Closed Bug 1772465 Opened 4 years ago Closed 2 years ago

Intermittent SUMMARY: AddressSanitizer: heap-buffer-overflow /builds/worker/checkouts/gecko/js/src/vm/Scope.h:119:37 in name

Categories

(Core :: JavaScript Engine, defect, P2)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: intermittent-bug-filer, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: csectype-bounds, intermittent-failure, sec-high)

Filed by: nfay [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=380111291&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/OMHVdzFVRQWwu3kLx9VsZg/runs/0/artifacts/public/logs/live_backing.log
Reftest URL: https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/OMHVdzFVRQWwu3kLx9VsZg/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

[task 2022-06-03T03:17:44.157Z] 03:17:44     INFO - REFTEST TEST-START | dom/canvas/test/reftest/webgl-color-test.html?frame=6&readback&__&________&premult&_____ == dom/canvas/test/reftest/wrapper.html?colors-no-alpha.png
[task 2022-06-03T03:17:44.161Z] 03:17:44     INFO - REFTEST INFO | RESTORE PREFERENCE pref(webgl.force-layers-readback,false)
[task 2022-06-03T03:17:44.163Z] 03:17:44     INFO - REFTEST INFO | RESTORE PREFERENCE pref(webgl.force-enabled,false)
[task 2022-06-03T03:17:44.167Z] 03:17:44     INFO - REFTEST INFO | SET PREFERENCE pref(webgl.force-enabled,true)
[task 2022-06-03T03:17:44.168Z] 03:17:44     INFO - REFTEST INFO | SET PREFERENCE pref(webgl.force-layers-readback,true)
[task 2022-06-03T03:17:44.168Z] 03:17:44     INFO - REFTEST TEST-LOAD | file:///builds/worker/workspace/build/tests/reftest/tests/dom/canvas/test/reftest/webgl-color-test.html?frame=6&readback&__&________&premult&_____ | 61 / 172 (35%)
[task 2022-06-03T03:17:44.454Z] 03:17:44     INFO - =================================================================
[task 2022-06-03T03:17:44.455Z] 03:17:44    ERROR - ==2127==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030007c7ee0 at pc 0x7f40059fa3d3 bp 0x7ffe700f9270 sp 0x7ffe700f9268
[task 2022-06-03T03:17:44.456Z] 03:17:44     INFO - READ of size 8 at 0x6030007c7ee0 thread T0
[task 2022-06-03T03:17:45.703Z] 03:17:45     INFO -     #0 0x7f40059fa3d2 in name /builds/worker/checkouts/gecko/js/src/vm/Scope.h:119:37
[task 2022-06-03T03:17:45.710Z] 03:17:45     INFO -     #1 0x7f40059fa3d2 in js::GCMarker::eagerlyMarkChildren(js::Scope*) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1549:50
[task 2022-06-03T03:17:45.711Z] 03:17:45     INFO -     #2 0x7f40059ed8df in bool js::gc::TraceEdgeInternal<js::Scope*>(JSTracer*, js::Scope**, char const*) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:727:5
[task 2022-06-03T03:17:45.711Z] 03:17:45     INFO -     #3 0x7f40059cd84c in TraceManuallyBarrieredEdge<js::Scope *> /builds/worker/checkouts/gecko/js/src/gc/Tracer.h:215:3
[task 2022-06-03T03:17:45.712Z] 03:17:45     INFO -     #4 0x7f40059cd84c in operator()<js::Scope *> /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:646:35
[task 2022-06-03T03:17:45.713Z] 03:17:45     INFO -     #5 0x7f40059cd84c in auto JS::MapGCThingTyped<js::TraceManuallyBarrieredGenericPointerEdge(JSTracer*, js::gc::Cell**, char const*)::$_1>(void*, JS::TraceKind, js::TraceManuallyBarrieredGenericPointerEdge(JSTracer*, js::gc::Cell**, char const*)::$_1&&) /builds/worker/workspace/obj-build/dist/include/js/TraceKind.h:252:5
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #6 0x7f40059cd452 in js::TraceManuallyBarrieredGenericPointerEdge(JSTracer*, js::gc::Cell**, char const*) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:644:17
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #7 0x7f40050c894b in js::PrivateScriptData::trace(JSTracer*) /builds/worker/checkouts/gecko/js/src/vm/JSScript.cpp:2291:5
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #8 0x7f40059cff9c in js::BaseScript::traceChildren(JSTracer*) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1274:12
