Closed Bug 1469775 Opened 8 years ago Closed 4 years ago

Intermittent SUMMARY: AddressSanitizer: heap-buffer-overflow z:\build\build\src\gfx\cairo\cairo\src\cairo-gstate.c:121 in _cairo_gstate_init

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: aryx, Unassigned)

References

Details

(Keywords: csectype-bounds, intermittent-failure, sec-moderate)

One of several new use-after-free bugs referencing cairo. See bug 1467363 (bug1467363 comment 9 says it looks unrelated) and bug 1469486. https://treeherder.mozilla.org/logviewer.html#?job_id=183810605&repo=autoland 15:40:20 INFO - 635 INFO TEST-START | browser/components/extensions/test/browser/test-oop-extensions/browser_ext_tabs_hide.js 15:40:21 INFO - GECKO(5660) | Waiting for browser load 15:40:21 INFO - GECKO(5660) | Saw state f0001 and status 0 15:40:21 INFO - GECKO(5660) | Saw state c0010 and status 0 15:40:21 INFO - GECKO(5660) | Browser loaded http://example.com/?one 15:40:21 INFO - GECKO(5660) | Waiting for browser load 15:40:21 INFO - GECKO(5660) | Saw state f0001 and status 0 15:40:21 INFO - GECKO(5660) | Saw state c0010 and status 0 15:40:21 INFO - GECKO(5660) | Browser loaded http://example.com/?two 15:40:21 INFO - GECKO(5660) | ================================================================= 15:40:21 ERROR - GECKO(5660) | ==5660==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x123054b00090 at pc 0x7fff6188cfe6 bp 0x00c00c7fd560 sp 0x00c00c7fd5a8 15:40:21 INFO - GECKO(5660) | WRITE of size 8 at 0x123054b00090 thread T47 15:40:22 INFO - GECKO(5660) | #0 0x7fff6188cfe5 in _cairo_gstate_init z:\build\build\src\gfx\cairo\cairo\src\cairo-gstate.c:121 15:40:22 INFO - GECKO(5660) | #1 0x7fff6193ee2c in _moz_cairo_create z:\build\build\src\gfx\cairo\cairo\src\cairo.c:399 15:40:22 INFO - GECKO(5660) | #2 0x7fff58af4e8e in mozilla::gfx::DrawTargetCairo::InitAlreadyReferenced(struct _cairo_surface *,struct mozilla::gfx::IntSizeTyped<struct mozilla::gfx::UnknownUnits> const &,enum mozilla::gfx::SurfaceFormat *) z:\build\build\src\gfx\2d\DrawTargetCairo.cpp:1919 15:40:22 INFO - GECKO(5660) | #3 0x7fff58a1f735 in mozilla::gfx::Factory::CreateDrawTargetForCairoSurface(struct _cairo_surface *,struct mozilla::gfx::IntSizeTyped<struct mozilla::gfx::UnknownUnits> const &,enum mozilla::gfx::SurfaceFormat *) z:\build\build\src\gfx\2d\Factory.cpp:1034 15:40:22 INFO - GECKO(5660) | #4 0x7fff5f53ec4c in mozilla::widget::WinCompositorWidget::StartRemoteDrawing(void) z:\build\build\src\widget\windows\WinCompositorWidget.cpp:114 15:40:22 INFO - GECKO(5660) | #5 0x7fff5f48fb05 in mozilla::widget::CompositorWidget::StartRemoteDrawingInRegion(class mozilla::gfx::IntRegionTyped<struct mozilla::LayoutDevicePixel> &,enum mozilla::layers::BufferMode *) z:\build\build\src\widget\CompositorWidget.h:159 15:40:22 INFO - GECKO(5660) | #6 0x7fff59254845 in mozilla::layers::BasicCompositor::BeginFrame(class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> *) z:\build\build\src\gfx\layers\basic\BasicCompositor.cpp:928 15:40:22 INFO - GECKO(5660) | #7 0x7fff593a7511 in mozilla::layers::LayerManagerComposite::Render(class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &) z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:918 