1577229 - AddressSanitizer: ABRT /build/glibc-OTsEL5/glibc-2.27/signal/../sysdeps/unix/sysv/linux/nptl-signals.h:80 in __libc_signal_restore_set

Status: NEW

(Core :: Graphics: CanvasWebGL, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 546d1fd47c9a.

==12861==ERROR: AddressSanitizer: ABRT on unknown address 0x03e80000323d (pc 0x7f4eaa71ae97 bp 0x7f4eaa8937d8 sp 0x7ffc1919e690 T0)
    #0 0x7f4eaa71ae96 in __libc_signal_restore_set /build/glibc-OTsEL5/glibc-2.27/signal/../sysdeps/unix/sysv/linux/nptl-signals.h:80
    #1 0x7f4eaa71ae96 in gsignal /build/glibc-OTsEL5/glibc-2.27/signal/../sysdeps/unix/sysv/linux/raise.c:48
    #2 0x7f4eaa71c800 in abort /build/glibc-OTsEL5/glibc-2.27/stdlib/abort.c:79
    #3 0x7f4eaa70c399 in __assert_fail_base /build/glibc-OTsEL5/glibc-2.27/assert/assert.c:92
    #4 0x7f4eaa70c411 in __assert_fail /build/glibc-OTsEL5/glibc-2.27/assert/assert.c:101
    #5 0x7f4e73efc50d  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x4d450d)
    #6 0x7f4e73fd53b4  (/usr/lib/x86_64-linux-gnu/dri/swrast_dri.so+0x5ad3b4)
    #7 0x7f4e8fa2239c in fGenerateMipmap /builds/worker/workspace/build/src/gfx/gl/GLContext.h:1260:5
    #8 0x7f4e8fa2239c in mozilla::WebGLTexture::GenerateMipmap() /builds/worker/workspace/build/src/dom/canvas/WebGLTexture.cpp:814
    #9 0x7f4e8f95873b in mozilla::WebGLContext::GenerateMipmap(unsigned int) /builds/worker/workspace/build/src/dom/canvas/WebGLContextTextures.cpp:235:8
    #10 0x7f4e8eabd398 in mozilla::dom::WebGL2RenderingContext_Binding::generateMipmap(JSContext*, JS::Handle<JSObject*>, mozilla::WebGL2Context*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WebGL2RenderingContextBinding.cpp:12674:24
    #11 0x7f4e8f77179d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3163:13
    #12 0x7f4e9636df07 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:447:13
    #13 0x7f4e9636df07 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:539
    #14 0x7f4e963561ac in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:598:10
    #15 0x7f4e963561ac in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3084
    #16 0x7f4e9633784f in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:424:10
    #17 0x7f4e9636ea0f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:567:13
    #18 0x7f4e96370c32 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:610:8
    #19 0x7f4e96e82368 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2722:10
    #20 0x7f4e8f196e02 in mozilla::dom::Function::Call(JSContext*, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/FunctionBinding.cpp:41:8
    #21 0x7f4e8d09e8cf in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject> >(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/FunctionBinding.h:73:12
    #22 0x7f4e8d09e281 in mozilla::dom::CallbackTimeoutHandler::Call(char const*) /builds/worker/workspace/build/src/dom/base/TimeoutHandler.cpp:181:29
    #23 0x7f4e8cc591aa in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) /builds/worker/workspace/build/src/dom/base/nsGlobalWindowInner.cpp:5901:38
    #24 0x7f4e8d09835c in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /builds/worker/workspace/build/src/dom/base/TimeoutManager.cpp:894:44
    #25 0x7f4e8d096f55 in mozilla::dom::TimeoutExecutor::MaybeExecute() /builds/worker/workspace/build/src/dom/base/TimeoutExecutor.cpp:179:11
    #26 0x7f4e8d09aba6 in Notify /builds/worker/workspace/build/src/dom/base/TimeoutExecutor.cpp:246:5
    #27 0x7f4e8d09aba6 in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /builds/worker/workspace/build/src/dom/base/TimeoutExecutor.cpp
    #28 0x7f4e88d8f81c in nsTimerImpl::Fire(int) /builds/worker/workspace/build/src/xpcom/threads/nsTimerImpl.cpp:564:39
    #29 0x7f4e88d8efc9 in nsTimerEvent::Run() /builds/worker/workspace/build/src/xpcom/threads/TimerThread.cpp:260:11
    #30 0x7f4e88dbd5e4 in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /builds/worker/workspace/build/src/xpcom/threads/ThrottledEventQueue.cpp:252:22
    #31 0x7f4e88db7eaf in mozilla::ThrottledEventQueue::Inner::Executor::Run() /builds/worker/workspace/build/src/xpcom/threads/ThrottledEventQueue.cpp:80:15
    #32 0x7f4e88d70451 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:295:32
    #33 0x7f4e88da23a0 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1225:14
    #34 0x7f4e88da83e8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
    #35 0x7f4e89fa6024 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:110:5
    #36 0x7f4e89ea1202 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #37 0x7f4e89ea1202 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
    #38 0x7f4e89ea1202 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
    #39 0x7f4e921b8d99 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #40 0x7f4e960b68df in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:934:20
    #41 0x7f4e89ea1202 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #42 0x7f4e89ea1202 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
    #43 0x7f4e89ea1202 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
    #44 0x7f4e960b6186 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:769:34
    #45 0x55c05e711d73 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #46 0x55c05e711d73 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:267
    #47 0x7f4eaa6fdb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT /build/glibc-OTsEL5/glibc-2.27/signal/../sysdeps/unix/sysv/linux/nptl-signals.h:80 in __libc_signal_restore_set

Comment 1

[Jason Kratzer [:jkratzer]]

Testcase bisects to the following commit:
https://hg.mozilla.org/mozilla-central/rev/28a4562cb5173c543cce6b58480ac80fcce3763a

Comment 2

[Aria Beingessner [:Gankra]]

Hey Jeff, how serious does this look? Something we need to prioritize? Something we can fix easily?

(yes, there's two fuzzing bugs, you're not hallucinating)