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #9 0x7f40059d3a90 in js::GCMarker::processMarkStackTop(js::SliceBudget&) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1955:22
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #10 0x7f40059d2e9e in js::GCMarker::markUntilBudgetExhausted(js::SliceBudget&, js::GCMarker::ShouldReportMarkTime) /builds/worker/checkouts/gecko/js/src/gc/Marking.cpp:1818:7
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #11 0x7f4005995e1a in js::gc::GCRuntime::markUntilBudgetExhausted(js::SliceBudget&, js::GCMarker::ShouldReportMarkTime) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:2780:17
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #12 0x7f40059998d1 in js::gc::GCRuntime::incrementalSlice(js::SliceBudget&, JS::GCReason, bool) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:3200:13
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #13 0x7f400599ecb8 in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget const&, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:3732:3
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #14 0x7f40059a0be0 in js::gc::GCRuntime::collect(bool, js::SliceBudget const&, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:3917:9
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #15 0x7f3ffafff9c1 in GarbageCollectImpl(JS::GCReason, nsJSContext::IsShrinking, js::SliceBudget const&) /builds/worker/checkouts/gecko/dom/base/nsJSEnvironment.cpp:1049:5
[task 2022-06-03T03:17:45.715Z] 03:17:45     INFO -     #16 0x7f3ffafffd10 in nsJSContext::RunIncrementalGCSlice(JS::GCReason, nsJSContext::IsShrinking, js::SliceBudget&) /builds/worker/checkouts/gecko/dom/base/nsJSEnvironment.cpp:1086:3
[task 2022-06-03T03:17:45.716Z] 03:17:45     INFO -     #17 0x7f3ffabc01a8 in mozilla::CCGCScheduler::GCRunnerFiredDoGC(mozilla::TimeStamp, mozilla::GCRunnerStep const&) /builds/worker/checkouts/gecko/dom/base/CCGCScheduler.cpp:355:3
[task 2022-06-03T03:17:45.716Z] 03:17:45     INFO -     #18 0x7f3ffabbfa7b in mozilla::CCGCScheduler::GCRunnerFired(mozilla::TimeStamp) /builds/worker/checkouts/gecko/dom/base/CCGCScheduler.cpp:317:10
[task 2022-06-03T03:17:45.717Z] 03:17:45     INFO -     #19 0x7f3ff7fc20ef in std::function<bool (mozilla::TimeStamp)>::operator()(mozilla::TimeStamp) const /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14
[task 2022-06-03T03:17:45.718Z] 03:17:45     INFO -     #20 0x7f3ff7fc1cb8 in mozilla::IdleTaskRunner::Run() /builds/worker/checkouts/gecko/xpcom/threads/IdleTaskRunner.cpp:124:14
[task 2022-06-03T03:17:45.719Z] 03:17:45     INFO -     #21 0x7f3ff7fc2f8f in mozilla::IdleTaskRunnerTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/IdleTaskRunner.cpp:45:15
[task 2022-06-03T03:17:45.719Z] 03:17:45     INFO -     #22 0x7f3ff7fe5285 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:788:26
[task 2022-06-03T03:17:45.720Z] 03:17:45     INFO -     #23 0x7f3ff7fe2755 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:662:15
[task 2022-06-03T03:17:45.721Z] 03:17:45     INFO -     #24 0x7f3ff7fe2b60 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:398:36
[task 2022-06-03T03:17:45.721Z] 03:17:45     INFO -     #25 0x7f3ff8028871 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:124:37
[task 2022-06-03T03:17:45.722Z] 03:17:45     INFO -     #26 0x7f3ff8028871 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
[task 2022-06-03T03:17:45.723Z] 03:17:45     INFO -     #27 0x7f3ff8005f57 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1180:16
[task 2022-06-03T03:17:45.723Z] 03:17:45     INFO -     #28 0x7f3ff8010384 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465:10
[task 2022-06-03T03:17:45.724Z] 03:17:45     INFO -     #29 0x7f3ff95e41d8 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
[task 2022-06-03T03:17:45.725Z] 03:17:45     INFO -     #30 0x7f3ff9481f01 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380:10
