1603104 - AddressSanitizer: heap-buffer-overflow [@ IsAllowedAsChild] with READ of size 8

Status: RESOLVED DUPLICATE of bug 1499861

(Core :: DOM: Core & HTML, defect)

Description

[Christian Holler (:decoder)]

The attached crash information was submitted via the ASan Nightly Reporter on mozilla-central-asan-nightly revision 64.0a1-20181013100102-https://hg.mozilla.org/mozilla-central/rev/94a62c1aad526dc24dc9186a6ccebb0db276ee87.

For detailed crash information, see attachment.

This report comes from a super-old Firefox version, but I decided to file it anyway, in case it points to a bug that might still be present in our code. If this is not interesting/actionable, feel free to close the bug.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Andrew McCreight [:mccr8]]

mozilla::dom::HTMLOptionsCollection_Binding::DOMProxyHandler::setCustom() is on the stack, which reminded me of bug 1371259, which added some rooting in that function, but that was fixed in Firefox 55, so too old for this particular version to be affected.

Comment 3

[Andrew Overholt [:overholt]]

Peter, do you think it's worth keeping this open?

Comment 4

[Peter Van der Beken [:peterv]]

I'm going to mark this as duplicate of bug 1499861. This is calling an indexed setter on an options collection, and it looks like the select element is dead. The collection's reference to its select element used to be a weak pointer (https://hg.mozilla.org/mozilla-central/file/94a62c1aad526dc24dc9186a6ccebb0db276ee87/dom/html/HTMLOptionsCollection.h#l159), but bug 1499861 made that a strong pointer.

Some links for the first few frames from the stack:

https://hg.mozilla.org/mozilla-central/file/94a62c1aad526dc24dc9186a6ccebb0db276ee87/dom/base/nsINode.cpp#l2092
https://hg.mozilla.org/mozilla-central/file/94a62c1aad526dc24dc9186a6ccebb0db276ee87/dom/base/nsINode.cpp#l2241 (inlined?)
https://hg.mozilla.org/mozilla-central/file/94a62c1aad526dc24dc9186a6ccebb0db276ee87/dom/base/nsINode.cpp#l2307
https://hg.mozilla.org/mozilla-central/file/94a62c1aad526dc24dc9186a6ccebb0db276ee87/dom/html/HTMLOptionsCollection.cpp#l155
...

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Per comment 4 marking dup of bug 1499861.
Please reopen if needed.