1746997 - Infinite recursion in FontFaceSet_Binding

Status: RESOLVED FIXED

(Core :: DOM: Bindings (WebIDL), defect)

Description

[Toshihito Kikuchi [:toshi]]

The crash https://crash-stats.mozilla.org/report/index/49671fbc-f387-4917-bf72-8f4ca0211208 shows the process entered into an infinite recursion in FontFaceSet_Binding::CreateInterfaceObjects, resuting in stack overflow.

0:000> .excr
rax=0000000000000009 rbx=000001ae6f9024c0 rcx=000001ae6f9024c0
rdx=0000004c2ba04078 rsi=0000004c2ba04078 rdi=000000000000005a
rip=00007ffde56190a2 rsp=0000004c2ba04000 rbp=0000000000000000
 r8=7efefefefefefeff  r9=c41f1eff666d6873 r10=00000fffad2ef866
r11=8101010101010100 r12=00000000dffadb03 r13=0000000000000003
r14=000001ae75e24000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
ntdll!RtlAcquireSRWLockExclusive+0x2:
00007ffd`e56190a2 56              push    rsi
0:000> knL:
Numeric expression missing from ':'
0:000> knL
  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP          RetAddr           Call Site
00 0000004c`2ba04000 00007ffd`677ab166 ntdll!RtlAcquireSRWLockExclusive+0x2
01 (Inline Function) --------`-------- xul!mozilla::OffTheBooksMutex::Lock+0x9
02 (Inline Function) --------`-------- xul!mozilla::detail::BaseAutoLock<mozilla::Mutex &>::BaseAutoLock+0x9
03 0000004c`2ba04010 00007ffd`6977c74b xul!CrashReporter::AnnotateCrashReport+0x26
04 0000004c`2ba04050 00007ffd`6977c351 xul!mozilla::CycleCollectedJSRuntime::AnnotateAndSetOutOfMemory+0x7b
05 (Inline Function) --------`-------- xul!mozilla::CycleCollectedJSRuntime::OnOutOfMemory+0x18
06 0000004c`2ba040b0 00007ffd`6baebd92 xul!mozilla::CycleCollectedJSRuntime::OutOfMemoryCallback+0x21
07 0000004c`2ba040f0 00007ffd`693c36ef xul!js::ReportOutOfMemory+0x77
08 (Inline Function) --------`-------- xul!js::gc::GCRuntime::tryNewTenuredThing+0x132d
09 (Inline Function) --------`-------- xul!js::gc::GCRuntime::tryNewTenuredObject+0x1336
0a 0000004c`2ba04150 00007ffd`693734cf xul!js::AllocateObject<js::CanGC>+0x172f
0b (Inline Function) --------`-------- xul!js::NativeObject::create+0x57
0c (Inline Function) --------`-------- xul!NewObject+0x30f
0d 0000004c`2ba04220 00007ffd`68ea7e56 xul!js::NewObjectWithGivenTaggedProto+0x65f
0e (Inline Function) --------`-------- xul!js::NewObjectWithGivenTaggedProto+0x3c
0f (Inline Function) --------`-------- xul!js::NewObjectWithGivenProto+0x3c
10 0000004c`2ba04300 00007ffd`684d4569 xul!JS_NewObjectWithGivenProto+0x46
11 (Inline Function) --------`-------- xul!mozilla::dom::CreateInterfacePrototypeObject+0xe
12 0000004c`2ba04340 00007ffd`6a5ff020 xul!mozilla::dom::CreateInterfaceObjects+0x149
13 0000004c`2ba04460 00007ffd`68eb2901 xul!mozilla::dom::FontFaceSet_Binding::CreateInterfaceObjects+0x180
14 0000004c`2ba04580 00007ffd`6a5ff045 xul!mozilla::dom::GetPerInterfaceObjectHandle+0x291
15 (Inline Function) --------`-------- xul!mozilla::dom::FontFaceSet_Binding::GetProtoObjectHandle+0x25
16 0000004c`2ba04620 00007ffd`68eb2901 xul!mozilla::dom::FontFaceSet_Binding::CreateInterfaceObjects+0x1a5
17 0000004c`2ba04740 00007ffd`6a5ff045 xul!mozilla::dom::GetPerInterfaceObjectHandle+0x291
18 (Inline Function) --------`-------- xul!mozilla::dom::FontFaceSet_Binding::GetProtoObjectHandle+0x25
19 0000004c`2ba047e0 00007ffd`68eb2901 xul!mozilla::dom::FontFaceSet_Binding::CreateInterfaceObjects+0x1a5
1a 0000004c`2ba04900 00007ffd`6a5ff045 xul!mozilla::dom::GetPerInterfaceObjectHandle+0x291
1b (Inline Function) --------`-------- xul!mozilla::dom::FontFaceSet_Binding::GetProtoObjectHandle+0x25
...

