1713495 - Crash in [@ mozilla::PermissionDelegateHandler::MaybeUnsafePermissionDelegate]

Status: RESOLVED INCOMPLETE

(Core :: Permission Manager, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/72ab7c0e-a21c-481b-b6ba-7e80d0210527

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 xul.dll mozilla::PermissionDelegateHandler::MaybeUnsafePermissionDelegate extensions/permissions/PermissionDelegateHandler.cpp:85
1 xul.dll mozilla::dom::ContentPermissionRequestBase::ContentPermissionRequestBase dom/base/nsContentPermissionHelper.cpp:412
2 xul.dll mozilla::dom::NotificationPermissionRequest::NotificationPermissionRequest dom/notification/Notification.cpp:221
3 xul.dll static mozilla::dom::Notification::RequestPermission dom/notification/Notification.cpp:1460
4 xul.dll mozilla::dom::Notification_Binding::requestPermission dom/bindings/NotificationBinding.cpp:812
5 xul.dll mozilla::dom::StaticMethodPromiseWrapper dom/bindings/BindingUtils.cpp:3271
6 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:522
7 xul.dll Interpret js/src/vm/Interpreter.cpp:3248
8 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:554
9 xul.dll JS::Call js/src/jsapi.cpp:2830

This was detected by PHC but I'm not sure what to make of it. The UAF seems to happen in a completely different place compared to where the page was allocated. This is the stack where the original page was allocated:

#0    selectors::parser::parse_selector<style::selector_parser::SelectorParser,style::gecko::selector_parser::SelectorImpl>(style::selector_parser::SelectorParser*, cssparser::parser::Parser*, selectors::parser::SelectorParsingState) (xul.pdb)
#1    selectors::parser::SelectorList<style::gecko::selector_parser::SelectorImpl>::parse_with_state<style::gecko::selector_parser::SelectorImpl,style::selector_parser::SelectorParser>(style::selector_parser::SelectorParser*, cssparser::parser::Parser*, selectors::parser::SelectorParsingState, selectors::parser::ParseErrorRecovery) (xul.pdb)
#2    cssparser::rules_and_declarations::parse_qualified_rule<style::stylesheets::rule_parser::TopLevelRuleParser,style_traits::StyleParseErrorKind>(cssparser::parser::Parser*, style::stylesheets::rule_parser::TopLevelRuleParser*) (xul.pdb)
#3    static style::stylesheets::stylesheet::StylesheetContents::from_str(str, style::stylesheets::UrlExtraData, style::stylesheets::origin::Origin, style::shared_lock::SharedRwLock*, core::option::Option<StylesheetLoader*>, core::option::Option<ParseErrorReporter*>, selectors::context::QuirksMode, unsigned int, core::option::Option<style::use_counters::UseCounters*>, style::stylesheets::stylesheet::AllowImportRules, core::option::Option<mut style::stylesheets::stylesheet::SanitizationData*>) (xul.pdb)
#4    static geckoservo::stylesheet_loader::AsyncStylesheetParser::parse(geckoservo::stylesheet_loader::AsyncStylesheetParser) (xul.pdb)
#5    geckoservo::glue::Servo_StyleSheet_FromUTF8BytesAsync(style::gecko_bindings::structs::root::nsMainThreadPtrHolder<style::gecko_bindings::structs::root::mozilla::css::SheetLoadData>*, style::gecko_bindings::structs::root::mozilla::URLExtraData*, nsstring::nsACString*, style::gecko_bindings::structs::root::mozilla::css::SheetParsingMode, unsigned int, style::gecko_bindings::structs::root::nsCompatibility, bool, style::stylesheets::stylesheet::AllowImportRules) (xul.pdb)
#6    mozilla::StyleSheet::ParseSheet(mozilla::css::Loader&, nsTSubstring<char> const&, mozilla::css::SheetLoadData&) (xul.pdb)
#7    mozilla::css::Loader::ParseSheet(nsTSubstring<char> const&, mozilla::css::SheetLoadData&, mozilla::css::Loader::AllowAsyncParse) (xul.pdb)
#8    mozilla::css::StreamLoader::OnStopRequest(nsIRequest*, nsresult) (xul.pdb)
#9    mozilla::net::nsHTTPCompressConv::OnStopRequest(nsIRequest*, nsresult) (xul.pdb)
#10    std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelChild.cpp:814:13',void>::_Do_call() (xul.pdb)
#11    mozilla::net::ChannelEventQueue::FlushQueue() (xul.pdb)
#12    mozilla::net::ChannelEventQueue::ResumeInternal::CompleteResumeRunnable::Run() (xul.pdb)
#13    mozilla::SchedulerGroup::Runnable::Run() (xul.pdb)
#14    mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&) (xul.pdb)
#15    nsThread::ProcessNextEvent(bool, bool*) (xul.pdb)

And this is where it was freed:

#0    servo_arc::Arc<style::shared_lock::Locked<style::stylesheets::style_rule::StyleRule>>::drop_slow<style::shared_lock::Locked<style::stylesheets::style_rule::StyleRule>>() (xul.pdb)
#1    servo_arc::Arc<style::shared_lock::Locked<style::stylesheets::rule_list::CssRules>>::drop_slow<style::shared_lock::Locked<style::stylesheets::rule_list::CssRules>>() (xul.pdb)
#2    servo_arc::Arc<style::stylesheets::stylesheet::StylesheetContents>::drop_slow<style::stylesheets::stylesheet::StylesheetContents>() (xul.pdb)
#3    style::gecko::arc_types::Servo_StyleSheetContents_Release(style::gecko_bindings::structs::root::RawServoStyleSheetContents*) (xul.pdb)
#4    mozilla::StyleSheetInfo::RemoveSheet(mozilla::StyleSheet*) (xul.pdb)
#5    mozilla::StyleSheet::Release() (xul.pdb)
#6    nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) (xul.pdb)
#7    nsCycleCollector_collectSlice(js::SliceBudget&, bool) (xul.pdb)
#8    CCRunnerFired(mozilla::TimeStamp) (xul.pdb)
#9    virtual bool std::_Func_impl_no_alloc<bool ( *)(class mozilla::TimeStamp),bool,class mozilla::TimeStamp>::_Do_call(class mozilla::TimeStamp &&) (xul.pdb)
#10    mozilla::IdleTaskRunner::Run() (xul.pdb)
#11    mozilla::IdleTaskRunnerTask::Run() (xul.pdb)
#12    mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&) (xul.pdb)
#13    nsThread::ProcessNextEvent(bool, bool*) (xul.pdb)
#14    mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (xul.pdb)
#15    MessageLoop::RunHandler() (xul.pdb)

The crashes are currently coming from a single installation.

Comment 1

[Daniel Veditz [:dveditz]]

I see 14 total crashes with this signature, all from the same Beta installation. Only 3 have a PHC "kind" and only one has a PHC stack. none of the crashes have a URL. Because it crashes with and without PHC maybe this is an interesting stack anyway?

I imagine selectors live in a stylesheet, so allocating selectors that get freed (or discovered dead) when the sheet is freed seems plausible enough?

Comment 2

[Emilio Cobos Álvarez [:emilio]]

If I understand correctly, the alloc and free stacks are perfectly reasonable, it's MaybeUnsafePermissionDelegate what's using garbage pointers. That keeps no references to selectors or what not so how they got to that memory address seems quite interesting.

Comment 3

[Daniel Veditz [:dveditz]]

We seem to be out of ideas here. I'm not seeing any additional crashes other than that one user crashing 14 times over a 40 hour period.