1709233 - crash near null in [@ mozilla::dom::Document::GetUnretargetedFocusedContent]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20210501-cd81489560e4 (--enable-address-sanitizer --enable-fuzzing)

==12314==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000004c0 (pc 0x7f97b51a2ff5 bp 0x7ffd2378e090 sp 0x7ffd2378dfc0 T0)
==12314==The signal is caused by a READ memory access.
==12314==Hint: address points to the zero page.
    #0 0x7f97b51a2ff5 in GetWindow /gecko/dom/base/Document.h:1805:12
    #1 0x7f97b51a2ff5 in mozilla::dom::Document::GetUnretargetedFocusedContent() const /gecko/dom/base/Document.cpp:6339:41
    #2 0x7f97b76f6345 in mozilla::dom::HTMLDialogElement::StorePreviouslyFocusedElement() /gecko/dom/html/HTMLDialogElement.cpp:113:29
    #3 0x7f97b76f62ae in mozilla::dom::HTMLDialogElement::Show() /gecko/dom/html/HTMLDialogElement.cpp:78:3
    #4 0x7f97b6b560be in mozilla::dom::HTMLDialogElement_Binding::show(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/HTMLDialogElementBinding.cpp:207:24
    #5 0x7f97b6d6b809 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3232:13
    #6 0x7f97bd516eb2 in CallJSNative /gecko/js/src/vm/Interpreter.cpp:437:13
    #7 0x7f97bd516eb2 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:522:12
    #8 0x7f97bd4fad94 in CallFromStack /gecko/js/src/vm/Interpreter.cpp:586:10
    #9 0x7f97bd4fad94 in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3248:16
    #10 0x7f97bd4e6af6 in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:406:13
    #11 0x7f97bd516feb in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:554:13
    #12 0x7f97bd518beb in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:599:8
    #13 0x7f97bdd86ff2 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/jsapi.cpp:2849:10
    #14 0x7f97b68a2574 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:279:37
    #15 0x7f97b7550a71 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:365:12
    #16 0x7f97b754eeb3 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /gecko/dom/events/JSEventHandler.cpp:201:12
    #17 0x7f97b7517e08 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /gecko/dom/events/EventListenerManager.cpp:1114:22
    #18 0x7f97b7519397 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /gecko/dom/events/EventListenerManager.cpp:1305:17
    #19 0x7f97b7506abe in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:354:17
    #20 0x7f97b75052e1 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:556:16
    #21 0x7f97b750959d in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /gecko/dom/events/EventDispatcher.cpp:1099:11
    #22 0x7f97b9c97ed6 in nsDocumentViewer::LoadComplete(nsresult) /gecko/layout/base/nsDocumentViewer.cpp:1084:7
    #23 0x7f97bc814f57 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /gecko/docshell/base/nsDocShell.cpp:6501:20
    #24 0x7f97bc814277 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp:5891:7
    #25 0x7f97bc8161cf in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp
    #26 0x7f97b3f0b0b9 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:1348:3
    #27 0x7f97b3f09e34 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:954:14
    #28 0x7f97b3f06d73 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /gecko/uriloader/base/nsDocLoader.cpp:773:9
    #29 0x7f97b3f08cc4 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:656:5
    #30 0x7f97bc84dd8f in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /gecko/docshell/base/nsDocShell.cpp:13628:23
    #31 0x7f97b2164b7e in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:625:22
    #32 0x7f97b2167343 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:529:10
    #33 0x7f97b51d1790 in mozilla::dom::Document::DoUnblockOnload() /gecko/dom/base/Document.cpp:11309:18
    #34 0x7f97b518e81e in mozilla::dom::Document::UnblockOnload(bool) /gecko/dom/base/Document.cpp:11239:9
    #35 0x7f97b51b07fd in mozilla::dom::Document::DispatchContentLoadedEvents() /gecko/dom/base/Document.cpp:7774:3
    #36 0x7f97b526d68f in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1148:12
    #37 0x7f97b526d68f in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1154:12
    #38 0x7f97b526d68f in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1201:13
    #39 0x7f97b1e4febf in mozilla::SchedulerGroup::Runnable::Run() /gecko/xpcom/threads/SchedulerGroup.cpp:143:20
    #40 0x7f97b1e93b92 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:482:16
    #41 0x7f97b1e605a0 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:766:26
    #42 0x7f97b1e5e0a7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:621:15
    #43 0x7f97b1e5e4fd in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:405:36
    #44 0x7f97b1e9d541 in operator() /gecko/xpcom/threads/TaskController.cpp:138:37
    #45 0x7f97b1e9d541 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /gecko/xpcom/threads/nsThreadUtils.h:534:5
    #46 0x7f97b1e7aec8 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1159:16
    #47 0x7f97b1e85c7c in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #48 0x7f97b302901f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:85:21
    #49 0x7f97b2f33841 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #50 0x7f97b2f33841 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #51 0x7f97b2f33841 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #52 0x7f97b969aef7 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
    #53 0x7f97bd2c42af in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:911:20
    #54 0x7f97b2f33841 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #55 0x7f97b2f33841 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #56 0x7f97b2f33841 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #57 0x7f97bd2c3c88 in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:743:34
    #58 0x55a30292e5bd in content_process_main(mozilla::Bootstrap*, int, char**) /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #59 0x55a30292e9ed in main /gecko/browser/app/nsBrowserApp.cpp:313:18
    #60 0x7f97d26050b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #61 0x55a30287f8b9 in _start (/home/worker/builds/m-c-20210501093251-fuzzing-asan-opt/firefox+0x5b8b9)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/-P3v1x07XhT3lUj34KCwtg/index.html

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210504033521-17594d43a3dc.
The bug appears to have been introduced in the following build range:

Start: 3009bdef939c0786c38c376de07ba615cbca0d8b (20210427221830)
End: cd81489560e48d19e43f8438c0c939fb58023648 (20210501093251)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3009bdef939c0786c38c376de07ba615cbca0d8b&tochange=cd81489560e48d19e43f8438c0c939fb58023648

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1660271

Comment 5

[Sean Feng [:sefeng]]

Attachment: Bug 1709233 - Fix a null pointer crash in HTMLDialogElement::StorePreviouslyFocusedElement r=emilio

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1b77e5d61e70
Fix a null pointer crash in HTMLDialogElement::StorePreviouslyFocusedElement r=emilio

Comment 7

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/28821 for changes under testing/web-platform/tests

Comment 8

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/1b77e5d61e70

Comment 9

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20210505041336-2cc060f28173.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 10

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot