1463329 - AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:92:25 in RefPtr

Status: RESOLVED FIXED

(Core :: WebVR, defect)

Description

[Jason Kratzer [:jkratzer]]

Found while fuzzing mozilla-central rev dc1868d255be.  I'm currently reducing the testcase and will update this once complete.

=================================================================
==27863==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020003066f8 at pc 0x7ff153b0bd3c bp 0x7ffd04ff6f50 sp 0x7ffd04ff6f48
READ of size 8 at 0x6020003066f8 thread T0 (file:// Content)
    #0 0x7ff153b0bd3b in RefPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:92:25
    #1 0x7ff153b0bd3b in Construct<RefPtr<mozilla::gfx::VRDisplayClient> &> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:541
    #2 0x7ff153b0bd3b in AppendElement<RefPtr<mozilla::gfx::VRDisplayClient> &, nsTArrayInfallibleAllocator> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2293
    #3 0x7ff153b0bd3b in mozilla::gfx::VRManagerChild::UpdateDisplayInfo(nsTArray<mozilla::gfx::VRDisplayInfo>&) /builds/worker/workspace/build/src/gfx/vr/ipc/VRManagerChild.cpp:212
    #4 0x7ff153b0bf96 in mozilla::gfx::VRManagerChild::RecvUpdateDisplayInfo(nsTArray<mozilla::gfx::VRDisplayInfo>&&) /builds/worker/workspace/build/src/gfx/vr/ipc/VRManagerChild.cpp:240:3
    #5 0x7ff1524ccf89 in mozilla::gfx::PVRManagerChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVRManagerChild.cpp:612:20
    #6 0x7ff151ecff9e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2136:25
    #7 0x7ff151eccee2 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2066:17
    #8 0x7ff151ece71c in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1912:5
    #9 0x7ff151eced78 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1945:15
    #10 0x7ff150fda236 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1090:14
    #11 0x7ff150ff6170 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10
    #12 0x7ff151ed7c3a in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21
    #13 0x7ff151e2b1a9 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #14 0x7ff151e2b1a9 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #15 0x7ff151e2b1a9 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #16 0x7ff158a4ee5a in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:157:27
    #17 0x7ff15cca45eb in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:893:22
    #18 0x7ff151e2b1a9 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #19 0x7ff151e2b1a9 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #20 0x7ff151e2b1a9 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #21 0x7ff15cca3fb0 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:719:34
    #22 0x4f50dc in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30
    #23 0x4f50dc in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:282
    #24 0x7ff170d6882f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #25 0x42476c in _start (/home/forb1dden/builds/mc-asan/firefox+0x42476c)

