1493957 - SUMMARY: AddressSanitizer: stack-overflow near [@ AddAndRemoveImageAssociations]

Status: NEW

(Core :: Layout, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev c5a9878baf35.

==4609==ERROR: AddressSanitizer: stack-overflow on address 0x7ffca18ccdc8 (pc 0x557451e9363f bp 0x7ffca18cd610 sp 0x7ffca18ccdc0 T0)
    #0 0x557451e9363e in BufferedStackTrace /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_stacktrace.h:94:37
    #1 0x557451e9363e in malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88
    #2 0x557451ec4aad in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:70:17
    #3 0x7efdab930118 in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:139:12
    #4 0x7efdab930118 in _M_init_functor /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/functional:1955
    #5 0x7efdab930118 in _M_init_functor /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/functional:1926
    #6 0x7efdab930118 in function<(lambda at /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:904:5), void> /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/functional:2427
    #7 0x7efdab930118 in AddAndRemoveImageAssociations /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:904
    #8 0x7efdab930118 in nsFrame::DidSetComputedStyle(mozilla::ComputedStyle*) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:1081
    #9 0x7efdab927583 in nsFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /builds/worker/workspace/build/src/layout/generic/nsFrame.cpp:707:3
    #10 0x7efdabbf5522 in nsSplittableFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /builds/worker/workspace/build/src/layout/generic/nsSplittableFrame.cpp:23:12
    #11 0x7efdab924678 in Init /builds/worker/workspace/build/src/layout/generic/nsContainerFrame.cpp:59:22
    #12 0x7efdab924678 in nsBlockFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /builds/worker/workspace/build/src/layout/generic/nsBlockFrame.cpp:7080
    #13 0x7efdab6d513b in InitAndRestoreFrame /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:4778:14
    #14 0x7efdab6d513b in nsCSSFrameConstructor::InitAndWrapInColumnSetFrameIfNeeded(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10940
    #15 0x7efdab6ccab6 in nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameItems&, nsIFrame*, PendingBinding*) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:10977:5
    #16 0x7efdab6dee7c in ConstructNonScrollableBlockWithConstructor /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:4758:3
    #17 0x7efdab6dee7c in nsCSSFrameConstructor::ConstructNonScrollableBlock(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameItems&) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:4722
    #18 0x7efdab6d98d2 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameItems&) /builds/worker/workspace/build/src/layout/base/nsCSSFrameConstructor.cpp:3788:7
...truncated...

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: ASAN output

Comment 2

[Cameron McCormack (:heycam)]

Frame construction of heavily nested custom elements.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Hmm... I'm not quite sure this is different than what you could do without custom elements... I'll take a look.

Comment 4

[Emilio Cobos Álvarez (:emilio)]

So this is a huge frame constructor stack (but still below the current hard limit, which is 400) mixed with a huge JS stack caused by the constructor being called synchronously from itself via innerHTML...

Olli, do you have any idea of what to make out of this other than trying to reduce stack limits on one of the two places?

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

nope. hsivonen was talking about some tree depth limitation thing in parser recently.

Comment 6

[Andrei Purice]

Hey Jason,
Can you still reproduce this issue or should we close it?

Comment 7

[Jason Kratzer [:jkratzer]]

(In reply to Andrei Purice from comment #6)

Hey Jason,
Can you still reproduce this issue or should we close it?

Andrei, this issue still reproduces on mozilla-central rev 152fdda295bb (built with --enable-address-sanitzer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 152fdda295bb --asan --fuzzing -n build
$ python -m grizzly.replay ./build/firefox ./testcase.html

Comment 8

[Daniel Holbert [:dholbert]]

Based on analysis in Comment 4, this sounds more like S3 than S2. (Seems like stack exhaustion, i.e. a safe crash, with a fuzzer testcase.)

Comment 9

[Daniel Holbert [:dholbert]]

I captured a pernosco trace, too (in an -enable-address-sanitzer --enable-fuzzing debug+opt build): https://pernos.co/debug/z94E8jSHc4MGkCcGX-7Igw/index.html