPC0) created by T0 (file:// Content) here: #0 0x4ae80d in __interceptor_pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:204:3 #1 0x7f54592d2ce4 in std::sys::unix::thread::Thread::new::hfacd17f85cfe49c8 /checkout/src/libstd/sys/unix/thread.rs:78 #2 0x7f5458d1d943 in std::thread::Builder::spawn::hcff4ffa19967b409 /checkout/src/libstd/thread/mod.rs:416 #3 0x7f5458d1d943 in futures_cpupool::Builder::create::h2293b415d3288208 /builds/worker/workspace/build/src/third_party/rust/futures-cpupool/src/lib.rs:427 #4 0x7f5458d1d943 in _$LT$audioipc_client..context..ClientContext$u20$as$u20$cubeb_backend..traits..ContextOps$GT$::init::_$u7b$$u7b$closure$u7d$$u7d$::hebf51216ea4fa046 /builds/worker/workspace/build/src/media/audioipc/client/src/context.rs:121 #5 0x7f5458d1d943 in _$LT$std..thread..local..LocalKey$LT$T$GT$$GT$::try_with::hb6615986bad3fa5f /checkout/src/libstd/thread/local.rs:377 #6 0x7f5458d1d943 in _$LT$std..thread..local..LocalKey$LT$T$GT$$GT$::with::hc556f0429e807045 /checkout/src/libstd/thread/local.rs:288 #7 0x7f5458d1d943 in _$LT$audioipc_client..context..ClientContext$u20$as$u20$cubeb_backend..traits..ContextOps$GT$::init::h8310c60be768aaa6 /builds/worker/workspace/build/src/media/audioipc/client/src/context.rs:119 #8 0x7f5458d3f228 in cubeb_backend::capi::capi_init::h3cfdebd406e31fab /builds/worker/workspace/build/src/third_party/rust/cubeb-backend/src/capi.rs:67 #9 0x7f5458d3f228 in audioipc_client_init /builds/worker/workspace/build/src/media/audioipc/client/src/lib.rs:105 #10 0x7f54514b0421 in mozilla::CubebUtils::GetCubebContextUnlocked() /builds/worker/workspace/build/src/dom/media/CubebUtils.cpp:436:10 #11 0x7f54514b06eb in mozilla::CubebUtils::InitPreferredSampleRate() /builds/worker/workspace/build/src/dom/media/CubebUtils.cpp:307:20 #12 0x7f54514b0789 in mozilla::CubebUtils::PreferredSampleRate() /builds/worker/workspace/build/src/dom/media/CubebUtils.cpp:329:8 #13 0x7f5451804e07 in mozilla::MediaStreamGraph::GetInstance(mozilla::MediaStreamGraph::GraphDriverType, nsPIDOMWindowInner*, int) /builds/worker/workspace/build/src/dom/media/MediaStreamGraph.cpp:3700:54 #14 0x7f545154bc43 in mozilla::dom::CanvasCaptureMediaStream::CreateSourceStream(nsPIDOMWindowInner*, mozilla::dom::HTMLCanvasElement*) /builds/worker/workspace/build/src/dom/media/CanvasCaptureMediaStream.cpp:290:5 #15 0x7f5451260545 in mozilla::dom::HTMLCanvasElement::CaptureStream(mozilla::dom::Optional<double> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/html/HTMLCanvasElement.cpp:772:5 #16 0x7f54504570a0 in mozilla::dom::HTMLCanvasElementBinding::captureStream(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLCanvasElement*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/HTMLCanvasElementBinding.cpp:682:76 #17 0x7f545093e721 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3260:13 #18 0x7f54571e9027 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:280:15 #19 0x7f54571e9027 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:467 #20 0x7f54573c641b in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jit/BaselineIC.cpp:2382:14 #21 0x19d277ea62f7 (<unknown module>) #22 0x621000c88077 (<unknown module>) #23 0x19d277ea04e1 (<unknown module>) #24 0x7f54573efd6d in EnterBaseline /builds/worker/workspace/build/src/js/src/jit/BaselineJIT.cpp:149:9 #25 0x7f54573efd6d in js::jit::EnterBaselineAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/BaselineJIT.cpp:226 #26 0x7f54571dea3f in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2037:28 #27 0x7f54571b9fe3 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12 #28 0x7f54571e8da5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15 #29 0x7f54571ea022 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10 #30 0x7f5457d21f6a in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2989:12 #31 0x7f54500cacf5 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:51:8 #32 0x7f5451070c2e in HandleEvent<mozilla::dom::EventTarget *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12 #33 0x7f5451070c2e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1118 #34 0x7f545107238b in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1288:20 #35 0x7f545105c737 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:528:16 #36 0x7f5451060533 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:961:9 #37 0x7f5453340068 in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/workspace/build/src/layout/base/nsDocumentViewer.cpp:1064:7 #38 0x7f5456499452 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7246:21 #39 0x7f5456495879 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp:7039:7 #40 0x7f545649d07f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/workspace/build/src/docshell/base/nsDocShell.cpp #41 0x7f544d118297 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:1315:3 #42 0x7f544d11731a in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:858:14 #43 0x7f544d113ef5 in nsDocLoader::DocLoaderIsEmpty(bool) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:747:9 #44 0x7f544d115ebc in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp:632:5 #45 0x7f544d116edc in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/uriloader/base/nsDocLoader.cpp #46 0x7f544b4cd2ea in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/workspace/build/src/netwerk/base/nsLoadGroup.cpp:629:28 #47 0x7f544e4f6a9a in DoUnblockOnload /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8401:18 #48 0x7f544e4f6a9a in nsDocument::UnblockOnload(bool) /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:8323 #49 0x7f544e4d7414 in nsIDocument::DispatchContentLoadedEvents() /builds/worker/workspace/build/src/dom/base/nsDocument.cpp:5303:3 #50 0x7f544e5e9da4 in applyImpl<nsIDocument, void (nsIDocument::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1165:12 #51 0x7f544e5e9da4 in apply<nsIDocument, void (nsIDocument::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1171 #52 0x7f544e5e9da4 in mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1216 #53 0x7f544b2c52a1 