0x6020003066f8 is located 8 bytes inside of 16-byte region [0x6020003066f0,0x602000306700)
freed by thread T0 (file:// Content) here:
    #0 0x4c5172 in __interceptor_free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:68:3
    #1 0x7ff150e2dd8a in Free /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:203:34
    #2 0x7ff150e2dd8a in nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::ShrinkCapacity(unsigned long, unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:230
    #3 0x7ff153b1659b in ShiftData<nsTArrayInfallibleAllocator> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:261:5
    #4 0x7ff153b1659b in RefPtr<mozilla::gfx::VRDisplayClient>* nsTArray_Impl<RefPtr<mozilla::gfx::VRDisplayClient>, nsTArrayInfallibleAllocator>::ReplaceElementsAt<RefPtr<mozilla::gfx::VRDisplayClient>, nsTArrayInfallibleAllocator>(unsigned long, unsigned long, RefPtr<mozilla::gfx::VRDisplayClient> const*, unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2108
    #5 0x7ff153b0b1f9 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:930:7
    #6 0x7ff153b0b1f9 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2350
    #7 0x7ff153b0b1f9 in mozilla::gfx::VRManagerChild::UpdateDisplayInfo(nsTArray<mozilla::gfx::VRDisplayInfo>&) /builds/worker/workspace/build/src/gfx/vr/ipc/VRManagerChild.cpp:223
    #8 0x7ff153b0bf96 in mozilla::gfx::VRManagerChild::RecvUpdateDisplayInfo(nsTArray<mozilla::gfx::VRDisplayInfo>&&) /builds/worker/workspace/build/src/gfx/vr/ipc/VRManagerChild.cpp:240:3
    #9 0x7ff1524ccf89 in mozilla::gfx::PVRManagerChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVRManagerChild.cpp:612:20
    #10 0x7ff151ecff9e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2136:25
    #11 0x7ff151eccee2 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2066:17
    #12 0x7ff151ece71c in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1912:5
    #13 0x7ff151eced78 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1945:15
    #14 0x7ff150fda236 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1090:14
    #15 0x7ff150ff6170 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10
    #16 0x7ff15877d709 in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2908:31)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:324:25
    #17 0x7ff15877d709 in mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*) /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2908
    #18 0x7ff15877ba14 in mozilla::dom::XMLHttpRequestMainThread::Send(JSContext*, mozilla::dom::Nullable<mozilla::dom::DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2693:11
    #19 0x7ff155bb1064 in mozilla::dom::XMLHttpRequestBinding::send(JSContext*, JS::Handle<JSObject*>, mozilla::dom::XMLHttpRequest*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/XMLHttpRequestBinding.cpp:1275:9
    #20 0x7ff1566bf151 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3280:13
    #21 0x7ff15cf8cef7 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:280:15
    #22 0x7ff15cf8cef7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:467
    #23 0x7ff15cf776e4 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12
    #24 0x7ff15cf776e4 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3086
    #25 0x7ff15cf5dea3 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #26 0x7ff15cf8cc75 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #27 0x7ff15cf8def2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10
    #28 0x7ff15dad25ca in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2981:12
    #29 0x7ff1558a5d3b in mozilla::dom::FrameRequestCallback::Call(JSContext*, JS::Handle<JS::Value>, double, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WindowBinding.cpp:802:8
    #30 0x7ff153af61a9 in Call /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/WindowBinding.h:548:12
    #31 0x7ff153af61a9 in Call /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/WindowBinding.h:561
    #32 0x7ff153af61a9 in mozilla::gfx::VRManagerChild::RunFrameRequestCallbacks() /builds/worker/workspace/build/src/gfx/vr/ipc/VRManagerChild.cpp:435
    #33 0x7ff153b0adf2 in UpdateDisplayInfo /builds/worker/workspace/build/src/gfx/vr/VRDisplayClient.cpp:49:3
    #34 0x7ff153b0adf2 in mozilla::gfx::VRManagerChild::UpdateDisplayInfo(nsTArray<mozilla::gfx::VRDisplayInfo>&) /builds/worker/workspace/build/src/gfx/vr/ipc/VRManagerChild.cpp:211
    #35 0x7ff153b0bf96 in mozilla::gfx::VRManagerChild::RecvUpdateDisplayInfo(nsTArray<mozilla::gfx::VRDisplayInfo>&&) /builds/worker/workspace/build/src/gfx/vr/ipc/VRManagerChild.cpp:240:3
    #36 0x7ff1524ccf89 in mozilla::gfx::PVRManagerChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVRManagerChild.cpp:612:20
    #37 0x7ff151ecff9e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2136:25
    #38 0x7ff151eccee2 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2066:17
    #39 0x7ff151ece71c in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1912:5