[task 2022-06-03T03:17:45.725Z] 03:17:45     INFO -     #31 0x7f3ff9481f01 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373:3
[task 2022-06-03T03:17:45.726Z] 03:17:45     INFO -     #32 0x7f3ff9481f01 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355:3
[task 2022-06-03T03:17:45.727Z] 03:17:45     INFO -     #33 0x7f3fffdcb3b7 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
[task 2022-06-03T03:17:45.727Z] 03:17:45     INFO -     #34 0x7f40048e3b57 in nsAppStartup::Run() /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:295:30
[task 2022-06-03T03:17:45.728Z] 03:17:45     INFO -     #35 0x7f4004b1006e in XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5733:22
[task 2022-06-03T03:17:45.729Z] 03:17:45     INFO -     #36 0x7f4004b11dee in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5927:8
[task 2022-06-03T03:17:45.729Z] 03:17:45     INFO -     #37 0x7f4004b12b5b in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5991:21
[task 2022-06-03T03:17:45.730Z] 03:17:45     INFO -     #38 0x55e46af82a39 in do_main(int, char**, char**) /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:227:22
[task 2022-06-03T03:17:45.730Z] 03:17:45     INFO -     #39 0x55e46af81cae in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:406:16
[task 2022-06-03T03:17:45.731Z] 03:17:45     INFO -     #40 0x7f401e0a1b96 in __libc_start_main /tmp/glibc/csu/../csu/libc-start.c:310
[task 2022-06-03T03:17:45.732Z] 03:17:45     INFO -     #41 0x55e46aec1c80 in _start (/builds/worker/workspace/build/application/firefox/firefox+0x72c80) (BuildId: f7e6bb82dce598ee3724ae3ff960bdab24062d57)
[task 2022-06-03T03:17:45.732Z] 03:17:45     INFO - 0x6030007c7ee0 is located 0 bytes to the right of 32-byte region [0x6030007c7ec0,0x6030007c7ee0)
[task 2022-06-03T03:17:45.733Z] 03:17:45     INFO - allocated by thread T0 here:
[task 2022-06-03T03:17:45.891Z] 03:17:45     INFO -     #0 0x55e46af4419e in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
[task 2022-06-03T03:17:45.892Z] 03:17:45     INFO -     #1 0x7f4005327de7 in js_arena_malloc /builds/worker/workspace/obj-build/dist/include/js/Utility.h:366:10
[task 2022-06-03T03:17:45.893Z] 03:17:45     INFO -     #2 0x7f4005327de7 in js_pod_arena_malloc<unsigned char> /builds/worker/workspace/obj-build/dist/include/js/Utility.h:575:26
[task 2022-06-03T03:17:45.894Z] 03:17:45     INFO -     #3 0x7f4005327de7 in maybe_pod_arena_malloc<unsigned char> /builds/worker/checkouts/gecko/js/src/vm/MallocProvider.h:57:12
[task 2022-06-03T03:17:45.895Z] 03:17:45     INFO -     #4 0x7f4005327de7 in pod_arena_malloc<unsigned char> /builds/worker/checkouts/gecko/js/src/vm/MallocProvider.h:109:12
[task 2022-06-03T03:17:45.896Z] 03:17:45     INFO -     #5 0x7f4005327de7 in pod_malloc<unsigned char> /builds/worker/checkouts/gecko/js/src/vm/MallocProvider.h:127:12
[task 2022-06-03T03:17:45.897Z] 03:17:45     INFO -     #6 0x7f4005327de7 in mozilla::UniquePtr<js::LexicalScope::AbstractData<JSAtom>, JS::DeletePolicy<js::LexicalScope::AbstractData<JSAtom> > > NewEmptyScopeData<js::LexicalScope, JSAtom>(JSContext*, unsigned int) /builds/worker/checkouts/gecko/js/src/vm/Scope.cpp:215:24
[task 2022-06-03T03:17:45.898Z] 03:17:45     INFO -     #7 0x7f40053278d7 in mozilla::UniquePtr<js::LexicalScope::RuntimeData, JS::DeletePolicy<js::LexicalScope::RuntimeData> > LiftParserScopeData<js::LexicalScope>(JSContext*, js::frontend::CompilationAtomCache&, js::AbstractBaseScopeData<js::frontend::TaggedParserAtomIndex>*) /builds/worker/checkouts/gecko/js/src/vm/Scope.cpp:249:7
[task 2022-06-03T03:17:45.899Z] 03:17:45     INFO -     #8 0x7f40052c2e11 in createSpecificScopeData<js::LexicalScope> /builds/worker/checkouts/gecko/js/src/vm/Scope.cpp:1628:10
