1802044 - Crash in [@ RefPtr<T>::get | RefPtr<T>::operator mozilla::dom::CanonicalBrowsingContext* const | mozilla::a11y::DocAccessibleParent::GetBrowsingContext]

Status: RESOLVED DUPLICATE of bug 1802040

(Core :: Disability Access APIs, defect)

Description

[Chris Peterson [:cpeterson]]

These crashes look like a possible UAF because all the crashing addresses have e5s like 0x00e5e5e5e5e5e6d5.

We have 12 crashes from 9 Fenix Nightly users so far. The earliest crash report is from build ID 20221119085828. Here is the pushlog for that build ID:

https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3b5a8f67189bd6549f0da19ea5da4a53f7e5c79a&tochange=f7eac47f5daa86a7f28257322b36cf85ae49c7f6

Crash report: https://crash-stats.mozilla.org/report/index/2608abfe-1562-4d98-bb63-a7a6c0221122

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  RefPtr<mozilla::dom::CanonicalBrowsingContext>::get const  mfbt/RefPtr.h:286
0  libxul.so  RefPtr<mozilla::dom::CanonicalBrowsingContext>::operator mozilla::dom::CanonicalBrowsingContext* const&  mfbt/RefPtr.h:299
0  libxul.so  mozilla::a11y::DocAccessibleParent::GetBrowsingContext const  accessible/ipc/DocAccessibleParent.h:95
0  libxul.so  mozilla::a11y::DocAccessibleParent::GetFrom  accessible/ipc/DocAccessibleParent.cpp:1381
1  libxul.so  mozilla::a11y::FocusManager::FocusedAccessible const  accessible/base/FocusManager.cpp:97
2  libxul.so  mozilla::a11y::FocusManager::IsFocused const  accessible/base/FocusManager.h:47
2  libxul.so  mozilla::a11y::Accessible::ApplyImplicitState const  accessible/basetypes/Accessible.cpp:498
3  libxul.so  mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::State  accessible/ipc/RemoteAccessibleBase.cpp:1104
4  libxul.so  mozilla::a11y::RemoteAccessible::State  accessible/ipc/other/RemoteAccessible.cpp:26
5  libxul.so  mozilla::a11y::SessionAccessibility::PopulateNodeInfo  accessible/android/SessionAccessibility.cpp:874

Comment 1

[Chris Peterson [:cpeterson]]

@ Jamie: could this DocAccessibleParent crash be a regression from your fixes for shadow root bug 1800731, IsAbbreviation bug 1800780, or font family bug 1800181? Your fixes all landed in the pushlog for the first crashing build.