Closed Bug 1575584 Opened 5 years ago Closed 5 years ago

load of value, which is not a valid value for type 'bool' in /src/editor/libeditor/TextEditor.cpp:1889

Tracking

()

Status:

RESOLVED FIXED

Milestone:

mozilla70

Tracking Flags:

Tracking

Status

firefox70

---

fixed

People

(Reporter: tsmith, Assigned: mbrodesser-Igalia)

References

(Blocks 2 open bugs)

Details

(Keywords: csectype-undefined, csectype-uninitialized)

Attachments

(1 file)

Bug 1575584: prevent reading uninitialized variable in `TextEditor::ComputeValueInternal`. r=masayuki 5 years ago Mirko Brodesser (:mbrodesser-Igalia), offline until 10th of Feb 47 bytes, text/x-phabricator-request		Details \| Review

Tyson Smith [:tsmith]

Reporter

Description

•

5 years ago

This issue was found while fuzzing m-c: 20190820-0dc91d87721b
Unfortuanaly a test case that can consistently reproduce this issue is not avaialble.

-fsanitize=bool was used to enable this check. It is enabled by default in ASan fuzzing builds.

/src/editor/libeditor/TextEditor.cpp:1889:7: runtime error: load of value 96, which is not a valid value for type 'bool'
    #0 0x7fc4c9e293f8 in mozilla::TextEditor::ComputeValueInternal(nsTSubstring<char16_t> const&, unsigned int, nsTSubstring<char16_t>&) const /src/editor/libeditor/TextEditor.cpp:1889:7
    #1 0x7fc4c7c0b685 in ComputeTextValue /src/obj-firefox/dist/include/mozilla/TextEditor.h:343:19
    #2 0x7fc4c7c0b685 in nsTextEditorState::GetValue(nsTSubstring<char16_t>&, bool) const /src/dom/html/nsTextEditorState.cpp:2114
    #3 0x7fc4c7c08284 in nsTextEditorState::PrepareEditor(nsTSubstring<char16_t> const*) /src/dom/html/nsTextEditorState.cpp:1332:5
    #4 0x7fc4c7c1669c in PrepareEditorEvent::Run() /src/dom/html/nsTextEditorState.cpp:1157:13
    #5 0x7fc4c44cd1ec in nsContentUtils::RemoveScriptBlocker() /src/dom/base/nsContentUtils.cpp:5179:15
    #6 0x7fc4ca09d754 in ~nsAutoScriptBlocker /src/obj-firefox/dist/include/nsContentUtils.h:3344:28
    #7 0x7fc4ca09d754 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /src/layout/base/PresShell.cpp:4120
    #8 0x7fc4c482dc09 in FlushPendingNotifications /src/obj-firefox/dist/include/mozilla/PresShell.h:1445:5
    #9 0x7fc4c482dc09 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /src/dom/base/Document.cpp:9982
    #10 0x7fc4c458f019 in FlushPendingNotifications /src/dom/base/nsGlobalWindowInner.cpp:5958:11
    #11 0x7fc4c458f019 in nsGlobalWindowInner::ScrollTo(mozilla::dom::ScrollToOptions const&) /src/dom/base/nsGlobalWindowInner.cpp:3574
    #12 0x7fc4c64ecdac in mozilla::dom::Window_Binding::scroll(JSContext*, JS::Handle<JSObject*>, nsGlobalWindowInner*, JSJitMethodCallArgs const&) /src/obj-firefox/dom/bindings/WindowBinding.cpp:4556:28
    #13 0x7fc4c7065c27 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /src/dom/bindings/BindingUtils.cpp:3163:13
    #14 0x7fc4cdc26ed7 in CallJSNative /src/js/src/vm/Interpreter.cpp:447:13
    #15 0x7fc4cdc26ed7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:539
    #16 0x7fc4cdc0f17c in CallFromStack /src/js/src/vm/Interpreter.cpp:598:10
    #17 0x7fc4cdc0f17c in Interpret(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:3084
    #18 0x7fc4cdbf081f in js::RunScript(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:424:10
    #19 0x7fc4cdc279df in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:567:13
    #20 0x7fc4cdc29c02 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /src/js/src/vm/Interpreter.cpp:610:8
    #21 0x7fc4ce735aa8 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /src/js/src/jsapi.cpp:2722:10
    #22 0x7fc4c68c8124 in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:267:37
    #23 0x7fc4c782ca11 in Call<nsCOMPtr<mozilla::dom::EventTarget> > /src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:363:12
    #24 0x7fc4c782ca11 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /src/dom/events/JSEventHandler.cpp:205
    #25 0x7fc4c77f0ffc in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /src/dom/events/EventListenerManager.cpp:1039:22
    #26 0x7fc4c77f2a40 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /src/dom/events/EventListenerManager.cpp:1231:17
    #27 0x7fc4c77d959a in HandleEvent /src/obj-firefox/dist/include/mozilla/EventListenerManager.h:353:5