[task 2022-06-03T03:17:45.907Z] 03:17:45     INFO -     #9 0x7f40052c2e11 in js::Scope* js::frontend::ScopeStencil::createSpecificScope<js::LexicalScope, js::BlockLexicalEnvironmentObject>(JSContext*, js::frontend::CompilationAtomCache&, JS::Handle<js::Scope*>, js::AbstractBaseScopeData<js::frontend::TaggedParserAtomIndex>*) const /builds/worker/checkouts/gecko/js/src/vm/Scope.cpp:1693:11
[task 2022-06-03T03:17:45.907Z] 03:17:45     INFO -     #10 0x7f40058af9d4 in js::frontend::ScopeStencil::createScope(JSContext*, js::frontend::CompilationInput&, js::frontend::CompilationGCOutput&, js::AbstractBaseScopeData<js::frontend::TaggedParserAtomIndex>*) const /builds/worker/checkouts/gecko/js/src/frontend/Stencil.cpp:1196:10
[task 2022-06-03T03:17:45.908Z] 03:17:45     INFO -     #11 0x7f40058b2791 in InstantiateScopes(JSContext*, js::frontend::CompilationInput&, js::frontend::CompilationStencil const&, js::frontend::CompilationGCOutput&) /builds/worker/checkouts/gecko/js/src/frontend/Stencil.cpp:1547:41
[task 2022-06-03T03:17:45.909Z] 03:17:45     INFO -     #12 0x7f40058b11f1 in js::frontend::CompilationStencil::instantiateStencilAfterPreparation(JSContext*, js::frontend::CompilationInput&, js::frontend::CompilationStencil const&, js::frontend::CompilationGCOutput&) /builds/worker/checkouts/gecko/js/src/frontend/Stencil.cpp:1979:8
[task 2022-06-03T03:17:45.909Z] 03:17:45     INFO -     #13 0x7f40057eb15d in js::frontend::InstantiateStencils(JSContext*, js::frontend::CompilationInput&, js::frontend::CompilationStencil const&, js::frontend::CompilationGCOutput&) /builds/worker/checkouts/gecko/js/src/frontend/BytecodeCompiler.cpp:414:10
[task 2022-06-03T03:17:45.910Z] 03:17:45     INFO -     #14 0x7f40058c8561 in JS::InstantiateGlobalStencil(JSContext*, JS::InstantiateOptions const&, js::frontend::CompilationStencil*) /builds/worker/checkouts/gecko/js/src/frontend/Stencil.cpp:4750:8
[task 2022-06-03T03:17:45.910Z] 03:17:45     INFO -     #15 0x7f3ff97c2f7e in mozJSComponentLoader::InstantiateStencil(JSContext*, js::frontend::CompilationStencil*, bool) /builds/worker/checkouts/gecko/js/xpconnect/loader/mozJSComponentLoader.cpp:1062:10
[task 2022-06-03T03:17:45.913Z] 03:17:45     INFO -     #16 0x7f3ff97c052c in mozJSComponentLoader::GetScriptForLocation(JSContext*, ComponentLoaderInfo&, nsIFile*, bool, JS::MutableHandle<JSScript*>, char**) /builds/worker/checkouts/gecko/js/xpconnect/loader/mozJSComponentLoader.cpp:976:18
[task 2022-06-03T03:17:45.914Z] 03:17:45     INFO -     #17 0x7f3ff97baf80 in mozJSComponentLoader::ObjectForLocation(ComponentLoaderInfo&, nsIFile*, JS::MutableHandle<JSObject*>, JS::MutableHandle<JSScript*>, char**, bool, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/xpconnect/loader/mozJSComponentLoader.cpp:810:8
[task 2022-06-03T03:17:45.914Z] 03:17:45     INFO -     #18 0x7f3ff97c7871 in mozJSComponentLoader::Import(JSContext*, nsTSubstring<char> const&, JS::MutableHandle<JSObject*>, JS::MutableHandle<JSObject*>, bool) /builds/worker/checkouts/gecko/js/xpconnect/loader/mozJSComponentLoader.cpp:1445:12
[task 2022-06-03T03:17:45.915Z] 03:17:45     INFO -     #19 0x7f3ffabe3ba9 in mozilla::dom::ChromeUtils::Import(mozilla::dom::GlobalObject const&, nsTSubstring<char> const&, mozilla::dom::Optional<JS::Handle<JSObject*> > const&, JS::MutableHandle<JSObject*>, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/ChromeUtils.cpp:542:31
[task 2022-06-03T03:17:45.915Z] 03:17:45     INFO -     #20 0x7f3ffc5b3098 in mozilla::dom::ChromeUtils_Binding::import(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/ChromeUtilsBinding.cpp:5093:3
[task 2022-06-03T03:17:45.915Z] 03:17:45     INFO -     #21 0x7f400651a7c0 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:420:13
[task 2022-06-03T03:17:45.916Z] 03:17:45     INFO -     #22 0x7f400651a7c0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:507:12
[task 2022-06-03T03:17:45.916Z] 03:17:45     INFO -     #23 0x7f4006508f6d in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:574:10