15:40:22 INFO - GECKO(5660) | #8 0x7fff593a5001 in mozilla::layers::LayerManagerComposite::UpdateAndRender(void) z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:534 15:40:22 INFO - GECKO(5660) | #9 0x7fff593a373c in mozilla::layers::LayerManagerComposite::EndTransaction(class mozilla::TimeStamp const &,enum mozilla::layers::LayerManager::EndTransactionFlags) z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:464 15:40:22 INFO - GECKO(5660) | #10 0x7fff5945383f in mozilla::layers::CompositorBridgeParent::CompositeToTarget(class mozilla::gfx::DrawTarget *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const *) z:\build\build\src\gfx\layers\ipc\CompositorBridgeParent.cpp:1068 15:40:22 INFO - GECKO(5660) | #11 0x7fff5946f569 in mozilla::layers::CompositorVsyncScheduler::Composite(class mozilla::TimeStamp) z:\build\build\src\gfx\layers\ipc\CompositorVsyncScheduler.cpp:243 15:40:22 INFO - GECKO(5660) | #12 0x7fff5949cae1 in mozilla::detail::RunnableMethodImpl<class mozilla::layers::CompositorVsyncScheduler *,void ( mozilla::layers::CompositorVsyncScheduler::*)(class mozilla::TimeStamp),1,1,class mozilla::TimeStamp>::Run(void) z:\build\build\src\obj-firefox\dist\include\nsThreadUtils.h:1216 15:40:22 INFO - GECKO(5660) | #13 0x7fff576098b3 in ?DeferOrRunPendingTask@MessageLoop@@IEAA_N$$QEAUPendingTask@1@@Z z:\build\build\src\ipc\chromium\src\base\message_loop.cc:459 15:40:22 INFO - GECKO(5660) | #14 0x7fff5760b09e in MessageLoop::DoWork(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:534 15:40:22 INFO - GECKO(5660) | #15 0x7fff575db682 in base::MessagePumpForUI::DoRunLoop(void) z:\build\build\src\ipc\chromium\src\base\message_pump_win.cc:210 15:40:22 INFO - GECKO(5660) | #16 0x7fff575ddad9 in base::MessagePumpWin::Run(class base::MessagePump::Delegate *) z:\build\build\src\ipc\chromium\src\base\message_pump_win.h:80 15:40:22 INFO - GECKO(5660) | #17 0x7fff5760865e in MessageLoop::RunHandler(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:318 15:40:22 INFO - GECKO(5660) | #18 0x7fff57618e55 in base::Thread::ThreadMain(void) z:\build\build\src\ipc\chromium\src\base\thread.cc:181 15:40:22 INFO - GECKO(5660) | #19 0x7fff575df4ef in `anonymous namespace'::ThreadFunc z:\build\build\src\ipc\chromium\src\base\platform_thread_win.cc:28 15:40:22 INFO - GECKO(5660) | #20 0x7fff6afed0b8 (Z:\task_1529421273\build\application\firefox\clang_rt.asan_dynamic-x86_64.dll+0x18003d0b8) 15:40:22 INFO - GECKO(5660) | #21 0x7fff8a5c2773 (C:\Windows\System32\KERNEL32.DLL+0x180012773) 15:40:22 INFO - GECKO(5660) | #22 0x7fff7b535441 in patched_BaseThreadInitThunk z:\build\build\src\mozglue\build\WindowsDllBlocklist.cpp:622 15:40:22 INFO - GECKO(5660) | #23 0x7fff8ceb0d60 (C:\Windows\SYSTEM32\ntdll.dll+0x180070d60) 15:40:22 INFO - GECKO(5660) | Address 0x123054b00090 is a wild pointer. 