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:dholbert, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Daniel Holbert [:dholbert]]

So the infinite recursion here seems to be this repeating pattern from the bottom of comment 0 (blank lines inserted for clarity):

13 0000004c`2ba04460 00007ffd`68eb2901 xul!mozilla::dom::FontFaceSet_Binding::CreateInterfaceObjects+0x180
14 0000004c`2ba04580 00007ffd`6a5ff045 xul!mozilla::dom::GetPerInterfaceObjectHandle+0x291
15 (Inline Function) --------`-------- xul!mozilla::dom::FontFaceSet_Binding::GetProtoObjectHandle+0x25

16 0000004c`2ba04620 00007ffd`68eb2901 xul!mozilla::dom::FontFaceSet_Binding::CreateInterfaceObjects+0x1a5
17 0000004c`2ba04740 00007ffd`6a5ff045 xul!mozilla::dom::GetPerInterfaceObjectHandle+0x291
18 (Inline Function) --------`-------- xul!mozilla::dom::FontFaceSet_Binding::GetProtoObjectHandle+0x25

19 0000004c`2ba047e0 00007ffd`68eb2901 xul!mozilla::dom::FontFaceSet_Binding::CreateInterfaceObjects+0x1a5
1a 0000004c`2ba04900 00007ffd`6a5ff045 xul!mozilla::dom::GetPerInterfaceObjectHandle+0x291
1b (Inline Function) --------`-------- xul!mozilla::dom::FontFaceSet_Binding::GetProtoObjectHandle+0x25

(The functions inside there^ seem to just be helpers that are the straw that breaks the camel's back, while we're deeply recursively nested.)

This all seems to be in generated DOM bindings code; we don't have enough of a backtrace to see what's outside of that, I guess.

smaug, perhaps you could take a look from a DOM bindings perspective & see if you know what's going on & where the problem lies?

Comment 3

[Daniel Holbert [:dholbert]]

Moving to DOM/CSSOM, and resetting severity for triage over there (though it feels no-more-severe than S3, since it appears to be annoying-but-not-exploitable, and fortunately we only have one crash report with this issue at this point, so it's perhaps rare).

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

(assuming I'm reading this correctly)
If https://searchfox.org/mozilla-central/source/__GENERATED__/dom/bindings/FontFaceSetBinding.cpp#1340 fails so that the method doesn't set
a value to protoCache
https://searchfox.org/mozilla-central/source/__GENERATED__/dom/bindings/FontFaceSetBinding.cpp#1352 will re-enter the method.
And I think it may fail in https://searchfox.org/mozilla-central/source/dom/bindings/BindingUtils.cpp#1104

Should we check that we have protoCache before calling
https://searchfox.org/mozilla-central/source/__GENERATED__/dom/bindings/FontFaceSetBinding.cpp#1352 ?

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jfkthame, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 6

[Jonathan Kew [:jfkthame]]

Marking as S3 for now (in line with comment 3), but feel free to adjust if you think appropriate, Peter.

Comment 7

[Andrew McCreight [:mccr8]]

While perusing stack overflow crashes, I came across another instance signature that looks like this: bp-2128ca6b-e4f9-4395-889c-da4d60220209

Comment 8

[Peter Van der Beken [:peterv]]

Attachment: Bug 1746997 - Infinite recursion in FontFaceSet_Binding. r?emilio!

Comment 9

[Peter Van der Beken [:peterv]]

Attachment: Diff of generated binding code

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/538dd2bb87a2
Infinite recursion in FontFaceSet_Binding. r=emilio

Comment 12

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/538dd2bb87a2

Comment 13

[Andrew McCreight [:mccr8]]

These crashes have been around a while, but the volume on ESR doesn't really look high enough to make it worth backporting this. I'll add some signatures I found by searching for stack overflow crashes where the proto stack contains CreateInterfaceObjects.