1705000 - Crash in Firefox (mozilla::RestyleManager::ContentStateChanged)

Status: RESOLVED WORKSFORME

(Core :: Layout, defect, P3)

Description

[rnmx123]

Attachment: test_0363.html

During fuzzing I found a crach in Firefox. It affects ASAN build (https://firefox-ci-tc.services.mozilla.com/api/index/v1/task/gecko.v2.mozilla-central.latest.firefox.win64-asan-opt/artifacts/public/build/target.zip).

This is how ASAN log looks like:

==14992==ERROR: AddressSanitizer: breakpoint on unknown address 0x000000000000 (pc 0x7fff36c56f9e bp 0x009121df1b90 sp 0x009121df1ac0 T0)
#0 0x7fff36c56f9d in mozilla::RestyleManager::ContentStateChanged /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3155
#1 0x7fff36c56597 in mozilla::PresShell::ContentStateChanged /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4323
#2 0x7fff30aa7f4f in mozilla::dom::Document::ContentStateChanged /builds/worker/checkouts/gecko/dom/base/Document.cpp:7884
#3 0x7fff30b2dda1 in mozilla::dom::Element::UpdateState /builds/worker/checkouts/gecko/dom/base/Element.cpp:371
#4 0x7fff3408013e in mozilla::TextControlState::SetValue /builds/worker/checkouts/gecko/dom/html/TextControlState.cpp:2684
#5 0x7fff3404345c in mozilla::TextControlState::UnbindFromFrame /builds/worker/checkouts/gecko/dom/html/TextControlState.cpp:2474
#6 0x7fff372cba58 in nsTextControlFrame::DestroyFrom /builds/worker/checkouts/gecko/layout/forms/nsTextControlFrame.cpp:145
#7 0x7fff36f15e12 in nsContainerFrame::RemoveFrame /builds/worker/checkouts/gecko/layout/generic/nsContainerFrame.cpp:181
#8 0x7fff36d34757 in nsCSSFrameConstructor::ContentRemoved /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7492
#9 0x7fff36d1dd5a in nsCSSFrameConstructor::RecreateFramesForContent /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:8463
#10 0x7fff36c96235 in mozilla::RestyleManager::ProcessRestyledFrames /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1503
#11 0x7fff36ca2e38 in mozilla::RestyleManager::DoProcessPendingRestyles /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3048
#12 0x7fff36c529c4 in mozilla::PresShell::DoFlushPendingNotifications /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4202
#13 0x7fff30acc2f0 in mozilla::dom::Document::FlushPendingNotifications /builds/worker/checkouts/gecko/dom/base/Document.cpp:10556
#14 0x7fff30b2c3bb in nsIContent::GetPrimaryFrame /builds/worker/checkouts/gecko/dom/base/Element.cpp:250
#15 0x7fff340a2523 in nsGenericHTMLElement::GetOffsetRect /builds/worker/checkouts/gecko/dom/html/nsGenericHTMLElement.cpp:335
#16 0x7fff32eacfed in mozilla::dom::HTMLElement_Binding::get_offsetTop /builds/worker/workspace/obj-build/dom/bindings/HTMLElementBinding.cpp:1434
#17 0x7fff33238873 in mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions> /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3113
#18 0x7fff3a7709a8 in js::InternalCallOrConstruct /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:520
#19 0x7fff3a773a4b in js::Call /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:597
#20 0x7fff3a7763ef in js::CallGetter /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:721
#21 0x7fff3ad6ff17 in js::NativeGetProperty /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2371
#22 0x7fff3a77db1d in js::GetProperty /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:4559
#23 0x7fff3a759b21 in Interpret /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:2935
#24 0x7fff3a73f3d4 in js::RunScript /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:405
#25 0x7fff3a770d27 in js::InternalCallOrConstruct /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:552
#26 0x7fff3a773a4b in js::Call /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:597
#27 0x7fff3b1b12f1 in JS::Call /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2821
#28 0x7fff32a7cef6 in mozilla::dom::EventHandlerNonNull::Call /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:279
#29 0x7fff33c6a5a8 in mozilla::JSEventHandler::HandleEvent /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:201
#30 0x7fff33c22880 in mozilla::EventListenerManager::HandleEventSubType /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1109
#31 0x7fff33c24684 in mozilla::EventListenerManager::HandleEventInternal /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1300
#32 0x7fff33c09c8c in mozilla::EventTargetChainItem::HandleEvent /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:354
#33 0x7fff33c07e34 in mozilla::EventTargetChainItem::HandleEventTargetChain /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:556
#34 0x7fff33c0e464 in mozilla::EventDispatcher::Dispatch /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1099
#35 0x7fff36d5e2b8 in nsDocumentViewer::LoadComplete /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1087
#36 0x7fff397eeff9 in nsDocShell::EndPageLoad /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6573
