Closed
Bug 1646608
Opened 4 years ago
Closed 4 years ago
AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27 in get
Categories
(Core :: DOM: Security, defect)
Core
DOM: Security
Tracking
()
RESOLVED
DUPLICATE
of bug 1645997
Tracking | Status | |
---|---|---|
firefox79 | --- | fixed |
People
(Reporter: jkratzer, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: crash, testcase)
Crash Data
Attachments
(1 file)
416 bytes,
text/html
|
Details |
Testcase found while fuzzing mozilla-central rev 567a8768593e.
==24156==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000110 (pc 0x7f9f7c6e60ca bp 0x7ffd91fd2410 sp 0x7ffd91fd2410 T0)
==24156==The signal is caused by a READ memory access.
==24156==Hint: address points to the zero page.
#0 0x7f9f7c6e60c9 in get /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27
#1 0x7f9f7c6e60c9 in operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:316:12
#2 0x7f9f7c6e60c9 in GetParentWindowContext /builds/worker/checkouts/gecko/docshell/base/WindowContext.cpp:55:10
#3 0x7f9f7c6e60c9 in mozilla::dom::WindowContext::TopWindowContext() /builds/worker/checkouts/gecko/docshell/base/WindowContext.cpp:60:19
#4 0x7f9f73591cbb in mozilla::PermissionDelegateHandler::GetPermission(nsTSubstring<char> const&, unsigned int*, bool) /builds/worker/checkouts/gecko/extensions/permissions/PermissionDelegateHandler.cpp:255:40
#5 0x7f9f77c7ae94 in mozilla::MediaManager::IsActivelyCapturingOrHasAPermission(unsigned long) /builds/worker/checkouts/gecko/dom/media/MediaManager.cpp:4041:24
#6 0x7f9f7790d1a3 in IsActivelyCapturingOrHasAPermission /builds/worker/checkouts/gecko/dom/media/AutoplayPolicy.cpp:46:41
#7 0x7f9f7790d1a3 in mozilla::dom::IsWindowAllowedToPlay(nsPIDOMWindowInner*) /builds/worker/checkouts/gecko/dom/media/AutoplayPolicy.cpp:77:7
#8 0x7f9f7840d69d in mozilla::dom::AudioContext::UpdateAutoplayAssumptionStatus() /builds/worker/checkouts/gecko/dom/media/webaudio/AudioContext.cpp:1033:7
#9 0x7f9f7840c4b8 in mozilla::dom::AudioContext::AudioContext(nsPIDOMWindowInner*, bool, unsigned int, unsigned int, float) /builds/worker/checkouts/gecko/dom/media/webaudio/AudioContext.cpp:195:3
#10 0x7f9f7840e375 in mozilla::dom::AudioContext::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::AudioContextOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/media/webaudio/AudioContext.cpp:277:11
#11 0x7f9f754044da in mozilla::dom::AudioContext_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/AudioContextBinding.cpp:852:58
#12 0x7f9f7d43f44e in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
#13 0x7f9f7d43f44e in CallJSNativeConstructor /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:502:8
#14 0x7f9f7d43f44e in InternalConstruct(JSContext*, js::AnyConstructArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:704:10
#15 0x7f9f7d43eb34 in js::ConstructFromStack(JSContext*, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:731:10
#16 0x7f9f7d4158ab in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3290:16
#17 0x7f9f7d408681 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:458:10
#18 0x7f9f7d43c40d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:613:13
#19 0x7f9f7d43e5c8 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:641:10
#20 0x7f9f7d43e8a6 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:658:8
#21 0x7f9f7dab26c0 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/SelfHosting.cpp:1698:10
#22 0x7f9f7d6ce8ec in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/AsyncFunction.cpp:128:8
#23 0x7f9f7d81beb1 in AsyncFunctionPromiseReactionJob /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:1700:10
#24 0x7f9f7d81beb1 in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:1852:12
#25 0x7f9f7d43c32b in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
#26 0x7f9f7d43c32b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:578:12
#27 0x7f9f7d43e5c8 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:641:10
#28 0x7f9f7d43e8a6 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:658:8
#29 0x7f9f7d5e0bc0 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2842:10
#30 0x7f9f75b2a61b in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:28:8
#31 0x7f9f70e2dc36 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:91:12
#32 0x7f9f70e2dc36 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:104:12
#33 0x7f9f70e2dc36 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:209:18
#34 0x7f9f70e0e012 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:640:17
#35 0x7f9f70e0ef8f in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:459:3
#36 0x7f9f73447a6d in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1363:28
#37 0x7f9f71019ba6 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1269:24
#38 0x7f9f7102443c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:501:10
#39 0x7f9f723b2c0f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
#40 0x7f9f72290127 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:315:10
#41 0x7f9f72290127 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:308:3
#42 0x7f9f72290127 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:290:3
#43 0x7f9f7960c718 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
#44 0x7f9f7d1ceda6 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
#45 0x7f9f72290127 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:315:10
#46 0x7f9f72290127 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:308:3
#47 0x7f9f72290127 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:290:3
#48 0x7f9f7d1ce38f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
#49 0x55b7ae633af3 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#50 0x55b7ae633af3 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
#51 0x7f9f94fbdb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27 in get
Flags: in-testsuite?
Reporter | ||
Updated•4 years ago
|
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Reporter | ||
Comment 1•4 years ago
|
||
Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200618094105-f291dd9e075c.
The bug appears to have been introduced in the following build range:
> Start: a890be633ec35c79b8c8fe68e8b32ab7c991ff83 (20200612162245)
> End: fd202991fa015a4fd5fefbd1ca59a64272d56780 (20200612163833)
> Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a890be633ec35c79b8c8fe68e8b32ab7c991ff83&tochange=fd202991fa015a4fd5fefbd1ca59a64272d56780
Updated•4 years ago
|
Crash Signature: [@ mozilla::dom::WindowContext::TopWindowContext ]
See Also: → 1645997
Comment 2•4 years ago
|
||
https://crash-stats.mozilla.org/report/index/14b5e40a-06bd-4a61-a103-eac890200615 is a more common crash stack.
Likely a result of https://hg.mozilla.org/mozilla-central/rev/4e6d8f786f87cca483cd5f54f9f57d2519eceb16#l1.32
Looks the same as bug 1645997.
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → DUPLICATE
Updated•4 years ago
|
Component: Web Audio → DOM: Security
Reporter | ||
Comment 3•4 years ago
|
||
Bugmon Analysis: Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Updated•4 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•