previously allocated by thread T0 (file:// Content) here:
    #0 0x4c54b3 in malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3
    #1 0x4f5f7d in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:70:17
    #2 0x7ff150e2d91a in Malloc /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:209:46
    #3 0x7ff150e2d91a in nsTArrayInfallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator>(unsigned long, unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray-inl.h:136
    #4 0x7ff153b1642f in RefPtr<mozilla::gfx::VRDisplayClient>* nsTArray_Impl<RefPtr<mozilla::gfx::VRDisplayClient>, nsTArrayInfallibleAllocator>::ReplaceElementsAt<RefPtr<mozilla::gfx::VRDisplayClient>, nsTArrayInfallibleAllocator>(unsigned long, unsigned long, RefPtr<mozilla::gfx::VRDisplayClient> const*, unsigned long) /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2103:47
    #5 0x7ff153b0b1f9 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:930:7
    #6 0x7ff153b0b1f9 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:2350
    #7 0x7ff153b0b1f9 in mozilla::gfx::VRManagerChild::UpdateDisplayInfo(nsTArray<mozilla::gfx::VRDisplayInfo>&) /builds/worker/workspace/build/src/gfx/vr/ipc/VRManagerChild.cpp:223
    #8 0x7ff153b0bf96 in mozilla::gfx::VRManagerChild::RecvUpdateDisplayInfo(nsTArray<mozilla::gfx::VRDisplayInfo>&&) /builds/worker/workspace/build/src/gfx/vr/ipc/VRManagerChild.cpp:240:3
    #9 0x7ff1524ccf89 in mozilla::gfx::PVRManagerChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PVRManagerChild.cpp:612:20
    #10 0x7ff151ecff9e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2136:25
    #11 0x7ff151eccee2 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:2066:17
    #12 0x7ff151ece71c in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1912:5
    #13 0x7ff151eced78 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:1945:15
    #14 0x7ff150fda236 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1090:14
    #15 0x7ff150ff6170 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:519:10
    #16 0x7ff15877d709 in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2908:31)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:324:25
    #17 0x7ff15877d709 in mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*) /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2908
    #18 0x7ff15877ba14 in mozilla::dom::XMLHttpRequestMainThread::Send(JSContext*, mozilla::dom::Nullable<mozilla::dom::DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/xhr/XMLHttpRequestMainThread.cpp:2693:11
    #19 0x7ff155bb1064 in mozilla::dom::XMLHttpRequestBinding::send(JSContext*, JS::Handle<JSObject*>, mozilla::dom::XMLHttpRequest*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/XMLHttpRequestBinding.cpp:1275:9
    #20 0x7ff1566bf151 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3280:13
    #21 0x7ff15cf8cef7 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:280:15
    #22 0x7ff15cf8cef7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:467
    #23 0x7ff15cf776e4 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12
    #24 0x7ff15cf776e4 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3086
    #25 0x7ff15cf5dea3 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #26 0x7ff15cf8cc75 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #27 0x7ff15cf8def2 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10
    #28 0x7ff15dad25ca in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2981:12
    #29 0x7ff155e6c6a5 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:51:8
    #30 0x7ff156df3a9e in HandleEvent<mozilla::dom::EventTarget *> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12
    #31 0x7ff156df3a9e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1121
    #32 0x7ff156df522b in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1291:20
    #33 0x7ff156ddf537 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:528:16
    #34 0x7ff156de3333 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:961:9
    #35 0x7ff156de586b in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp
    #36 0x7ff1542999e8 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/nsINode.cpp:1091:5

SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:92:25 in RefPtr
Shadow bytes around the buggy address:
  0x0c0480058c80: fa fa fd fd fa fa 00 00 fa fa fd fd fa fa fd fd
  0x0c0480058c90: fa fa fa fa fa fa fd fd fa fa fa fa fa fa 00 01
  0x0c0480058ca0: fa fa fa fa fa fa 00 00 fa fa fa fa fa fa fd fd
  0x0c0480058cb0: fa fa fa fa fa fa fd fd fa fa 04 fa fa fa fa fa
  0x0c0480058cc0: fa fa fd fd fa fa fa fa fa fa 04 fa fa fa 00 07
=>0x0c0480058cd0: fa fa fa fa fa fa fd fd fa fa fd fd fa fa fd[fd]
  0x0c0480058ce0: fa fa fa fa fa fa fd fd fa fa 00 00 fa fa 03 fa
  0x0c0480058cf0: fa fa fd fd fa fa fa fa fa fa fa fa fa fa fd fd
  0x0c0480058d00: fa fa fa fa fa fa 04 fa fa fa fa fa fa fa fa fa
  0x0c0480058d10: fa fa fa fa fa fa fd fa fa fa fd fd fa fa fd fd
  0x0c0480058d20: fa fa fd fd fa fa fd fd fa fa fa fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==27863==ABORTING

Comment 1

[:kip (Kearwood Gilbert)]

I am investigating now.

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

I've attached the partially reduced testcase.  Further reduction was found to make the testcase unreliable.  As is, the current testcase may take a few minutes in order to trigger the issue and requires a build with --fuzzing enabled.

Unzip the archive and use harness.html as the entry-point.

Comment 3

[Andrew McCreight [:mccr8]]

Alex points out this can be probably be sec-high because it is in the content process.

Comment 4

[:kip (Kearwood Gilbert)]

I have repro'd this with a fuzzing+asan build on Linux.  Investigating deeper.

Comment 5

[:kip (Kearwood Gilbert)]

I suspect that the issue is caused by modifications to VRManagerChild::mDisplays during a loop with "for (auto& display : mDisplays)".  The change happens indirectly, due to asynchronous messages that get pumped during the loop.

Having a local copy of mDisplays to iterate on should keep the RefPtr's alive until the loop exits.

I am verifying this now.

A UAF could be possible in the client thread, but would be difficult to remotely cause this condition, as it would require physical VR hardware to be disconnected at a very precise time while visiting malicious content.

Comment 6

[:kip (Kearwood Gilbert)]

Attachment: Bug 1463329 - Iterate over a copy of VRManagerChild::mDisplays to guard against modifications to mDisplays during the loop

Comment 7

[:kip (Kearwood Gilbert)]

This appears to eliminate the failure in my local ASAN builds, but I haven't yet been able to verify with the current nightly, as I am encountering ASAN related linker issues on the current nightly in Ubuntu 18.04.

