1704234 - crash near null in [@ mozilla::a11y::NotificationController::CoalesceMutationEvents]

Status: NEW

(Core :: Disability Access APIs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

First found while fuzzing m-c 20210407-b740f950e497 (--enable-address-sanitizer --enable-fuzzing)

==30860==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000004d (pc 0x7f6e2d5c4be0 bp 0x7fff4ef145f0 sp 0x7fff4ef144c0 T0)
==30860==The signal is caused by a READ memory access.
==30860==Hint: address points to the zero page.
    #0 0x7f6e2d5c4be0 in ReorderEventTarget /gecko/accessible/generic/LocalAccessible.h:873:44
    #1 0x7f6e2d5c4be0 in mozilla::a11y::NotificationController::CoalesceMutationEvents() /gecko/accessible/base/NotificationController.cpp:334:21
    #2 0x7f6e2d5c7d5c in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) /gecko/accessible/base/NotificationController.cpp:852:3
    #3 0x7f6e2a8c71f8 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /gecko/layout/base/nsRefreshDriver.cpp:2128:12
    #4 0x7f6e2a8d38a5 in TickDriver /gecko/layout/base/nsRefreshDriver.cpp:346:13
    #5 0x7f6e2a8d38a5 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /gecko/layout/base/nsRefreshDriver.cpp:324:7
    #6 0x7f6e2a8d360d in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /gecko/layout/base/nsRefreshDriver.cpp:340:5
    #7 0x7f6e2a8d2b11 in RunRefreshDrivers /gecko/layout/base/nsRefreshDriver.cpp:773:5
    #8 0x7f6e2a8d2b11 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /gecko/layout/base/nsRefreshDriver.cpp:702:16
    #9 0x7f6e2a8d20cd in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /gecko/layout/base/nsRefreshDriver.cpp:615:7
    #10 0x7f6e2a8d0352 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::ParentProcessVsyncNotifier::Run() /gecko/layout/base/nsRefreshDriver.cpp:505:20
    #11 0x7f6e22b80626 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:470:16
    #12 0x7f6e22b467e3 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:754:26
    #13 0x7f6e22b44327 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:609:15
    #14 0x7f6e22b4477d in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:393:36
    #15 0x7f6e22b89c64 in operator() /gecko/xpcom/threads/TaskController.cpp:136:37
    #16 0x7f6e22b89c64 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /gecko/xpcom/threads/nsThreadUtils.h:534:5
    #17 0x7f6e22b62a53 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1159:16
    #18 0x7f6e22b6d97c in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #19 0x7f6e23db1674 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:109:5
    #20 0x7f6e23cbb871 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #21 0x7f6e23cbb871 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #22 0x7f6e23cbb871 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #23 0x7f6e2a3f67d7 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
    #24 0x7f6e2dcf6137 in nsAppStartup::Run() /gecko/toolkit/components/startup/nsAppStartup.cpp:273:30
    #25 0x7f6e2defca4f in XREMain::XRE_mainRun() /gecko/toolkit/xre/nsAppRunner.cpp:5348:22
    #26 0x7f6e2defef76 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /gecko/toolkit/xre/nsAppRunner.cpp:5539:8
    #27 0x7f6e2deffd53 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /gecko/toolkit/xre/nsAppRunner.cpp:5598:21
    #28 0x55de16ae6902 in do_main /gecko/browser/app/nsBrowserApp.cpp:220:22
    #29 0x55de16ae6902 in main /gecko/browser/app/nsBrowserApp.cpp:347:16
    #30 0x7f6e430410b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #31 0x55de16a398b9 in _start (/home/worker/builds/m-c-20210409092020-fuzzing-asan-opt/firefox+0x5a8b9)

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/yeIkfUv5FS2_d9ETx8Hj1A/index.html