    #28 0x7fc4c77d959a in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:349
    #29 0x7fc4c77d7db2 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:551:16
    #30 0x7fc4c77dd77b in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /src/dom/events/EventDispatcher.cpp:1047:11
    #31 0x7fc4c77e47f0 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /src/dom/events/EventDispatcher.cpp
    #32 0x7fc4c4b1f0fa in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /src/dom/base/nsINode.cpp:1061:17
    #33 0x7fc4c7800823 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /src/dom/events/EventTarget.cpp:178:13
    #34 0x7fc4c776de56 in mozilla::AsyncEventDispatcher::Run() /src/dom/events/AsyncEventDispatcher.cpp:69:12
    #35 0x7fc4c44cdbd5 in AddScriptRunner /src/dom/base/nsContentUtils.cpp:5246:13
    #36 0x7fc4c44cdbd5 in nsContentUtils::AddScriptRunner(nsIRunnable*) /src/dom/base/nsContentUtils.cpp:5252
    #37 0x7fc4c776ec83 in mozilla::AsyncEventDispatcher::RunDOMEventWhenSafe() /src/dom/events/AsyncEventDispatcher.cpp:99:3
    #38 0x7fc4c44c24ec in nsContentUtils::DispatchInputEvent(mozilla::dom::Element*, mozilla::EditorInputType, mozilla::TextEditor*, nsContentUtils::InputEventOptions const&) /src/dom/base/nsContentUtils.cpp:4164:9
    #39 0x7fc4c9c1705d in mozilla::EditorBase::FireInputEvent(mozilla::EditAction, nsTSubstring<char16_t> const&, mozilla::dom::DataTransfer*) /src/editor/libeditor/EditorBase.cpp:2189:35
    #40 0x7fc4c9c16da4 in mozilla::EditorBase::FireInputEvent() /src/editor/libeditor/EditorBase.cpp:2169:3
    #41 0x7fc4c9c0468c in mozilla::EditorBase::NotifyEditorObservers(mozilla::EditorBase::NotificationForEditorObservers) /src/editor/libeditor/EditorBase.cpp:2139:7
    #42 0x7fc4c9c04e2b in mozilla::EditorBase::EndPlaceholderTransaction() /src/editor/libeditor/EditorBase.cpp:954:9
    #43 0x7fc4c9e1b393 in ~AutoPlaceholderBatch /src/obj-firefox/dist/include/mozilla/EditorBase.h:2400:44
    #44 0x7fc4c9e1b393 in mozilla::TextEditor::DeleteSelectionAsAction(short, short, nsIPrincipal*) /src/editor/libeditor/TextEditor.cpp:641
    #45 0x7fc4c47ec601 in mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&) /src/dom/base/Document.cpp:4610:26
    #46 0x7fc4c6910bb7 in mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Document*, JSJitMethodCallArgs const&) /src/obj-firefox/dom/bindings/DocumentBinding.cpp:3579:36
    #47 0x7fc4c70640dd in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /src/dom/bindings/BindingUtils.cpp:3163:13
    #48 0x7fc4cdc26ed7 in CallJSNative /src/js/src/vm/Interpreter.cpp:447:13
    #49 0x7fc4cdc26ed7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:539
    #50 0x7fc4cdc0f17c in CallFromStack /src/js/src/vm/Interpreter.cpp:598:10
    #51 0x7fc4cdc0f17c in Interpret(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:3084
    #52 0x7fc4cdbf081f in js::RunScript(JSContext*, js::RunState&) /src/js/src/vm/Interpreter.cpp:424:10
    #53 0x7fc4cdc279df in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /src/js/src/vm/Interpreter.cpp:567:13
    #54 0x7fc4cdc29c02 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /src/js/src/vm/Interpreter.cpp:610:8
    #55 0x7fc4ce735aa8 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /src/js/src/jsapi.cpp:2722:10
    #56 0x7fc4c68c8124 in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:267:37
    #57 0x7fc4c782ca11 in Call<nsCOMPtr<mozilla::dom::EventTarget> > /src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:363:12
    #58 0x7fc4c782ca11 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /src/dom/events/JSEventHandler.cpp:205
    #59 0x7fc4c77f0ffc in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /src/dom/events/EventListenerManager.cpp:1039:22
    #60 0x7fc4c77f2a40 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /src/dom/events/EventListenerManager.cpp:1231:17
    #61 0x7fc4c77d959a in HandleEvent /src/obj-firefox/dist/include/mozilla/EventListenerManager.h:353:5
    #62 0x7fc4c77d959a in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:349
    #63 0x7fc4c77d7db2 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /src/dom/events/EventDispatcher.cpp:551:16
    #64 0x7fc4c77dd77b in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /src/dom/events/EventDispatcher.cpp:1047:11
