1755101 - crash at null in [@ mozilla::gfx::FilterNodeSoftware::GetInputRectInRect]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220209-99073046b39c (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --xvfb

==24261==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f218c26a19e bp 0x7fff6d01caf0 sp 0x7fff6d01c820 T0)
==24261==The signal is caused by a READ memory access.
==24261==Hint: address points to the zero page.
    #0 0x7f218c26a19e in mozilla::gfx::FilterNodeSoftware::GetInputRectInRect(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:873:18
    #1 0x7f218c26c9a4 in mozilla::gfx::FilterNodeTransformSoftware::SourceRectForOutputRect(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:1145:10
    #2 0x7f218c26e2b6 in mozilla::gfx::FilterNodeTransformSoftware::GetOutputRectInRect(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:1225:21
    #3 0x7f218c26a1b9 in mozilla::gfx::FilterNodeSoftware::GetInputRectInRect(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:873:18
    #4 0x7f218c2831cf in mozilla::gfx::FilterNodeBlurXYSoftware::GetOutputRectInRect(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:3085:23
    #5 0x7f218c26a1b9 in mozilla::gfx::FilterNodeSoftware::GetInputRectInRect(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:873:18
    #6 0x7f218c28409a in mozilla::gfx::FilterNodeCropSoftware::GetOutputRectInRect(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:3183:10
    #7 0x7f218c26a1b9 in mozilla::gfx::FilterNodeSoftware::GetInputRectInRect(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:873:18
    #8 0x7f218c26a1b9 in mozilla::gfx::FilterNodeSoftware::GetInputRectInRect(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:873:18
    #9 0x7f218c28409a in mozilla::gfx::FilterNodeCropSoftware::GetOutputRectInRect(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:3183:10
    #10 0x7f218c26a1b9 in mozilla::gfx::FilterNodeSoftware::GetInputRectInRect(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:873:18
    #11 0x7f218c270c9c in mozilla::gfx::FilterNodeColorMatrixSoftware::GetOutputRectInRect(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:1535:10
    #12 0x7f218c26a1b9 in mozilla::gfx::FilterNodeSoftware::GetInputRectInRect(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:873:18
    #13 0x7f218c28409a in mozilla::gfx::FilterNodeCropSoftware::GetOutputRectInRect(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:3183:10
    #14 0x7f218c26a1b9 in mozilla::gfx::FilterNodeSoftware::GetInputRectInRect(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:873:18
    #15 0x7f218c24819f in mozilla::gfx::FilterNodeSoftware::Draw(mozilla::gfx::DrawTarget*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::DrawOptions const&) /gecko/gfx/2d/FilterNodeSoftware.cpp:561:24
    #16 0x7f218c1c72ec in mozilla::gfx::RecordedDrawFilter::PlayEvent(mozilla::gfx::Translator*) const /gecko/gfx/2d/RecordedEventImpl.h:2897:7
    #17 0x7f218c315a31 in std::function<bool (mozilla::gfx::RecordedEvent*)>::operator()(mozilla::gfx::RecordedEvent*) const /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14
    #18 0x7f218c2fc36d in bool mozilla::gfx::RecordedEvent::DoWithEvent<mozilla::gfx::EventStream>(mozilla::gfx::EventStream&, mozilla::gfx::RecordedEvent::EventType, std::function<bool (mozilla::gfx::RecordedEvent*)> const&) /gecko/gfx/2d/RecordedEventImpl.h:4061:5
    #19 0x7f2192a7d84b in mozilla::layout::PrintTranslator::TranslateRecording(mozilla::layout::PRFileDescStream&) /gecko/layout/printing/PrintTranslator.cpp:50:20
    #20 0x7f2192a81289 in mozilla::layout::RemotePrintJobParent::PrintPage(mozilla::layout::PRFileDescStream&, nsRefCountedHashtable<nsIntegralHashKey<unsigned long, 0>, RefPtr<mozilla::gfx::RecordedDependentSurface> >*) /gecko/layout/printing/ipc/RemotePrintJobParent.cpp:167:26
    #21 0x7f2192a8119b in mozilla::layout::RemotePrintJobParent::FinishProcessingPage(nsRefCountedHashtable<nsIntegralHashKey<unsigned long, 0>, RefPtr<mozilla::gfx::RecordedDependentSurface> >*) /gecko/layout/printing/ipc/RemotePrintJobParent.cpp:146:17
