1477324 - AddressSanitizer: heap-use-after-free [@ _cairo_user_data_array_get_data] with READ of size 8

Status: RESOLVED DUPLICATE of bug 1476952

(Core :: Graphics, defect)

Description

[Christian Holler (:decoder)]

The attached crash information was submitted via the ASan Nightly Reporter on mozilla-central-asan-nightly revision 63.0a1-20180719220047-https://hg.mozilla.org/mozilla-central/rev/690cb3015db6645b335ac4835a50073cb6a3e23c.

For detailed crash information, see attachment.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Alex Gaynor [:Alex_Gaynor]]

This looks like it's probably the same as bug 1476952.

Comment 3

[Daniel Veditz [:dveditz]]

agreed. Duping because they're equivalent ASAN traces. If the older bug were just a crash-stats report with no investigation I'd probably dupe the other way.

Comment 4

[Christian Holler (:decoder)]

When you find some time, it would be very helpful if you could answer the following questions so I can work on improving ASan Nightly further. In particular, many of the reports we saw about use-after-free were sent only once, not multiple times. So I'm asking myself what changes to ASan Nightly I can make to improve overall uaf detection rate:

1) Do you think more frequent GC/CC would have helped detecting this problem more frequently?

2) Do you think GC/CC on specific DOM events (e.g. beforeunload, pagehide, DOMContentLoaded) would have helped?

3) Do you think triggering the event loop in the specific child processes would have helped here? (e.g. dummy XMLHttpRequest onbeforeunload, useful in fuzzing).

4) Do you have any other ideas to reproduce this particular problem better or do you think any of the above points (or other approaches) might help to find other use-after-free issues in areas that you work in?

Any feedback would be greatly appreciated. Thanks!


(This bug was fixed somewhere else and also found in fuzzing, but I would still like to find out if we can detect this or similar problems better in ASan Nightly as well).

Comment 5

[Lee Salzman [:lsalzman]]

(In reply to Christian Holler (:decoder) from comment #4)
> When you find some time, it would be very helpful if you could answer the
> following questions so I can work on improving ASan Nightly further. In
> particular, many of the reports we saw about use-after-free were sent only
> once, not multiple times. So I'm asking myself what changes to ASan Nightly
> I can make to improve overall uaf detection rate:
> 
> 1) Do you think more frequent GC/CC would have helped detecting this problem
> more frequently?
> 
> 2) Do you think GC/CC on specific DOM events (e.g. beforeunload, pagehide,
> DOMContentLoaded) would have helped?
> 
> 3) Do you think triggering the event loop in the specific child processes
> would have helped here? (e.g. dummy XMLHttpRequest onbeforeunload, useful in
> fuzzing).
> 
> 4) Do you have any other ideas to reproduce this particular problem better
> or do you think any of the above points (or other approaches) might help to
> find other use-after-free issues in areas that you work in?
> 
> Any feedback would be greatly appreciated. Thanks!
> 
> 
> (This bug was fixed somewhere else and also found in fuzzing, but I would
> still like to find out if we can detect this or similar problems better in
> ASan Nightly as well).

This was a race condition unaffected by the above suggestions.

Comment 6

[Liz Henry (:lizzard) (relman/hg->git project)]

Removing the affected flag for 63 based on comments here and bug 1476952. It was likely fixed in another issue.