1746308 - Crash near null in [@ mozilla::layers::Image::GetDescFromTexClient]

Status: RESOLVED DUPLICATE of bug 1746135

(Core :: Graphics: CanvasWebGL, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20211215-498591f70df9 (--enable-address-sanitizer --enable-fuzzing)

Marking as fuzzblocker. Huge spike today.

==18142==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 (pc 0x7fe5b45d65c7 bp 0x7ffdfbb0ddd0 sp 0x7ffdfbb0dc20 T0)
==18142==The signal is caused by a READ memory access.
==18142==Hint: address points to the zero page.
    #0 0x7fe5b45d65c7 in GetInternalData /builds/worker/workspace/obj-build/dist/include/mozilla/layers/TextureClient.h:594:43
    #1 0x7fe5b45d65c7 in mozilla::layers::Image::GetDescFromTexClient(mozilla::layers::TextureClient*) /gecko/gfx/layers/ImageContainer.cpp:226:25
    #2 0x7fe5b45d644a in mozilla::layers::Image::GetDesc() /gecko/gfx/layers/ImageContainer.cpp:217:52
    #3 0x7fe5b753aa81 in mozilla::webgl::FromDomElem(mozilla::ClientWebGLContext const&, unsigned int, mozilla::avec3<unsigned int>, mozilla::dom::Element const&, mozilla::ErrorResult*) /gecko/dom/canvas/WebGLTextureUpload.cpp:190:23
    #4 0x7fe5b72f876f in operator() /gecko/dom/canvas/ClientWebGLContext.cpp:4048:14
    #5 0x7fe5b72f876f in mozilla::ClientWebGLContext::TexImage(unsigned char, unsigned int, int, unsigned int, mozilla::avec3<int> const&, mozilla::avec3<int> const&, int, mozilla::webgl::PackingInfo const&, mozilla::TexImageSource const&) const /gecko/dom/canvas/ClientWebGLContext.cpp:3995:15
    #6 0x7fe5b675c0c0 in void mozilla::ClientWebGLContext::TexImage2D<mozilla::dom::HTMLVideoElement>(unsigned int, int, unsigned int, int, int, int, unsigned int, unsigned int, mozilla::dom::HTMLVideoElement const&, mozilla::ErrorResult&) const /gecko/dom/canvas/ClientWebGLContext.h:1559:5
    #7 0x7fe5b6757e96 in mozilla::dom::WebGL2RenderingContext_Binding::texImage2D(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WebGL2RenderingContextBinding.cpp:2239:32
    #8 0x7fe5b711bf8d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3306:13
    #9 0x7fe5bec11f44 in CallJSNative /gecko/js/src/vm/Interpreter.cpp:388:13
    #10 0x7fe5bec11f44 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:475:12
    #11 0x7fe5bebfe40e in CallFromStack /gecko/js/src/vm/Interpreter.cpp:539:10
    #12 0x7fe5bebfe40e in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3243:16
    #13 0x7fe5bebe3211 in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:357:13
    #14 0x7fe5bec1207f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:507:13
    #15 0x7fe5bec141cb in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:552:8
    #16 0x7fe5bee9226d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/CallAndConstruct.cpp:117:10
    #17 0x7fe5b6e0c6d1 in mozilla::dom::Function::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/FunctionBinding.cpp:50:8
    #18 0x7fe5b54ec451 in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject> >(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:71:12
    #19 0x7fe5b54ec033 in mozilla::dom::CallbackTimeoutHandler::Call(char const*) /gecko/dom/base/TimeoutHandler.cpp:167:29
    #20 0x7fe5b506db20 in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) /gecko/dom/base/nsGlobalWindowInner.cpp:6291:38
    #21 0x7fe5b54e77b9 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /gecko/dom/base/TimeoutManager.cpp:893:44
    #22 0x7fe5b54e64f5 in mozilla::dom::TimeoutExecutor::MaybeExecute() /gecko/dom/base/TimeoutExecutor.cpp:179:11
    #23 0x7fe5b54e961c in Notify /gecko/dom/base/TimeoutExecutor.cpp:246:5
    #24 0x7fe5b54e961c in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /gecko/dom/base/TimeoutExecutor.cpp
    #25 0x7fe5b1ab120c in operator() /gecko/xpcom/threads/nsTimerImpl.cpp:654:44
    #26 0x7fe5b1ab120c in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:654:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:659:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
    #27 0x7fe5b1ab120c in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:653:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:654:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:659:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