[task 2022-06-03T03:17:45.916Z] 03:17:45     INFO -     #24 0x7f4006508f6d in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:578:10
[task 2022-06-03T03:17:45.917Z] 03:17:45     INFO -     #25 0x7f4006508f6d in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3314:16
[task 2022-06-03T03:17:45.917Z] 03:17:45     INFO -     #26 0x7f40064ee6d9 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:389:13
[task 2022-06-03T03:17:45.917Z] 03:17:45     INFO -     #27 0x7f400651e435 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:781:13
[task 2022-06-03T03:17:45.918Z] 03:17:45     INFO -     #28 0x7f4004e16c95 in ExecuteInExtensibleLexicalEnvironment(JSContext*, JS::Handle<JSScript*>, JS::Handle<js::ExtensibleLexicalEnvironmentObject*>) /builds/worker/checkouts/gecko/js/src/builtin/Eval.cpp:397:10
[task 2022-06-03T03:17:45.919Z] 03:17:45     INFO -     #29 0x7f4004e1772e in JS::ExecuteInJSMEnvironment(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, JS::Handle<JS::StackGCVector<JSObject*, js::TempAllocPolicy> >) /builds/worker/checkouts/gecko/js/src/builtin/Eval.cpp:507:10
[task 2022-06-03T03:17:45.919Z] 03:17:45     INFO -     #30 0x7f4004e1728a in JS::ExecuteInJSMEnvironment(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>) /builds/worker/checkouts/gecko/js/src/builtin/Eval.cpp:460:10
[task 2022-06-03T03:17:45.920Z] 03:17:45     INFO -     #31 0x7f3ff97bb173 in mozJSComponentLoader::ObjectForLocation(ComponentLoaderInfo&, nsIFile*, JS::MutableHandle<JSObject*>, JS::MutableHandle<JSScript*>, char**, bool, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/xpconnect/loader/mozJSComponentLoader.cpp:844:19
[task 2022-06-03T03:17:45.921Z] 03:17:45     INFO -     #32 0x7f3ff97c7871 in mozJSComponentLoader::Import(JSContext*, nsTSubstring<char> const&, JS::MutableHandle<JSObject*>, JS::MutableHandle<JSObject*>, bool) /builds/worker/checkouts/gecko/js/xpconnect/loader/mozJSComponentLoader.cpp:1445:12
[task 2022-06-03T03:17:45.921Z] 03:17:45     INFO -     #33 0x7f3ffabe3ba9 in mozilla::dom::ChromeUtils::Import(mozilla::dom::GlobalObject const&, nsTSubstring<char> const&, mozilla::dom::Optional<JS::Handle<JSObject*> > const&, JS::MutableHandle<JSObject*>, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/ChromeUtils.cpp:542:31
[task 2022-06-03T03:17:45.922Z] 03:17:45     INFO -     #34 0x7f3ffc5b3098 in mozilla::dom::ChromeUtils_Binding::import(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/ChromeUtilsBinding.cpp:5093:3
[task 2022-06-03T03:17:45.922Z] 03:17:45     INFO -     #35 0x7f400651a7c0 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:420:13
[task 2022-06-03T03:17:45.923Z] 03:17:45     INFO -     #36 0x7f400651a7c0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:507:12
[task 2022-06-03T03:17:45.923Z] 03:17:45     INFO -     #37 0x7f4006508f6d in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:574:10
[task 2022-06-03T03:17:45.924Z] 03:17:45     INFO -     #38 0x7f4006508f6d in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:578:10
[task 2022-06-03T03:17:45.925Z] 03:17:45     INFO -     #39 0x7f4006508f6d in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3314:16
[task 2022-06-03T03:17:45.925Z] 03:17:45     INFO -     #40 0x7f40064ee6d9 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:389:13
[task 2022-06-03T03:17:45.926Z] 03:17:45     INFO -     #41 0x7f400651a8fe in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:539:13
[task 2022-06-03T03:17:45.926Z] 03:17:45     INFO - SUMMARY: AddressSanitizer: heap-buffer-overflow /builds/worker/checkouts/gecko/js/src/vm/Scope.h:119:37 in name
[task 2022-06-03T03:17:45.926Z] 03:17:45     INFO - Shadow bytes around the buggy address:
[task 2022-06-03T03:17:45.927Z] 03:17:45     INFO -   0x0c06800f0f80: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa
[task 2022-06-03T03:17:45.927Z] 03:17:45     INFO -   0x0c06800f0f90: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 fa