    #65 0x7fc4c77e47f0 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /src/dom/events/EventDispatcher.cpp
    #66 0x7fc4c4b1f0fa in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /src/dom/base/nsINode.cpp:1061:17
    #67 0x7fc4c7800823 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /src/dom/events/EventTarget.cpp:178:13
    #68 0x7fc4c776de56 in mozilla::AsyncEventDispatcher::Run() /src/dom/events/AsyncEventDispatcher.cpp:69:12
    #69 0x7fc4c44cdbd5 in AddScriptRunner /src/dom/base/nsContentUtils.cpp:5246:13
    #70 0x7fc4c44cdbd5 in nsContentUtils::AddScriptRunner(nsIRunnable*) /src/dom/base/nsContentUtils.cpp:5252
    #71 0x7fc4c776ec83 in mozilla::AsyncEventDispatcher::RunDOMEventWhenSafe() /src/dom/events/AsyncEventDispatcher.cpp:99:3
    #72 0x7fc4c47cf346 in mozilla::dom::Document::SetReadyStateInternal(mozilla::dom::Document::ReadyState, bool) /src/dom/base/Document.cpp:11177:20
    #73 0x7fc4c4a55d50 in nsContentSink::DidBuildModelImpl(bool) /src/dom/base/nsContentSink.cpp:1410:16
    #74 0x7fc4c33c3b7f in nsHtml5TreeOpExecutor::DidBuildModel(bool) /src/parser/html/nsHtml5TreeOpExecutor.cpp:171:3
    #75 0x7fc4c3325f59 in nsHtml5Parser::Terminate() /src/parser/html/nsHtml5Parser.cpp:475:20
    #76 0x7fc4ca18dc7c in nsDocumentViewer::Stop() /src/layout/base/nsDocumentViewer.cpp:1925:16
    #77 0x7fc4ccd4de36 in nsDocShell::Stop(unsigned int) /src/docshell/base/nsDocShell.cpp:4634:11
    #78 0x7fc4ccd600ef in nsDocShell::Destroy() /src/docshell/base/nsDocShell.cpp:4908:3
    #79 0x7fc4cd3ac1bd in nsWebBrowser::SetDocShell(nsIDocShell*) /src/toolkit/components/browser/nsWebBrowser.cpp:1263:23
    #80 0x7fc4cd3aa62c in nsWebBrowser::InternalDestroy() /src/toolkit/components/browser/nsWebBrowser.cpp:205:3
    #81 0x7fc4cd3b4eac in Destroy /src/toolkit/components/browser/nsWebBrowser.cpp:934:3
    #82 0x7fc4cd3b4eac in non-virtual thunk to nsWebBrowser::Destroy() /src/toolkit/components/browser/nsWebBrowser.cpp
    #83 0x7fc4c9068677 in mozilla::dom::BrowserChild::DestroyWindow() /src/dom/ipc/BrowserChild.cpp:992:31
    #84 0x7fc4c9085fba in mozilla::dom::BrowserChild::RecvDestroy() /src/dom/ipc/BrowserChild.cpp:2400:3
    #85 0x7fc4c282e608 in mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) /src/obj-firefox/ipc/ipdl/PBrowserChild.cpp:6096:56
    #86 0x7fc4c1c648ba in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /src/obj-firefox/ipc/ipdl/PContentChild.cpp:7874:32
    #87 0x7fc4c19012a6 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /src/ipc/glue/MessageChannel.cpp:2184:25
    #88 0x7fc4c18fc00b in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /src/ipc/glue/MessageChannel.cpp:2108:9
    #89 0x7fc4c18fe5c7 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /src/ipc/glue/MessageChannel.cpp:1955:3
    #90 0x7fc4c18ff457 in mozilla::ipc::MessageChannel::MessageTask::Run() /src/ipc/glue/MessageChannel.cpp:1986:13
    #91 0x7fc4c06ddaf1 in mozilla::SchedulerGroup::Runnable::Run() /src/xpcom/threads/SchedulerGroup.cpp:295:32
    #92 0x7fc4c070fa40 in nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1225:14
    #93 0x7fc4c0715a88 in NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:486:10
    #94 0x7fc4c190a68f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:88:21
    #95 0x7fc4c18056f2 in RunInternal /src/ipc/chromium/src/base/message_loop.cc:315:10
    #96 0x7fc4c18056f2 in RunHandler /src/ipc/chromium/src/base/message_loop.cc:308
    #97 0x7fc4c18056f2 in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:290
    #98 0x7fc4c9a99229 in nsBaseAppShell::Run() /src/widget/nsBaseAppShell.cpp:137:27
    #99 0x7fc4cd96e88f in XRE_RunAppShell() /src/toolkit/xre/nsEmbedFunctions.cpp:934:20
    #100 0x7fc4c18056f2 in RunInternal /src/ipc/chromium/src/base/message_loop.cc:315:10
    #101 0x7fc4c18056f2 in RunHandler /src/ipc/chromium/src/base/message_loop.cc:308
    #102 0x7fc4c18056f2 in MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:290
    #103 0x7fc4cd96e136 in XRE_InitChildProcess(int, char**, XREChildData const*) /src/toolkit/xre/nsEmbedFunctions.cpp:769:34
    #104 0x55cfe1dd0d73 in content_process_main /src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #105 0x55cfe1dd0d73 in main /src/browser/app/nsBrowserApp.cpp:267