15:40:22 INFO - GECKO(5660) | SUMMARY: AddressSanitizer: heap-buffer-overflow z:\build\build\src\gfx\cairo\cairo\src\cairo-gstate.c:121 in _cairo_gstate_init 15:40:22 INFO - GECKO(5660) | Shadow bytes around the buggy address: 15:40:22 INFO - GECKO(5660) | 0x04405efdffc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | 0x04405efdffd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | 0x04405efdffe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | 0x04405efdfff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | 0x04405efe0000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | =>0x04405efe0010: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | 0x04405efe0020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | 0x04405efe0030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | 0x04405efe0040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | 0x04405efe0050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | 0x04405efe0060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 15:40:22 INFO - GECKO(5660) | Shadow byte legend (one shadow byte represents 8 application bytes): 15:40:22 INFO - GECKO(5660) | Addressable: 00 15:40:22 INFO - GECKO(5660) | Partially addressable: 01 02 03 04 05 06 07 15:40:22 INFO - GECKO(5660) | Heap left redzone: fa 15:40:22 INFO - GECKO(5660) | Freed heap region: fd 15:40:22 INFO - GECKO(5660) | Stack left redzone: f1 15:40:22 INFO - GECKO(5660) | Stack mid redzone: f2 15:40:22 INFO - GECKO(5660) | Stack right redzone: f3 15:40:22 INFO - GECKO(5660) | Stack after return: f5 15:40:22 INFO - GECKO(5660) | Stack use after scope: f8 15:40:22 INFO - GECKO(5660) | Global redzone: f9 15:40:22 INFO - GECKO(5660) | Global init order: f6 15:40:22 INFO - GECKO(5660) | Poisoned by user: f7 15:40:22 INFO - GECKO(5660) | Container overflow: fc 15:40:22 INFO - GECKO(5660) | Array cookie: ac 15:40:22 INFO - GECKO(5660) | Intra object redzone: bb 15:40:22 INFO - GECKO(5660) | ASan internal: fe 15:40:22 INFO - GECKO(5660) | Left alloca redzone: ca 15:40:22 INFO - GECKO(5660) | Right alloca redzone: cb 15:40:22 INFO - GECKO(5660) | Shadow gap: cc 15:40:22 INFO - GECKO(5660) | Thread T47 created by T0 here: 15:40:22 INFO - GECKO(5660) | #0 0x7fff6afee200 (Z:\task_1529421273\build\application\firefox\clang_rt.asan_dynamic-x86_64.dll+0x18003e200) 15:40:22 INFO - GECKO(5660) | #1 0x7fff575df48f in PlatformThread::Create(unsigned __int64,class PlatformThread::Delegate *,void * *) z:\build\build\src\ipc\chromium\src\base\platform_thread_win.cc:86 15:40:22 INFO - GECKO(5660) | #2 0x7fff5761870c in base::Thread::StartWithOptions(struct base::Thread::Options const &) z:\build\build\src\ipc\chromium\src\base\thread.cc:99 15:40:22 INFO - GECKO(5660) | #3 0x7fff5946dd8c in mozilla::layers::CompositorThreadHolder::CompositorThreadHolder(void) z:\build\build\src\gfx\layers\ipc\CompositorThread.cpp:53 15:40:22 INFO - GECKO(5660) | #4 0x7fff5946e0c0 in mozilla::layers::CompositorThreadHolder::Start(void) z:\build\build\src\gfx\layers\ipc\CompositorThread.cpp:124 15:40:22 INFO - GECKO(5660) | #5 0x7fff5954ed2b in gfxPlatform::Init(void) z:\build\build\src\gfx\thebes\gfxPlatform.cpp:777 15:40:22 INFO - GECKO(5660) | #6 0x7fff5954bcd3 in gfxPlatform::GetPlatform(void) z:\build\build\src\gfx\thebes\gfxPlatform.cpp:534 15:40:22 INFO - GECKO(5660) | #7 0x7fff5fc1c49f in nsRefreshDriver::ChooseTimer(void)const z:\build\build\src\layout\base\nsRefreshDriver.cpp:1110 