1752649 - crash near null in [@ nsQuoteNode::Text]

Status: VERIFIED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220128-48e8fb0b62c5 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip --xvfb

==12904==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x7f58bfdaef81 bp 0x7fffb0368c70 sp 0x7fffb0368aa0 T0)
==12904==The signal is caused by a READ memory access.
==12904==Hint: address points to the zero page.
    #0 0x7f58bfdaef81 in get /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27
    #1 0x7f58bfdaef81 in operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:316:12
    #2 0x7f58bfdaef81 in StyleFont /gecko/layout/style/nsStyleStructList.h:35:1
    #3 0x7f58bfdaef81 in nsQuoteNode::Text() /gecko/layout/base/nsQuoteList.cpp:63:36
    #4 0x7f58bfdaeb67 in nsQuoteNode::InitTextFrame(nsGenConList*, nsIFrame*, nsIFrame*) /gecko/layout/base/nsQuoteList.cpp:34:49
    #5 0x7f58bfce2df4 in nsCSSFrameConstructor::ConstructTextFrame(nsCSSFrameConstructor::FrameConstructionData const*, nsFrameConstructorState&, nsIContent*, nsContainerFrame*, mozilla::ComputedStyle*, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:3261:41
    #6 0x7f58bfceb388 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:5595:5
    #7 0x7f58bfcd54d5 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:9465:5
    #8 0x7f58bfcd60c6 in nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState&, nsIContent*, mozilla::ComputedStyle*, nsContainerFrame*, bool, nsFrameList&, bool, nsIFrame*) /gecko/layout/base/nsCSSFrameConstructor.cpp:9625:3
    #9 0x7f58bfcdbe65 in nsCSSFrameConstructor::ConstructBlock(nsFrameConstructorState&, nsIContent*, nsContainerFrame*, nsContainerFrame*, mozilla::ComputedStyle*, nsContainerFrame**, nsFrameList&, nsIFrame*) /gecko/layout/base/nsCSSFrameConstructor.cpp:10514:3
    #10 0x7f58bfce258e in nsCSSFrameConstructor::ConstructNonScrollableBlockWithConstructor(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&, nsBlockFrame* (*)(mozilla::PresShell*, mozilla::ComputedStyle*)) /gecko/layout/base/nsCSSFrameConstructor.cpp:4572:3
    #11 0x7f58bfce6e17 in nsCSSFrameConstructor::ConstructNonScrollableBlock(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:4543:10
    #12 0x7f58bfce3ffb in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:3643:16
    #13 0x7f58bfceb158 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:5608:3
    #14 0x7f58bfcd54d5 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:9465:5
    #15 0x7f58bfce685c in nsCSSFrameConstructor::ConstructInline(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItem&, nsContainerFrame*, nsStyleDisplay const*, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:10912:3
    #16 0x7f58bfce3ffb in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:3643:16
    #17 0x7f58bfceb158 in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:5608:3
    #18 0x7f58bfcd54d5 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /gecko/layout/base/nsCSSFrameConstructor.cpp:9465:5
    #19 0x7f58bfcf1e40 in nsCSSFrameConstructor::ContentAppended(nsIContent*, nsCSSFrameConstructor::InsertionKind) /gecko/layout/base/nsCSSFrameConstructor.cpp:6741:3
    #20 0x7f58bfc82a5e in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /gecko/layout/base/RestyleManager.cpp:1494:27
    #21 0x7f58bfc8c1a4 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /gecko/layout/base/RestyleManager.cpp:3098:9
    #22 0x7f58bfc52aa6 in ProcessPendingRestyles /gecko/layout/base/RestyleManager.cpp:3177:3
    #23 0x7f58bfc52aa6 in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /gecko/layout/base/PresShell.cpp:4258:39
    #24 0x7f58babefd7e in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1448:5
    #25 0x7f58babefd7e in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /gecko/dom/base/Document.cpp:10746:16