#37 0x7fff397ee191 in nsDocShell::OnStateChange /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5928
#38 0x7fff2f390976 in nsDocLoader::DoFireOnStateChange /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1332
#39 0x7fff2f38f3eb in nsDocLoader::doStopDocumentLoad /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:938
#40 0x7fff2f38ae93 in nsDocLoader::DocLoaderIsEmpty /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:757
#41 0x7fff2f38fa57 in nsDocLoader::NotifyDoneWithOnload /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:832
#42 0x7fff2f38ae9e in nsDocLoader::DocLoaderIsEmpty /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:759
#43 0x7fff2f38da18 in nsDocLoader::OnStopRequest /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:640
#44 0x7fff2d499b16 in mozilla::net::nsLoadGroup::NotifyRemovalObservers /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:616
#45 0x7fff2d49c8b1 in mozilla::net::nsLoadGroup::RemoveRequest /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:523
#46 0x7fff30ad3871 in mozilla::dom::Document::DoUnblockOnload /builds/worker/checkouts/gecko/dom/base/Document.cpp:11296
#47 0x7fff30a755ab in mozilla::dom::Document::UnblockOnload /builds/worker/checkouts/gecko/dom/base/Document.cpp:11226
#48 0x7fff30aa5f9d in mozilla::dom::Document::DispatchContentLoadedEvents /builds/worker/checkouts/gecko/dom/base/Document.cpp:7779
#49 0x7fff2cf3506a in mozilla::detail::RunnableMethodImpl<nsMemoryReporterManager ,nsresult (nsMemoryReporterManager::)(),1,mozilla::RunnableKind::Standard>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1201
#50 0x7fff2d0dd4c1 in mozilla::SchedulerGroup::Runnable::Run /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:143
#51 0x7fff2d13fcfd in mozilla::RunnableTask::Run /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:470
#52 0x7fff2d0f449e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:754
#53 0x7fff2d0f071e in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:609
#54 0x7fff2d0f0c30 in mozilla::TaskController::ProcessPendingMTTask /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:393
#55 0x7fff2d149f61 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:133:7'>::Run /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:534
#56 0x7fff2d11af61 in nsThread::ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159
#57 0x7fff2d12b30c in NS_ProcessNextEvent /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548
#58 0x7fff2e4c946e in mozilla::ipc::MessagePump::Run /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87
#59 0x7fff2e4030f5 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328
#60 0x7fff2e402ec5 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310
#61 0x7fff363f5daa in nsBaseAppShell::Run /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137
#62 0x7fff365d9b0b in nsAppShell::Run /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:602
#63 0x7fff3a4ac754 in XRE_RunAppShell /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:906
#64 0x7fff2e4030f5 in MessageLoop::RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328
#65 0x7fff2e402ec5 in MessageLoop::Run /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310
#66 0x7fff3a4abbe9 in XRE_InitChildProcess /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:738
#67 0x7ff7bfc31edd in NS_internal_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:309
#68 0x7ff7bfc3148e in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:131
#69 0x7ff7bfd2c3d7 in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#70 0x7fff84187bd3 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017bd3)
#71 0x7fff84acce50 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18006ce50)

To get "Gah. Your tab just crashed" it is enough to just open attached PoC in Firefox Asan build (89.0a1 - which is the latest version at the time of writing this submission).

Thank you!

Comment 1

[Andrew McCreight [:mccr8]]

This looks like a null deref. If the line numbers match mozilla-central, it is on this line: MOZ_DIAGNOSTIC_ASSERT(!mInStyleRefresh);. That doesn't sound like a security issue, but it is worth somebody more familiar with layout taking a look.

Comment 2

[Andrew McCreight [:mccr8]]

It would also be nice if somebody ran a reducer on that test case, as it is quite large.

Comment 3

[Emilio Cobos Álvarez [:emilio]]

Yeah, that probably means that some code that calls into the style system is bogus and mishandling some state when frames come and go, but it shouldn't have a security impact, only correctness impact.

Comment 4

[Emilio Cobos Álvarez [:emilio]]

I haven't been able to reproduce this locally, though I fixed something relatively similar recently so maybe it's fixed already?

Comment 5

[Daniel Veditz [:dveditz]]

As Andrew noted, this looks like an intentional crash and not a security bug.

Resolving per comment 4