1800446 - AddressSanitizer: heap-use-after-free [@ operator bool] with READ of size 8 through [@ WorkerScriptLoader::CancelMainThread]

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Christian Holler (:decoder)]

The attached crash information was submitted via the ASan Nightly Reporter on mozilla-central-asan-nightly revision 108.0a1-20221112215806-https://hg.mozilla.org/mozilla-central/rev/6479051196c1165c23a1964a00422e3be55f7ff1.

For detailed crash information, see attachment.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 3

[Jens Stutte [:jstutte]]

After bug 1797327 landed it seems there are still raw WorkerLoadContext* passed as a (copied) list into a runnable and one of these has been freed before the runnable was executed.

Comment 4

[Yulia Startsev [:yulia]]

Ok. I am already reverting the behavior, so this should be fixed by the revert.

Comment 5

[Jens Stutte [:jstutte]]

Now that bug 1800496 landed - are we confident enough to close this?

Comment 6

[Yulia Startsev [:yulia]]

This can be closed as we are no longer copying the array.

Comment 7

[Jens Stutte [:jstutte]]

Fixed by the changes in bug 1800496. Does that patch need uplift to beta 108 then?

Comment 8

[Yulia Startsev [:yulia]]

The changes may need an uplift as we keep getting reports related to this.

Comment 9

[Daniel Veditz [:dveditz]]

See also https://bugzilla.mozilla.org/show_bug.cgi?id=1793407#c4 where Yulia started talking about reverting the earlier changes back in October

Comment 10

[Dianna Smith [:diannaS]]

Just Following up on this since we are nearing the end of our beta cycle this week.
Can i get some clarification on what we are trying to uplift to fx108? Are we suggesting to uplift bug 1800496 (which seems very risky so late in the cycle) or are we trying to revert some behavior introduced in 108?
Thank you in advance!

Comment 11

[Yulia Startsev [:yulia]]

I believe it is too risky to uplift bug 1800496, as there are two follow up patches fixing behavior, so the sequence would be quite large. I think it should bake longer on nightly.

Comment 12

[Frederik Braun [:freddy]]

Looks like this bug was fixed regardless of this report. We knew the implementation had issues and worked on it independently (see other bug).
Thanks for reporting this, but at this time we're not awarding a bounty.