[task 2022-06-03T03:17:45.928Z] 03:17:45     INFO -   0x0c06800f0fa0: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
[task 2022-06-03T03:17:45.929Z] 03:17:45     INFO -   0x0c06800f0fb0: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
[task 2022-06-03T03:17:45.929Z] 03:17:45     INFO -   0x0c06800f0fc0: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
[task 2022-06-03T03:17:45.930Z] 03:17:45     INFO - =>0x0c06800f0fd0: fa fa fd fd fd fd fa fa 00 00 00 00[fa]fa fd fd
[task 2022-06-03T03:17:45.930Z] 03:17:45     INFO -   0x0c06800f0fe0: fd fd fa fa 00 00 00 fa fa fa fd fd fd fa fa fa
[task 2022-06-03T03:17:45.930Z] 03:17:45     INFO -   0x0c06800f0ff0: fd fd fd fa fa fa fa fa fa fa fa fa fd fd fd fa
[task 2022-06-03T03:17:45.931Z] 03:17:45     INFO -   0x0c06800f1000: fa fa fa fa fa fa fa fa fd fd fd fa fa fa fa fa
[task 2022-06-03T03:17:45.931Z] 03:17:45     INFO -   0x0c06800f1010: fa fa fa fa fd fd fd fd fa fa 00 00 00 00 fa fa
[task 2022-06-03T03:17:45.932Z] 03:17:45     INFO -   0x0c06800f1020: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
[task 2022-06-03T03:17:45.932Z] 03:17:45     INFO - Shadow byte legend (one shadow byte represents 8 application bytes):
[task 2022-06-03T03:17:45.933Z] 03:17:45     INFO -   Addressable:           00
[task 2022-06-03T03:17:45.933Z] 03:17:45     INFO -   Partially addressable: 01 02 03 04 05 06 07
[task 2022-06-03T03:17:45.934Z] 03:17:45     INFO -   Heap left redzone:       fa
[task 2022-06-03T03:17:45.934Z] 03:17:45     INFO -   Freed heap region:       fd
[task 2022-06-03T03:17:45.934Z] 03:17:45     INFO -   Stack left redzone:      f1
[task 2022-06-03T03:17:45.935Z] 03:17:45     INFO -   Stack mid redzone:       f2
[task 2022-06-03T03:17:45.935Z] 03:17:45     INFO -   Stack right redzone:     f3
[task 2022-06-03T03:17:45.936Z] 03:17:45     INFO -   Stack after return:      f5
[task 2022-06-03T03:17:45.936Z] 03:17:45     INFO -   Stack use after scope:   f8
[task 2022-06-03T03:17:45.937Z] 03:17:45     INFO -   Global redzone:          f9
[task 2022-06-03T03:17:45.937Z] 03:17:45     INFO -   Global init order:       f6
[task 2022-06-03T03:17:45.937Z] 03:17:45     INFO -   Poisoned by user:        f7
[task 2022-06-03T03:17:45.938Z] 03:17:45     INFO -   Container overflow:      fc
[task 2022-06-03T03:17:45.938Z] 03:17:45     INFO -   Array cookie:            ac
[task 2022-06-03T03:17:45.938Z] 03:17:45     INFO -   Intra object redzone:    bb
[task 2022-06-03T03:17:45.939Z] 03:17:45     INFO -   ASan internal:           fe
[task 2022-06-03T03:17:45.940Z] 03:17:45     INFO -   Left alloca redzone:     ca
[task 2022-06-03T03:17:45.940Z] 03:17:45     INFO -   Right alloca redzone:    cb
[task 2022-06-03T03:17:45.940Z] 03:17:45     INFO - ==2127==ABORTING
[task 2022-06-03T03:17:46.034Z] 03:17:46     INFO - Exiting due to channel error.
[task 2022-06-03T03:17:46.036Z] 03:17:46     INFO - Exiting due to channel error.
[task 2022-06-03T03:17:46.037Z] 03:17:46     INFO - Exiting due to channel error.
[task 2022-06-03T03:17:46.038Z] 03:17:46     INFO - Exiting due to channel error.
[task 2022-06-03T03:17:46.039Z] 03:17:46     INFO - Exiting due to channel error.
[task 2022-06-03T03:17:46.041Z] 03:17:46     INFO - Exiting due to channel error.
[task 2022-06-03T03:17:46.082Z] 03:17:46    ERROR - TEST-UNEXPECTED-FAIL | dom/canvas/test/reftest/webgl-color-test.html?frame=6&readback&__&________&premult&_____ | application terminated with exit code 1
[task 2022-06-03T03:17:46.106Z] 03:17:46     INFO - REFTEST INFO | Process mode: e10s
[task 2022-06-03T03:17:46.107Z] 03:17:46  WARNING - leakcheck | refcount logging is off, so leaks can't be detected!
[task 2022-06-03T03:17:46.108Z] 03:17:46     INFO - REFTEST INFO | Running tests in file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/async-scrolling/reftest.list
[task 2022-06-03T03:17:46.141Z] 03:17:46     INFO - REFTEST INFO | Running with e10s: True