    #22 0x7f2192a8101b in mozilla::layout::RemotePrintJobParent::RecvProcessPage(nsTArray<unsigned long>&&) /gecko/layout/printing/ipc/RemotePrintJobParent.cpp:121:5
    #23 0x7f218b61134b in mozilla::layout::PRemotePrintJobParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PRemotePrintJobParent.cpp:332:28
    #24 0x7f218b131535 in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:6488:32
    #25 0x7f218ad8ec39 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /gecko/ipc/glue/MessageChannel.cpp:1658:25
    #26 0x7f218ad8c839 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /gecko/ipc/glue/MessageChannel.cpp:1583:9
    #27 0x7f218ad8dd77 in mozilla::ipc::MessageChannel::MessageTask::Run() /gecko/ipc/glue/MessageChannel.cpp:1480:14
    #28 0x7f218988d912 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:467:16
    #29 0x7f2189851eed in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:770:26
    #30 0x7f218984f448 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:606:15
    #31 0x7f218984fb59 in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:390:36
    #32 0x7f2189896051 in operator() /gecko/xpcom/threads/TaskController.cpp:124:37
    #33 0x7f2189896051 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /gecko/xpcom/threads/nsThreadUtils.h:531:5
    #34 0x7f2189872c97 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1171:16
    #35 0x7f218987e27c in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:467:10
    #36 0x7f218ad95edf in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:85:21
    #37 0x7f218ac1c221 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #38 0x7f218ac1c221 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #39 0x7f218ac1c221 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #40 0x7f2191c6efe7 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
    #41 0x7f219676b097 in nsAppStartup::Run() /gecko/toolkit/components/startup/nsAppStartup.cpp:295:30
    #42 0x7f21969949b4 in XREMain::XRE_mainRun() /gecko/toolkit/xre/nsAppRunner.cpp:5719:22
    #43 0x7f2196996ae9 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /gecko/toolkit/xre/nsAppRunner.cpp:5904:8
    #44 0x7f2196997823 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /gecko/toolkit/xre/nsAppRunner.cpp:5963:21
    #45 0x55af83632071 in do_main /gecko/browser/app/nsBrowserApp.cpp:225:22
    #46 0x55af83632071 in main /gecko/browser/app/nsBrowserApp.cpp:395:16
    #47 0x7f21ae1e50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #48 0x55af83580749 in _start (/home/worker/builds/m-c-20220209095640-fuzzing-asan-opt/firefox+0x5d749)

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220211164352-46048399bf0f.
The bug appears to have been introduced in the following build range:

Start: eaf8bc2be960664fafb9c09ec0235031b7364e9f (20210427223837)
End: c874dda7b295148436244ea50e63ec7e5a3c137d (20210430174909)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=eaf8bc2be960664fafb9c09ec0235031b7364e9f&tochange=c874dda7b295148436244ea50e63ec7e5a3c137d

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon was unable reproduce this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Jason Kratzer [:jkratzer]]

A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.

Comment 4

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/J3ejB7Sp4prXTkLXB3Mo8w/index.html

Comment 5

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20231118093245-391181d97b6b) but not with tip (mozilla-central 20241116092601-8cdd018168b0.)

The bug appears to have been fixed in the following build range:

Start: dd9e4e4efc0febc12d791201d0c0f054368de649 (20241105004636)
End: 0f235ae77130977658ba0d9f8f7cc20fcb4f4c4c (20241105045805)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=dd9e4e4efc0febc12d791201d0c0f054368de649&tochange=0f235ae77130977658ba0d9f8f7cc20fcb4f4c4c

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 6

[Tyson Smith [:tsmith]]

Fixed by bug 1873322.