Henri Sivonen (:hsivonen) (not reading bugmail until 2025-02-06)

Comment 1

•

5 years ago

Mirko, could you, please, take a look? I suspect that there's some case where we declare a bool but fail to initialize it and as a result, we end up with unintialized garbage in a bool.

Flags: needinfo?(mbrodesser)

Priority: -- → P2

Mirko Brodesser (:mbrodesser-Igalia), offline until 10th of Feb

Assignee

Comment 2

•

5 years ago

•

Edited

The problem is around https://searchfox.org/mozilla-central/source/editor/libeditor/TextEditor.cpp#1889:

  bool cancel, handled;
  nsresult rv = rules->WillDoAction(subActionInfo, &cancel, &handled);
  if (cancel || NS_FAILED(rv)) {

WillDoAction may return an error before assigning values to cancel and handled. We need to swap the checks in

  if (cancel || NS_FAILED(rv)) {

Additionally, we should assign default values to cancel and handled.

Flags: needinfo?(mbrodesser)

Mirko Brodesser (:mbrodesser-Igalia), offline until 10th of Feb

Assignee

Updated

•

5 years ago

Assignee: nobody → mbrodesser

Mirko Brodesser (:mbrodesser-Igalia), offline until 10th of Feb

Assignee

Comment 3

•

5 years ago

Attached file Bug 1575584: prevent reading uninitialized variable in `TextEditor::ComputeValueInternal`. r=masayuki — Details

The fix here is to first check NS_FAILED(rv), because if that's the
case, cancel wasn't necessarily set to a value.

As best practice I initialized cancel and handled with default
values.

Pulsebot

Comment 4

•

5 years ago

Pushed by mbrodesser@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/c8fcbaade215 prevent reading uninitialized variable in `TextEditor::ComputeValueInternal`. r=masayuki

Natalia Csoregi [:nataliaCs]

Comment 5

•

5 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/c8fcbaade215

Status: NEW → RESOLVED

Closed: 5 years ago

status-firefox70: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla70

You need to log in before you can comment on or make changes to this bug.

Bugzilla

load of value, which is not a valid value for type 'bool' in /src/editor/libeditor/TextEditor.cpp:1889

Categories

(Core :: DOM: Editor, defect, P2)

Tracking

()

People

(Reporter: tsmith, Assigned: mbrodesser-Igalia)

References

(Blocks 2 open bugs)

Details

(Keywords: csectype-undefined, csectype-uninitialized)

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Comment 1

Comment 2

Updated

Comment 3

Comment 4

Comment 5

Attachment

General

Description

File Name

Content Type