[task 2022-06-03T03:17:46.141Z] 03:17:46     INFO - REFTEST INFO | Running with fission: True
[task 2022-06-03T03:17:46.141Z] 03:17:46     INFO - REFTEST INFO | INFO | runtests.py | ASan using symbolizer at /builds/worker/workspace/build/application/firefox/llvm-symbolizer
[task 2022-06-03T03:17:46.147Z] 03:17:46     INFO - REFTEST INFO | INFO | runtests.py | ASan running in default memory configuration
[task 2022-06-03T03:17:46.147Z] 03:17:46     INFO - REFTEST INFO | UBSan enabled.
[task 2022-06-03T03:17:46.147Z] 03:17:46     INFO - REFTEST INFO | Application command: /builds/worker/workspace/build/application/firefox/firefox -marionette -profile /tmp/tmpkt_theyx.mozrunner
[task 2022-06-03T03:17:47.452Z] 03:17:47     INFO - 1654226267451	Marionette	INFO	Marionette enabled
[task 2022-06-03T03:17:47.457Z] 03:17:47     INFO - 1654226267456	Marionette	TRACE	Received observer notification final-ui-startup
[task 2022-06-03T03:17:47.461Z] 03:17:47     INFO - 1654226267460	Marionette	INFO	Listening on port 2828
[task 2022-06-03T03:17:47.461Z] 03:17:47     INFO - 1654226267460	Marionette	DEBUG	Marionette is listening
[task 2022-06-03T03:17:47.734Z] 03:17:47     INFO - 1654226267733	Marionette	DEBUG	Accepted connection 0 from 127.0.0.1:49588
[task 2022-06-03T03:17:47.813Z] 03:17:47     INFO - 1654226267812	Marionette	DEBUG	Accepted connection 1 from 127.0.0.1:49590
[task 2022-06-03T03:17:47.816Z] 03:17:47     INFO - 1654226267813	Marionette	DEBUG	Closed connection 0
[task 2022-06-03T03:17:47.904Z] 03:17:47     INFO - 1654226267903	Marionette	DEBUG	1 -> [0,1,"WebDriver:NewSession",{"strictFileInteractability":true}]
[task 2022-06-03T03:17:47.913Z] 03:17:47     INFO - 1654226267912	Marionette	DEBUG	Waiting for initial application window
[task 2022-06-03T03:17:50.815Z] 03:17:50     INFO - console.warn: SearchSettings: "get: No settings file exists, new profile?" (new NotFoundError("Could not open the file at /tmp/tmpkt_theyx.mozrunner/search.json.mozlz4", (void 0)))
[task 2022-06-03T03:17:53.443Z] 03:17:53     INFO - 1654226273441	Marionette	TRACE	Received observer notification browser-idle-startup-tasks-finished
[task 2022-06-03T03:17:53.498Z] 03:17:53     INFO - 1654226273497	RemoteAgent	TRACE	[24] Document already finished loading: about:blank
[task 2022-06-03T03:17:53.532Z] 03:17:53     INFO - 1654226273530	Marionette	DEBUG	1 <- [1,1,null,{"sessionId":"6139148e-bd02-49bd-a77e-9c1774009780","capabilities":{"browserName":"firefox","browserVersion":"103.0 ... wnTimeout":300000,"moz:useNonSpecCompliantPointerOrigin":false,"moz:webdriverClick":true,"moz:windowless":false,"proxy":{}}}]
[task 2022-06-03T03:17:53.573Z] 03:17:53     INFO - 1654226273570	Marionette	DEBUG	1 -> [0,2,"Addon:Install",{"path":"/builds/worker/workspace/build/tests/reftest/specialpowers","temporary":true}]
[task 2022-06-03T03:17:53.610Z] 03:17:53     INFO - 1654226273609	Marionette	DEBUG	1 <- [1,2,null,{"value":"special-powers@mozilla.org"}]
[task 2022-06-03T03:17:53.617Z] 03:17:53     INFO - 1654226273616	Marionette	DEBUG	1 -> [0,3,"Addon:Install",{"path":"/builds/worker/workspace/build/tests/reftest/reftest","temporary":true}]
[task 2022-06-03T03:17:53.677Z] 03:17:53     INFO - 1654226273676	Marionette	TRACE	Received observer notification domwindowopened
[task 2022-06-03T03:17:53.683Z] 03:17:53     INFO - 1654226273682	Marionette	DEBUG	1 <- [1,3,null,{"value":"reftest@mozilla.org"}]
[task 2022-06-03T03:17:53.691Z] 03:17:53     INFO - 1654226273690	Marionette	DEBUG	1 -> [0,4,"WebDriver:DeleteSession",{}]
[task 2022-06-03T03:17:53.700Z] 03:17:53     INFO - 1654226273699	Marionette	DEBUG	1 <- [1,4,null,{"value":null}]
[task 2022-06-03T03:17:53.703Z] 03:17:53     INFO - 1654226273702	Marionette	DEBUG	Closed connection 1
[task 2022-06-03T03:17:54.296Z] 03:17:54     INFO - REFTEST TEST-START | layout/reftests/async-scrolling/bg-fixed-1.html == layout/reftests/async-scrolling/bg-fixed-1-ref.html

