1794373 - Crash in [@ mozilla::nsDisplayList::DeleteAll]

Status: RESOLVED INCOMPLETE

(Core :: Web Painting, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/bdfb9f05-4086-4482-a5aa-1b43f0221006

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll mozilla::nsDisplayList::DeleteAll layout/painting/nsDisplayList.cpp:2343
0 xul.dll mozilla::RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3613
1 xul.dll mozilla::nsDisplayWrapList::Destroy layout/painting/nsDisplayList.h:4842
1 xul.dll mozilla::nsDisplayList::DeleteAll layout/painting/nsDisplayList.cpp:2343
1 xul.dll mozilla::RetainedDisplayList::DeleteAll layout/painting/nsDisplayList.h:3613
2 xul.dll mozilla::nsDisplayWrapList::Destroy layout/painting/nsDisplayList.h:4842
2 xul.dll mozilla::nsDisplayList::DeleteAll layout/painting/nsDisplayList.cpp:2343
3 xul.dll nsLayoutUtils::GetFramesForArea layout/base/nsLayoutUtils.cpp:2801
4 xul.dll nsLayoutUtils::GetFrameForPoint layout/base/nsLayoutUtils.cpp:2742
5 xul.dll mozilla::FindFrameTargetedByInputEvent layout/base/PositionedEventTargeting.cpp:486

This crash is an obvious UAF, however that's not what worries me because the volume here is small. What worries me is that it seems eerily related to bug 1766471. Looking at the crashes in that bug it seems like we're always dereferencing a pointer that's completely bogus. Either it looks like an integer used for storing flags (e.g. 0x0b001000) or it appears like there's integer values (0x0000021700000218). Either way bug 1766471 looks like it's accessing some data that's been overwritten by something else.

So there's two possibilities: either we're dealing with a buffer overflow somewhere and it's stomping on our data, or we're dealing with a "late" use-after-free where we've deallocated the original object so long ago that we don't find the poison pattern anymore because memory has been re-used somewhere else.

Comments and URLs in those crashes point to either video (on Facebook, Twitch, Twitter plus a lot of NSFW sites) and viewing PDFs.

Furthermore there are more crash signatures that point to the same problem if you look at the stack, see this crash for example. Given the affected object seems to have been thoroughly overwritten with unrelated data I wouldn't be surprised if there would be even more similar crashes.

Comment 1

[Gabriele Svelto [:gsvelto]]

I'm not explicitly linking bug 1766471 because it's public and it's been so for a while, so I don't want to paint an obvious target over it.

Comment 2

[Gian-Carlo Pascutto [:gcp]]

I'm not explicitly linking bug 1766471 because it's public and it's been so for a while, so I don't want to paint an obvious target over it.

It's safe to do so, Bugzilla is now magic enough to not make the links show without proper access.

Comment 3

[Jeff Muizelaar [:jrmuizel]]

This is really hard to make actionable

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field for this bug is set to S3. However, the bug is flagged with the sec-high keyword.
:tnikkel, could you consider increasing the severity of this security bug?

For more information, please visit auto_nag documentation.

Comment 5

[Maire Reavy [:mreavy]]

(In reply to Jeff Muizelaar [:jrmuizel] from comment #3)

This is really hard to make actionable

Seems like this is stalled, but since this is a sec-high, I'd appreciate a double-check. Thanks, Jeff.

Comment 6

[Tom Ritter [:tjr]]

We are trying to close out unactionable bugs. This one is still pretty common, with ~150 crashes a release, but if we cannot move it forward, we can close it out for now.

Comment 7

[BugBot (nomail) [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit BugBot documentation.

Comment 8

[Gabriele Svelto [:gsvelto]]

Half of the most recent crashes are flagged as potentially caused by bit-flips, assuming there was a real bug when I filed it then it's not what we're seeing now. All the remaining crashes are likely caused by bad hardware.