    #26 0x7f58bfb5e48c in nsComputedDOMStyle::Flush(mozilla::dom::Document&, mozilla::FlushType) /gecko/layout/style/nsComputedDOMStyle.cpp:1010:13
    #27 0x7f58bfb5b632 in nsComputedDOMStyle::UpdateCurrentStyleSources(nsCSSPropertyID) /gecko/layout/style/nsComputedDOMStyle.cpp:1062:5
    #28 0x7f58bfb5a48e in nsComputedDOMStyle::GetPropertyValue(nsCSSPropertyID, nsTSubstring<char> const&, nsTSubstring<char>&) /gecko/layout/style/nsComputedDOMStyle.cpp:465:3
    #29 0x7f58bbc366d3 in GetPropertyValue /gecko/layout/style/nsICSSDeclaration.h:102:10
    #30 0x7f58bbc366d3 in mozilla::dom::CSSStyleDeclaration_Binding::getPropertyValue(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/CSSStyleDeclarationBinding.cpp:309:24
    #31 0x7f58bca6a20d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3306:13
    #32 0x7f58c46abd14 in CallJSNative /gecko/js/src/vm/Interpreter.cpp:425:13
    #33 0x7f58c46abd14 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:512:12
    #34 0x7f58c4698145 in CallFromStack /gecko/js/src/vm/Interpreter.cpp:576:10
    #35 0x7f58c4698145 in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3309:16
    #36 0x7f58c467cfa1 in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:394:13
    #37 0x7f58c46abe4f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:544:13
    #38 0x7f58c46adf9b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:589:8
    #39 0x7f58c46af52b in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/Interpreter.cpp:715:10
    #40 0x7f58c4b9f8b2 in CallGetter /gecko/js/src/vm/NativeObject.cpp:1970:12
    #41 0x7f58c4b9f8b2 in GetExistingProperty<js::CanGC> /gecko/js/src/vm/NativeObject.cpp:1998:12
    #42 0x7f58c4b9f8b2 in NativeGetPropertyInline<js::CanGC> /gecko/js/src/vm/NativeObject.cpp:2144:14
    #43 0x7f58c4b9f8b2 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/NativeObject.cpp:2175:10
    #44 0x7f58c46b53c9 in GetProperty /gecko/js/src/vm/ObjectOperations-inl.h:120:10
    #45 0x7f58c46b53c9 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/ObjectOperations-inl.h:127:10
    #46 0x7f58c46b4a24 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/Interpreter.cpp:4710:10
    #47 0x7f58c46857c8 in GetPropertyOperation /gecko/js/src/vm/Interpreter.cpp:208:10
    #48 0x7f58c46857c8 in Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:2973:12
    #49 0x7f58c467cfa1 in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:394:13
    #50 0x7f58c46abe4f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:544:13
    #51 0x7f58c5583631 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /gecko/js/src/jit/BaselineIC.cpp:1595:10
    #52 0x1b98023bae17  (<unknown module>)

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Null-check or oof check needed on the new quote code I suspect

Comment 2

[Jonathan Kew [:jfkthame]]

Attachment: Bug 1752649 - Use GetInFlowParent when retrieving language to be used for quote marks from the element's context. r=#layout-reviewers

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220130093554-12ecc19b4b60.
The bug appears to have been introduced in the following build range:

Start: 1d6c7a604dd69142e2e970ffccdba11f09e41bfa (20220128093216)
End: 48e8fb0b62c587e64b43e9d51a0dff7fdf4b7b2c (20220128123612)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1d6c7a604dd69142e2e970ffccdba11f09e41bfa&tochange=48e8fb0b62c587e64b43e9d51a0dff7fdf4b7b2c

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/60ef503af55a
Use GetInFlowParent when retrieving language to be used for quote marks from the element's context. r=dholbert

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

:jfkthame, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 6

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/60ef503af55a

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220131165143-bb528a123b65.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.