It looks like something is going wrong when tracing a Scope. arai, any ideas? Thanks.

Group: core-security → javascript-core-security
Flags: needinfo?(arai.unmht)
Keywords: csectype-bounds

"located 0 bytes to the right of 32-byte region" sounds like maybe it is an off by 1 error or something.

32 bytes allocated there means 2 lexical bindings, 16 bytes for RuntimeData + 2 bindings

  • uint32_t AbstractBaseScopeData<JSAtom>::length
  • uint32_t LexicalScope::SlotInfo::nextFrameSlot
  • uint32_t LexicalScope::SlotInfo::constStart
  • 4 bytes padding
  • uintptr_t AbstractBindingName<JSAtom>::bits_
  • uintptr_t AbstractBindingName<JSAtom>::bits_

and accessing the next memory means either:

  • It's treated as other scope than LexicalScope, and the starting address of the bindings shifts
    • FunctionScope = 24 bytes for RuntimeData => accesses 0x6030007c7ee0 when reading 2nd binding
    • ModuleScope = 32 bytes for RuntimeData => accesses 0x6030007c7ee0 when reading 1st binding
    • WasmInstanceScope = 24 bytes for RuntimeData => accesses 0x6030007c7ee0 when reading 2nd binding
  • the length data is broken and becomes greater than 2
    • bit flip?

Is the memory data around the 32 bytes region available somewhere?

Flags: needinfo?(continuation)

There's the "Shadow bytes around the buggy address" section, but I don't see anything in the report for the actual values.

Flags: needinfo?(continuation)

At this point, most likely thing is data corruption either in the AbstractBaseScopeData::length part or Scope::kind_ part.
I'd like to wait for more reports to see if this keeps happening.

If this keeps happening, I'll look into the way to see the actual values around the invalid access.

Flags: needinfo?(arai.unmht)
Blocks: sm-security, sm-frontend
Severity: -- → S4
Keywords: stalled
Priority: -- → P2
Keywords: sec-high

The severity field for this bug is set to S4. However, the bug is flagged with the sec-high keyword.
:sdetar, could you consider increasing the severity of this security bug?

For more information, please visit auto_nag documentation.

Flags: needinfo?(sdetar)

This bug is not actionable at this time and is marked as stalled.

Flags: needinfo?(sdetar)

This intermittent hasn't been seen in the past 6 months according to the treeherder tool

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit BugBot documentation.

Keywords: stalled
Group: javascript-core-security
You need to log in before you can comment on or make changes to this bug.