1583238 - AddressSanitizer: SEGV /builds/worker/workspace/build/src/dom/canvas/ImageBitmap.cpp:1352:56 in mozilla::dom::ImageBitmap::WriteStructuredClone(JSStructuredCloneWriter*, nsTArray<RefPtr<mozilla::gfx::DataSourceSurface> >&, mozilla::dom::ImageBitmap*)

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 07eb2cc7e1c3.

==11769==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f1685823053 bp 0x7fff7fedeeb0 sp 0x7fff7feded80 T0)
==11769==The signal is caused by a READ memory access.
==11769==Hint: address points to the zero page.
    #0 0x7f1685823052 in mozilla::dom::ImageBitmap::WriteStructuredClone(JSStructuredCloneWriter*, nsTArray<RefPtr<mozilla::gfx::DataSourceSurface> >&, mozilla::dom::ImageBitmap*) /builds/worker/workspace/build/src/dom/canvas/ImageBitmap.cpp:1352:56
    #1 0x7f1682f14de7 in mozilla::dom::StructuredCloneHolder::CustomWriteHandler(JSContext*, JSStructuredCloneWriter*, JS::Handle<JSObject*>) /builds/worker/workspace/build/src/dom/base/StructuredCloneHolder.cpp:969:14
    #2 0x7f168c359493 in JSStructuredCloneWriter::startWrite(JS::Handle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/StructuredClone.cpp:1731:14
    #3 0x7f168c34d406 in JSStructuredCloneWriter::write(JS::Handle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/StructuredClone.cpp:1928:8
    #4 0x7f168c34ce3d in WriteStructuredClone(JSContext*, JS::Handle<JS::Value>, JSStructuredCloneData*, JS::StructuredCloneScope, JS::CloneDataPolicy, JSStructuredCloneCallbacks const*, void*, JS::Value const&) /builds/worker/workspace/build/src/js/src/vm/StructuredClone.cpp:631:10
    #5 0x7f168c372aba in JS_WriteStructuredClone /builds/worker/workspace/build/src/js/src/vm/StructuredClone.cpp:3034:10
    #6 0x7f168c372aba in JSAutoStructuredCloneBuffer::write(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::CloneDataPolicy, JSStructuredCloneCallbacks const*, void*) /builds/worker/workspace/build/src/js/src/vm/StructuredClone.cpp:3163
    #7 0x7f1682f0ec56 in mozilla::dom::StructuredCloneHolderBase::Write(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::CloneDataPolicy) /builds/worker/workspace/build/src/dom/base/StructuredCloneHolder.cpp:183:17
    #8 0x7f1682f0f06d in mozilla::dom::StructuredCloneHolder::Write(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::CloneDataPolicy, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/base/StructuredCloneHolder.cpp:264:35
    #9 0x7f168787ead1 in mozilla::dom::Worker::PostMessage(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Sequence<JSObject*> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/workers/Worker.cpp:103:13
    #10 0x7f1684b7d217 in mozilla::dom::Worker_Binding::postMessage(JSContext*, JS::Handle<JSObject*>, mozilla::dom::Worker*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/WorkerBinding.cpp:609:28
    #11 0x7f16856dce9d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3168:13
    #12 0x7f168c3143f8 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:458:13
    #13 0x7f168c3143f8 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:551
    #14 0x7f168c2fc7b0 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:624:10
    #15 0x7f168c2fc7b0 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3113
    #16 0x7f168c2de60f in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:424:10
    #17 0x7f168c314ea5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:592:13
    #18 0x7f168c3171c9 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:637:8
    #19 0x7f168c4e6499 in Call /builds/worker/workspace/build/src/js/src/vm/Interpreter.h:107:10
    #20 0x7f168c4e6499 in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Promise.cpp:1703
    #21 0x7f168c3143f8 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:458:13
    #22 0x7f168c3143f8 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:551
    #23 0x7f168c3171c9 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:637:8
    #24 0x7f168ce8281b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2728:10
    #25 0x7f1683c396c6 in mozilla::dom::PromiseJobCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/PromiseBinding.cpp:26:8
    #26 0x7f167e9f8110 in Call /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/PromiseBinding.h:91:12
    #27 0x7f167e9f8110 in Call /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/PromiseBinding.h:104
    #28 0x7f167e9f8110 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:243
    #29 0x7f167e9d1b21 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:665:17
    #30 0x7f167e9d273f in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:494:3
    #31 0x7f1680fa14dd in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/workspace/build/src/js/xpconnect/src/XPCJSContext.cpp:1323:28
    #32 0x7f167ebd3fa6 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1282:24
    #33 0x7f167ebd9368 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
    #34 0x7f167fe1172f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:88:21
    #35 0x7f167fd082e2 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #36 0x7f167fd082e2 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
    #37 0x7f167fd082e2 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
    #38 0x7f1688124849 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #39 0x7f168bdd7a00 in nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:276:30
    #40 0x7f168c056213 in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4601:22
    #41 0x7f168c05832f in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4736:8
    #42 0x7f168c059c10 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4817:21
    #43 0x55916af42a26 in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:218:22
    #44 0x55916af42a26 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:300
    #45 0x7f16a1ae3b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/dom/canvas/ImageBitmap.cpp:1352:56 in mozilla::dom::ImageBitmap::WriteStructuredClone(JSStructuredCloneWriter*, nsTArray<RefPtr<mozilla::gfx::DataSourceSurface> >&, mozilla::dom::ImageBitmap*)

Comment 1

[Jason Kratzer [:jkratzer]]

Testcase bisects back further than a year.

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

We crash on this line because mData is null:

https://searchfox.org/mozilla-central/rev/f43ae7e1c43a4a940b658381157a6ea6c5a185c1/dom/canvas/ImageBitmap.cpp#1360

We check elsewhere before cloning to see if it is null, because if we call ImageBitmap::Close, we clear it:

https://searchfox.org/mozilla-central/rev/f43ae7e1c43a4a940b658381157a6ea6c5a185c1/dom/canvas/ImageBitmap.cpp#610

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1583238 - Check if ImageBitmap was closed in WriteStructuredClone.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f10d7e036f92
Check if ImageBitmap was closed in WriteStructuredClone. r=lsalzman

Comment 5

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/f10d7e036f92

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Can/should we land this testcase as a crashtest?

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #6)

Can/should we land this testcase as a crashtest?

Guess not.