1509507 - Crash in encoding_rs::utf_8::Utf8Decoder::decode_to_utf16_raw

Status: RESOLVED FIXED

(Core :: Internationalization, defect)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-3ddf8112-4b1a-4225-92eb-4c4690181123.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll ?MOZ_CrashOOL@@[e-mail].17252753682276159622 mfbt/Assertions.h:311
1 xul.dll GeckoCrashOOL toolkit/xre/nsAppRunner.cpp:5350
2 xul.dll static void gkrust_shared::panic_hook toolkit/library/rust/shared/lib.rs:234
3 xul.dll static void core::ops::function::Fn::call<fn /libcore/ops/function.rs:78
4 xul.dll static void std::panicking::rust_panic_with_hook /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libstd/panicking.rs:481
5 xul.dll static void std::panicking::continue_panic_fmt /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libstd/panicking.rs:391
6 xul.dll static void std::panicking::rust_begin_panic /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libstd/panicking.rs:326
7 xul.dll static void core::panicking::panic_fmt /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libcore/panicking.rs:77
8 xul.dll static void core::panicking::panic_bounds_check /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libcore/panicking.rs:59
9 xul.dll static struct  third_party/rust/encoding_rs/src/macros.rs:70

=============================================================

There are 22 crashes (from 21 installations) in nightly 65 starting with buildid 20181122220059. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1507726.

[1] https://hg.mozilla.org/mozilla-central/rev?node=3691033d6e78

Comment 1

[Henri Sivonen (:hsivonen)]

This code withstood a few days of fuzzing before landing. This is a panic, so safe code is in an unexpected state.

I don't have access to crash report URLs. Steps to reproduce would be really helpful. Meanwhile, I'll run the fuzzer some more.

Comment 2

[Henri Sivonen (:hsivonen)]

(In reply to Henri Sivonen (:hsivonen) from comment #1)
> This is a panic,
> so safe code is in an unexpected state.

Specifically: index out of bounds: the len is 1024 but the index is 1024

Comment 3

[Henri Sivonen (:hsivonen)]

1024 is the size of the output buffer, in UTF-16 code units, in the HTML parser, so chances are this is a write to the output slice.

Comment 5

[Henri Sivonen (:hsivonen)]

Attachment: Bug 1509507 - Update to encoding_rs 0.8.13 to fix a panic in UTF-8 to UTF-16 decode.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e9eedbf1bd4b
Update to encoding_rs 0.8.13 to fix a panic in UTF-8 to UTF-16 decode. r=m_kato

Comment 8

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/e9eedbf1bd4b

Comment 9

[Intermittent Failures Robot]

1 failures in 2808 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:
* autoland: 1

Platform breakdown:
* android-em-7-0-x86: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1509507&startday=2018-11-26&endday=2018-12-02&tree=all