Would you be able to confirm that it no longer fails with this patch?

I'll do some sanity checks with real VR hardware tomorrow to ensure that nothing regresses with this applied.

Comment 8

[:kip (Kearwood Gilbert)]

I've tested this on real VR hardware and see no issues.

Comment 9

[:kip (Kearwood Gilbert)]

Comment on attachment 8982066 [details] [diff] [review]
Bug 1463329 - Iterate over a copy of VRManagerChild::mDisplays to guard against modifications to mDisplays during the loop

[Security approval request comment]
How easily could an exploit be constructed based on the patch?
- An exploit would require physical access to the end users' computer to disconnect and reconnect hardware while someone was actively using a WebVR site in immersive mode.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?
- The patch comment and content do not mention any security related issue; however, identify the error in the logic involved.

Which older supported branches are affected by this flaw?
- This code was introduced early in WebVR implementation and would be within the current Nightly, Beta, Release, and ESR.

If not all supported branches, which bug introduced the flaw?
- This code was introduced with the implementation of WebVR 1.0, specifically Bug 1284357 (Implement Navigator.activeVRDisplays)

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?
- This patch could be uplifted to Beta, Release, and ESR with little or no changes.

How likely is this patch to cause regressions; how much testing does it need?
- Low-Moderate risk.  I have tested the patch with physical VR hardware and was able to enter and exit immersive mode on WebVR sites.  If any regressions occur, they would be limited to WebVR functionality for users that have physical VR hardware attached to their computer in 64-bit Windows while visiting a site with WebVR content.

Comment 10

[Daniel Veditz [:dveditz]]

Lowering to sec-moderate based on comment 9 indicating the fuzzer is using functionality that isn't available to a web context (I see requestVRServiceTest which requires a pref flip, don't know if there's other special-priv stuff as well).

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Comment on attachment 8982066 [details] [diff] [review]
Bug 1463329 - Iterate over a copy of VRManagerChild::mDisplays to guard against modifications to mDisplays during the loop

Clearing sec-approval so this can be checked into trunk.

Comment 12

[Julien Cristau [:jcristau] (back August 18)]

https://hg.mozilla.org/mozilla-central/rev/4c50952c3e8c

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Doesn't sound like we need to worry about this on ESR60, but let's at least backport to Beta. Kip, can you please request approval?

Comment 14

[Jason Kratzer [:jkratzer]]

Kip, sorry for the delay.  Do you still need me to test this patch?

Comment 15

[:kip (Kearwood Gilbert)]

(In reply to Jason Kratzer [:jkratzer] from comment #14)
> Kip, sorry for the delay.  Do you still need me to test this patch?

No worries, I am pretty confident that this patch fixes the issue.  Having a secondary confirmation would be mostly a sanity check :-)

Comment 16

[Ryan VanderMeulen [:RyanVM]]

Please request Beta approval on this still :)

Comment 17

[:kip (Kearwood Gilbert)]

Comment on attachment 8982066 [details] [diff] [review]
Bug 1463329 - Iterate over a copy of VRManagerChild::mDisplays to guard against modifications to mDisplays during the loop

Approval Request Comment
[Feature/Bug causing the regression]:
Bug 1284357 (WebVR 1.0 API)
[User impact if declined]:
If VR hardware was physically disconnected from the end user's machine while visiting a malicious web site, a UAF would be possible.  This would require precise timing for the hardware removal and garbage collection event.
[Is this code covered by automated tests?]:
The affected code is used by our VR reftests and mochitests; however, a specific crash test for this scenario has not yet been submitted.
[Has the fix been verified in Nightly?]:
Yes, the code has landed in nightly; the trigger testcase attached to the bug no longer is effective.
[Needs manual test from QE? If yes, steps to reproduce]: 
N/A - This was only reproduced on address sanitizer + fuzzing builds.
[List of other uplifts needed for the feature/fix]:
No dependencies
[Is the change risky?]:
Low risk.
[Why is the change risky/not risky?]:
This code is isolated to two functions, which are only used by WebVR functionality.
[String changes made/needed]:
None

Comment 18

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 8982066 [details] [diff] [review]
Bug 1463329 - Iterate over a copy of VRManagerChild::mDisplays to guard against modifications to mDisplays during the loop

Fixes a WebVR crash. Approved for 61.0b14.

Comment 19

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/86a5a856fa17