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:337:32 #54 0x7f544b2e3f63 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1090:14 #55 0x7f544b2ffb30 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10 #56 0x7f544c1de65a in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21 #57 0x7f544c132649 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #58 0x7f544c132649 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #59 0x7f544c132649 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #60 0x7f5452ca5efa in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:157:27 #61 0x7f5456f0032b in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:893:22 #62 0x7f544c132649 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #63 0x7f544c132649 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #64 0x7f544c132649 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #65 0x7f5456effcf0 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:719:34 #66 0x4f50dc in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30 #67 0x4f50dc in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:282 #68 0x7f546ab2882f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 Thread T163 (CubebOp~tion #3) created by T0 (file:// Content) here: #0 0x4ae80d in __interceptor_pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:204:3 #1 0x7f54685891cf in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:433:14 #2 0x7f5468588dbe in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:518:12 #3 0x7f544b2e0843 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:608:8 #4 0x7f544b2e9f4a in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:471:22 #5 0x7f544b2f951f in NS_NewNamedThread /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:143:45 #6 0x7f544b2f951f in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:109 #7 0x7f544b2fb0f6 in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:278:5 #8 0x7f545159325d in Dispatch /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIEventTarget.h:37:14 #9 0x7f545159325d in Dispatch /builds/worker/workspace/build/src/dom/media/GraphDriver.h:583 #10 0x7f545159325d in mozilla::AudioCallbackDriver::Revive() /builds/worker/workspace/build/src/dom/media/GraphDriver.cpp:794 #11 0x7f54517f105d in mozilla::MediaStreamGraphImpl::RunInStableState(bool) /builds/worker/workspace/build/src/dom/media/MediaStreamGraph.cpp:1666:19 #12 0x7f545181a2ba in mozilla::(anonymous namespace)::MediaStreamGraphStableStateRunnable::Run() /builds/worker/workspace/build/src/dom/media/MediaStreamGraph.cpp:1544:15 #13 0x7f544b13e700 in mozilla::CycleCollectedJSContext::ProcessStableStateQueue() /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:312:12 #14 0x7f544b140895 in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:377:3 #15 0x7f544cbd9aad in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/workspace/build/src/js/xpconnect/src/XPCJSContext.cpp:1258:30 #16 0x7f544b2e4a4d in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1125:24 #17 0x7f544b2ffb30 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10 #18 0x7f544c1de65a in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21 #19 0x7f544c132649 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #20 0x7f544c132649 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #21 0x7f544c132649 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #22 0x7f5452ca5efa in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:157:27 #23 0x7f5456f0032b in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:893:22 #24 0x7f544c132649 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 #25 0x7f544c132649 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 #26 0x7f544c132649 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 #27 0x7f5456effcf0 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:719:34 #28 0x4f50dc in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30 #29 0x4f50dc in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:282 #30 0x7f546ab2882f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/dom/media/AudioMixer.h:67:17 in FinishMixing Shadow bytes around the buggy address: 0x0c2280017b40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2280017b50: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2280017b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2280017b70: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c2280017b80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c2280017b90:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2280017ba0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2280017bb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2280017bc0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x0c2280017bd0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c2280017be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3443==ABORTING
Go figure, I was just asking Karl about bug 1457372 the other day. Maybe this will give us some insight.
Group: core-security → media-core-security
See Also: → 1457372
Jason: any hope of a reliable testcase? If not we probably should just dupe to bug 1457372
Flags: needinfo?(jthomas)
Keywords: csectype-uaf, sec-high
Flags: needinfo?(jthomas) → needinfo?(jkratzer)
Unfortunately not. It's triggered twice since I filed this but none of the testcases have been reproducible.
Flags: needinfo?(jkratzer)
Thank you for filing, Jason. This is the same as bug 1457372, and so I think we should track there. The fact that OpenAudioInputImpl and Revive have both been involved again may be significant, but I can't draw concrete conclusions about thread creators because these threads are reused from a pool. Even if the testcases are not reproducible, if you have one that is known to have reproduced once without the need to run the browser for too long, then I could try running repeatedly with rr --chaos.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE

Removing employee no longer with company from CC list of private bugs.

Group: media-core-security
You need to log in before you can comment on or make changes to this bug.