15:40:22 INFO - GECKO(5660) | #8 0x7fff5fc1ff5b in nsRefreshDriver::EnsureTimerStarted(enum nsRefreshDriver::EnsureTimerStartedFlags) z:\build\build\src\layout\base\nsRefreshDriver.cpp:1360 15:40:22 INFO - GECKO(5660) | #9 0x7fff5fc896a6 in nsRefreshDriver::AddStyleFlushObserver(class nsIPresShell *) z:\build\build\src\layout\base\nsRefreshDriver.h:188 15:40:22 INFO - GECKO(5660) | #10 0x7fff5fe601e4 in nsPresContext::CompatibilityModeChanged(void) z:\build\build\src\layout\base\nsPresContext.cpp:1182 15:40:22 INFO - GECKO(5660) | #11 0x7fff5fc833ad in mozilla::PresShell::Init(class nsIDocument *,class nsPresContext *,class nsViewManager *,class mozilla::UniquePtr<class mozilla::ServoStyleSet,class mozilla::DefaultDelete<class mozilla::ServoStyleSet> >) z:\build\build\src\layout\base\PresShell.cpp:951 15:40:22 INFO - GECKO(5660) | #12 0x7fff59f67201 in nsIDocument::CreateShell(class nsPresContext *,class nsViewManager *,class mozilla::UniquePtr<class mozilla::ServoStyleSet,class mozilla::DefaultDelete<class mozilla::ServoStyleSet> >) z:\build\build\src\dom\base\nsDocument.cpp:3782 15:40:22 INFO - GECKO(5660) | #13 0x7fff5fda60bf in nsDocumentViewer::InitPresentationStuff(bool) z:\build\build\src\layout\base\nsDocumentViewer.cpp:794 15:40:22 INFO - GECKO(5660) | #14 0x7fff5fda53eb in nsDocumentViewer::InitInternal(class nsIWidget *,class nsISupports *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,bool,bool,bool) z:\build\build\src\layout\base\nsDocumentViewer.cpp:1044 15:40:22 INFO - GECKO(5660) | #15 0x7fff5fda4570 in nsDocumentViewer::Init(class nsIWidget *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &) z:\build\build\src\layout\base\nsDocumentViewer.cpp:769 15:40:22 INFO - GECKO(5660) | #16 0x7fff62eb3467 in nsDocShell::SetupNewViewer(class nsIContentViewer *) z:\build\build\src\docshell\base\nsDocShell.cpp:8972 15:40:22 INFO - GECKO(5660) | #17 0x7fff62eb1e62 in nsDocShell::Embed(class nsIContentViewer *,char const *,class nsISupports *) z:\build\build\src\docshell\base\nsDocShell.cpp:6782 15:40:22 INFO - GECKO(5660) | #18 0x7fff62ec31aa in nsDocShell::CreateAboutBlankContentViewer(class nsIPrincipal *,class nsIURI *,bool,bool) z:\build\build\src\docshell\base\nsDocShell.cpp:7661 15:40:22 INFO - GECKO(5660) | #19 0x7fff62ec487a in nsDocShell::CreateAboutBlankContentViewer(class nsIPrincipal *) z:\build\build\src\docshell\base\nsDocShell.cpp:7686 15:40:22 INFO - GECKO(5660) | #20 0x7fff62f53310 in nsWebShellWindow::Initialize(class nsIXULWindow *,class nsIXULWindow *,class nsIURI *,int,int,bool,class nsITabParent *,class mozIDOMWindowProxy *,struct nsWidgetInitData &) z:\build\build\src\xpfe\appshell\nsWebShellWindow.cpp:233 15:40:22 INFO - GECKO(5660) | #21 0x7fff62f4d1f8 in nsAppShellService::JustCreateTopWindow(class nsIXULWindow *,class nsIURI *,unsigned int,int,int,bool,class nsITabParent *,class mozIDOMWindowProxy *,class nsWebShellWindow * *) z:\build\build\src\xpfe\appshell\nsAppShellService.cpp:736 15:40:22 INFO - GECKO(5660) | #22 0x7fff62f4f38c in nsAppShellService::CreateTopLevelWindow(class nsIXULWindow *,class nsIURI *,unsigned int,int,int,class nsITabParent *,class mozIDOMWindowProxy *,class nsIXULWindow * *) z:\build\build\src\xpfe\appshell\nsAppShellService.cpp:200 15:40:22 INFO - GECKO(5660) | #23 0x7fff638288cf in nsAppStartup::CreateChromeWindow2(class nsIWebBrowserChrome *,unsigned int,class nsITabParent *,class mozIDOMWindowProxy *,unsigned __int64,bool *,class nsIWebBrowserChrome * *) z:\build\build\src\toolkit\components\startup\nsAppStartup.cpp:680 15:40:22 INFO - GECKO(5660) | #24 0x7fff63a14934 in nsWindowWatcher::CreateChromeWindow(class nsTSubstring<char> const &,class nsIWebBrowserChrome *,unsigned int,class nsITabParent *,class mozIDOMWindowProxy *,unsigned __int64,class nsIWebBrowserChrome * *) z:\build\build\src\toolkit\components\windowwatcher\nsWindowWatcher.cpp:467 15:40:22 INFO - GECKO(5660) | #25 0x7fff63a0f6c8 in nsWindowWatcher::OpenWindowInternal(class mozIDOMWindowProxy *,char const *,char const *,char const *,bool,bool,bool,class nsIArray *,bool,bool,class nsIDocShellLoadInfo *,class mozIDOMWindowProxy * *) z:\build\build\src\toolkit\components\windowwatcher\nsWindowWatcher.cpp:938 15:40:22 INFO - GECKO(5660) | #26 0x7fff63a0ade4 in nsWindowWatcher::OpenWindow(class mozIDOMWindowProxy *,char const *,char const *,char const *,class nsISupports *,class mozIDOMWindowProxy * *) z:\build\build\src\toolkit\components\windowwatcher\nsWindowWatcher.cpp:327 15:40:22 INFO - GECKO(5660) | #27 0x7fff6628e431 in XPTC__InvokebyIndex (Z:\task_1529421273\build\application\firefox\xul.dll+0x18fe8e431) 15:40:22 INFO - GECKO(5660) | #28 0x7fff58230382 in XPCWrappedNative::CallMethod(class XPCCallContext &,enum XPCWrappedNative::CallMode) z:\build\build\src\js\xpconnect\src\XPCWrappedNative.cpp:1186 15:40:22 INFO - GECKO(5660) | #29 0x7fff58237649 in XPC_WN_CallMethod(struct JSContext *,unsigned int,union JS::Value *) z:\build\build\src\js\xpconnect\src\XPCWrappedNativeJSOps.cpp:899 15:40:22 INFO - GECKO(5660) | #30 0x7fff65633332 in js::InternalCallOrConstruct(struct JSContext *,class JS::CallArgs const &,enum js::MaybeConstruct) z:\build\build\src\js\src\vm\Interpreter.cpp:471 15:40:22 INFO - GECKO(5660) | #31 0x7fff65634a15 in InternalCall z:\build\build\src\js\src\vm\Interpreter.cpp:520 15:40:22 INFO - GECKO(5660) | #32 0x7fff65617fe7 in Interpret z:\build\build\src\js\src\vm\Interpreter.cpp:3122 15:40:22 INFO - GECKO(5660) | #33 0x7fff655fc1d0 in js::RunScript(struct JSContext *,class js::RunState &) z:\build\build\src\js\src\vm\Interpreter.cpp:421 15:40:22 INFO - GECKO(5660) | #34 0x7fff65633934 in js::InternalCallOrConstruct(struct JSContext *,class JS::CallArgs const &,enum js::MaybeConstruct) z:\build\build\src\js\src\vm\Interpreter.cpp:493 15:40:22 INFO - GECKO(5660) | #35 0x7fff65634a15 in InternalCall z:\build\build\src\js\src\vm\Interpreter.cpp:520 15:40:22 INFO - GECKO(5660) | #36 0x7fff65634c46 in js::Call(struct JSContext *,class JS::Handle<union JS::Value>,class JS::Handle<union JS::Value>,class js::AnyInvokeArgs const &,class JS::MutableHandle<union JS::Value>) z:\build\build\src\js\src\vm\Interpreter.cpp:539 15:40:22 INFO - GECKO(5660) | #37 0x7fff63cd1ccb in JS_CallFunctionValue(struct JSContext *,class JS::Handle<class JSObject *>,class JS::Handle<union