    #28 0x7fe5b1ab120c in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:653:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:654:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:659:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:902:12
    #29 0x7fe5b1ab120c in match<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:653:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:654:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:659:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:857:12
    #30 0x7fe5b1ab120c in nsTimerImpl::Fire(int) /gecko/xpcom/threads/nsTimerImpl.cpp:652:22
    #31 0x7fe5b1a5902f in nsTimerEvent::Run() /gecko/xpcom/threads/TimerThread.cpp:265:11
    #32 0x7fe5b1a8ccf2 in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /gecko/xpcom/threads/ThrottledEventQueue.cpp:254:22
    #33 0x7fe5b1a84ccf in mozilla::ThrottledEventQueue::Inner::Executor::Run() /gecko/xpcom/threads/ThrottledEventQueue.cpp:81:15
    #34 0x7fe5b1a86b62 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:468:16
    #35 0x7fe5b1a4c14d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:771:26
    #36 0x7fe5b1a496a8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:607:15
    #37 0x7fe5b1a49db9 in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:391:36
    #38 0x7fe5b1a901d4 in operator() /gecko/xpcom/threads/TaskController.cpp:127:37
    #39 0x7fe5b1a901d4 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /gecko/xpcom/threads/nsThreadUtils.h:531:5
    #40 0x7fe5b1a6c447 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1183:16
    #41 0x7fe5b1a7793c in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:467:10
    #42 0x7fe5b2f85324 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:107:5
    #43 0x7fe5b2e04d41 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #44 0x7fe5b2e04d41 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #45 0x7fe5b2e04d41 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #46 0x7fe5b9cf3517 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
    #47 0x7fe5be92faef in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:864:20
    #48 0x7fe5b2e04d41 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #49 0x7fe5b2e04d41 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #50 0x7fe5b2e04d41 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #51 0x7fe5be92ed22 in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:701:34
    #52 0x560a1f8b7e9d in content_process_main(mozilla::Bootstrap*, int, char**) /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #53 0x560a1f8b82c8 in main /gecko/browser/app/nsBrowserApp.cpp:327:18
    #54 0x7fe5d5b7b0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #55 0x560a1f806f69 in _start (/home/worker/builds/m-c-20211215102502-fuzzing-asan-opt/firefox+0x5cf69)

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/doxpeaNKy1cjuMwnmNJ5ww/index.html

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20211215215113-66b5b425d27f.
The bug appears to have been introduced in the following build range:

Start: f2e2d0e522d07a7043e2df47b7ccab8e348e5cb0 (20211215011533)
End: 3d201ea8834161911890a06bae578b64d18eefa9 (20211215015643)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=f2e2d0e522d07a7043e2df47b7ccab8e348e5cb0&tochange=3d201ea8834161911890a06bae578b64d18eefa9

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20211215102502-498591f70df9) but not with tip (mozilla-central 20211217212339-2c242fa34cb6.)
The bug appears to have been fixed in the following build range:

Start: 792c9fbceb7170c1c00d8bed57a2c3d2cf6d1913 (20211216094142)
End: 65cda71ffcdd12a28b748d4a025a0ddaf972396a (20211216093449)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=792c9fbceb7170c1c00d8bed57a2c3d2cf6d1913&tochange=65cda71ffcdd12a28b748d4a025a0ddaf972396a
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Christian Holler (:decoder)]

Potentially fixed by bug 1746135. Tyson, are we still seeing this signature?

Comment 5

[Tyson Smith [:tsmith]]

The fuzzers last reported this issue while running m-c 20211216-792c9fbceb71.