JS::Value>,class JS::HandleValueArray const &,class JS::MutableHandle<union JS::Value>) z:\build\build\src\js\src\jsapi.cpp:2851 15:40:22 INFO - GECKO(5660) | #38 0x7fff582159af in nsXPCWrappedJSClass::CallMethod(class nsXPCWrappedJS *,unsigned short,struct nsXPTMethodInfo const *,struct nsXPTCMiniVariant *) z:\build\build\src\js\xpconnect\src\XPCWrappedJSClass.cpp:1123 15:40:22 INFO - GECKO(5660) | #39 0x7fff58213643 in nsXPCWrappedJS::CallMethod(unsigned short,struct nsXPTMethodInfo const *,struct nsXPTCMiniVariant *) z:\build\build\src\js\xpconnect\src\XPCWrappedJS.cpp:611 15:40:22 INFO - GECKO(5660) | #40 0x7fff566e2e62 in PrepareAndDispatch z:\build\build\src\xpcom\reflect\xptcall\md\win32\xptcstubs_x86_64.cpp:173 15:40:22 INFO - GECKO(5660) | #41 0x7fff6628e488 in SharedStub (Z:\task_1529421273\build\application\firefox\xul.dll+0x18fe8e488) 15:40:22 INFO - GECKO(5660) | #42 0x7fff566477b7 in NS_CreateServicesFromCategory(char const *,class nsISupports *,char const *,UNKNOWN const *) z:\build\build\src\xpcom\components\nsCategoryManager.cpp:810 15:40:22 INFO - GECKO(5660) | #43 0x7fff63aefe39 in nsXREDirProvider::DoStartup(void) z:\build\build\src\toolkit\xre\nsXREDirProvider.cpp:999 15:40:22 INFO - GECKO(5660) | #44 0x7fff63ab8bac in XREMain::XRE_mainRun(void) z:\build\build\src\toolkit\xre\nsAppRunner.cpp:4574 15:40:22 INFO - GECKO(5660) | #45 0x7fff63abedb4 in XREMain::XRE_main(int,char * * const,struct mozilla::BootstrapConfig const &) z:\build\build\src\toolkit\xre\nsAppRunner.cpp:4891 15:40:22 INFO - GECKO(5660) | #46 0x7fff63ac12c0 in XRE_main(int,char * * const,struct mozilla::BootstrapConfig const &) z:\build\build\src\toolkit\xre\nsAppRunner.cpp:4983 15:40:22 INFO - GECKO(5660) | #47 0x7ff6b1681e3d (Z:\task_1529421273\build\application\firefox\firefox.exe+0x140001e3d) 15:40:22 INFO - GECKO(5660) | #48 0x7ff6b1681529 (Z:\task_1529421273\build\application\firefox\firefox.exe+0x140001529) 15:40:22 INFO - GECKO(5660) | #49 0x7ff6b177ac87 (Z:\task_1529421273\build\application\firefox\firefox.exe+0x1400fac87) 15:40:22 INFO - GECKO(5660) | #50 0x7fff8a5c2773 (C:\Windows\System32\KERNEL32.DLL+0x180012773) 15:40:22 INFO - GECKO(5660) | #51 0x7fff8ceb0d60 (C:\Windows\SYSTEM32\ntdll.dll+0x180070d60) 15:40:22 INFO - GECKO(5660) | ==5660==ABORTING
Is this really a UAF? I'm not too experienced reading ASAN logs, but to me this appears to be a buffer overflow? If this -is- a UAF it likely has the same underlying cause as bug 1467363 (although it would still be a subtly different bug).
Flags: needinfo?(aryx.bugmail)
Oops, sorry.
Flags: needinfo?(aryx.bugmail)
Keywords: csectype-uaf
UAFs do sometimes show up as buffer overflows in ASan, for whatever reason. Note also bug 1414865, which is a crash in the same method. I looked at two of the failure logs, and they had allocator poison values in some registers.
Keywords: csectype-bounds, sec-high
There's widget stuff in the stack, so I'll just assume that it is a related issue that can't easily be triggered from content.
Keywords: sec-high → sec-moderate

Closing some ancient sec-moderate intermittent failures.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.