1818836 - crash near null in [@ mozilla::a11y::HTMLImageMapAccessible::GetChildAccessibleFor]

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230224-4fba5295dc19 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

==351140==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000040 (pc 0x7fa9edcbc659 bp 0x7ffe55bc2d10 sp 0x7ffe55bc2cf0 T0)
==351140==The signal is caused by a READ memory access.
==351140==Hint: address points to the zero page.
    #0 0x7fa9edcbc659 in Length /builds/worker/workspace/obj-build/dist/include/nsTArray.h:410:37
    #1 0x7fa9edcbc659 in mozilla::a11y::HTMLImageMapAccessible::GetChildAccessibleFor(nsINode const*) const /builds/worker/checkouts/gecko/accessible/html/HTMLImageMapAccessible.cpp:104:31
    #2 0x7fa9edbd22d3 in GetAccessibleEvenIfNotInMapOrContainer /builds/worker/checkouts/gecko/accessible/generic/DocAccessible-inl.h:115:26
    #3 0x7fa9edbd22d3 in mozilla::a11y::FocusManager::FocusedLocalAccessible() const /builds/worker/checkouts/gecko/accessible/base/FocusManager.cpp:51:23
    #4 0x7fa9edbd25e8 in mozilla::a11y::FocusManager::FocusedAccessible() const /builds/worker/checkouts/gecko/accessible/base/FocusManager.cpp:73:32
    #5 0x7fa9edc5c2a9 in IsFocused /builds/worker/workspace/obj-build/dist/include/mozilla/a11y/FocusManager.h:48:12
    #6 0x7fa9edc5c2a9 in mozilla::a11y::DocAccessible::NativeState() const /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:235:19
    #7 0x7fa9edc9e9c1 in mozilla::a11y::RootAccessible::NativeState() const /builds/worker/checkouts/gecko/accessible/generic/RootAccessible.cpp:101:39
    #8 0x7fa9edc92734 in mozilla::a11y::LocalAccessible::State() /builds/worker/checkouts/gecko/accessible/generic/LocalAccessible.cpp:1525:20
    #9 0x7fa9edbbadd2 in mozilla::a11y::AccTextChangeEvent::AccTextChangeEvent(mozilla::a11y::LocalAccessible*, int, nsTSubstring<char16_t> const&, bool, mozilla::a11y::EIsFromUserInput) /builds/worker/checkouts/gecko/accessible/base/AccEvent.cpp:96:20
    #10 0x7fa9edbd1389 in mozilla::a11y::NotificationController::QueueMutationEvent(mozilla::a11y::AccTreeMutationEvent*) /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:284:38
    #11 0x7fa9edbd1867 in mozilla::a11y::TreeMutation::BeforeRemoval(mozilla::a11y::LocalAccessible*, bool) /builds/worker/checkouts/gecko/accessible/base/EventTree.cpp:71:21
    #12 0x7fa9edc67d74 in mozilla::a11y::DocAccessible::ContentRemoved(mozilla::a11y::LocalAccessible*) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:2187:6
    #13 0x7fa9edc613df in mozilla::a11y::DocAccessible::ContentRemoved(nsIContent*) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:2216:5
    #14 0x7fa9edc68291 in mozilla::a11y::DocAccessible::RecreateAccessible(nsIContent*) /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:1477:3
    #15 0x7fa9ea315976 in nsImageFrame::GetImageMap() /builds/worker/checkouts/gecko/layout/generic/nsImageFrame.cpp:2557:18
    #16 0x7fa9ea315152 in nsImageFrame::Init(nsIContent*, nsContainerFrame*, nsIFrame*) /builds/worker/checkouts/gecko/layout/generic/nsImageFrame.cpp:626:3
    #17 0x7fa9ea01ea83 in nsCSSFrameConstructor::InitAndRestoreFrame(nsFrameConstructorState const&, nsIContent*, nsContainerFrame*, nsIFrame*, bool) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:4636:14
    #18 0x7fa9ea02e548 in nsCSSFrameConstructor::ConstructFrameFromItemInternal(nsCSSFrameConstructor::FrameConstructionItem&, nsFrameConstructorState&, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:3785:7
    #19 0x7fa9ea0349aa in nsCSSFrameConstructor::ConstructFramesFromItem(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList::Iterator&, nsContainerFrame*, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:5596:3
    #20 0x7fa9ea01f138 in nsCSSFrameConstructor::ConstructFramesFromItemList(nsFrameConstructorState&, nsCSSFrameConstructor::FrameConstructionItemList&, nsContainerFrame*, bool, nsFrameList&) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:9536:5
    #21 0x7fa9ea039289 in nsCSSFrameConstructor::ContentRangeInserted(nsIContent*, nsIContent*, nsCSSFrameConstructor::InsertionKind) /builds/worker/checkouts/gecko/layout/base/nsCSSFrameConstructor.cpp:7204:3
    #22 0x7fa9e9fcde80 in mozilla::RestyleManager::ProcessRestyledFrames(nsStyleChangeList&) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:1593:25
    #23 0x7fa9e9fd69b4 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3166:9
    #24 0x7fa9e9f9cc26 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3251:3
    #25 0x7fa9e9f9b29a in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4328:39
    #26 0x7fa9e9f20671 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2623:22
    #27 0x7fa9e9f2ecf6 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:373:13
    #28 0x7fa9e9f2ecf6 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:351:7
    #29 0x7fa9e9f2ea5e in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:5
    #30 0x7fa9e9f2e7e5 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:911:5
    #31 0x7fa9e9f2da7f in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:825:5
    #32 0x7fa9e9f2ccb2 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:746:5
    #33 0x7fa9e9f2c4ab in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:592:14
    #34 0x7fa9e9f2c048 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:549:9
    #35 0x7fa9e897facc in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
    #36 0x7fa9e8e97b73 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:228:78
    #37 0x7fa9e8c6f48c in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8784:32
    #38 0x7fa9e22c1869 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
    #39 0x7fa9e22be87d in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
    #40 0x7fa9e22bf44e in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
    #41 0x7fa9e22c067e in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
    #42 0x7fa9e0a78a89 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:541:16
    #43 0x7fa9e0a6ee1c in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:855:26
    #44 0x7fa9e0a6c098 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:686:15
    #45 0x7fa9e0a6c7c0 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:464:36
    #46 0x7fa9e0a7ef61 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:188:37
    #47 0x7fa9e0a7ef61 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
    #48 0x7fa9e0aa37ae in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1225:16
    #49 0x7fa9e0aadd24 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:477:10
    #50 0x7fa9e22c946e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #51 0x7fa9e2148337 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
    #52 0x7fa9e2148337 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
    #53 0x7fa9e2148337 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
    #54 0x7fa9e98f4919 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
    #55 0x7fa9ee93c5c8 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:742:20
    #56 0x7fa9e2148337 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
    #57 0x7fa9e2148337 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
    #58 0x7fa9e2148337 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
    #59 0x7fa9ee93bd5f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:675:34
    #60 0x556de2f1d824 in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #61 0x556de2f1dce7 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:353:18
    #62 0x7faa037c0d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #63 0x7faa037c0e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #64 0x556de2e5c2a8 in _start (/home/user/workspace/browsers/m-c-20230224160401-fuzzing-asan-opt/firefox+0x1122a8) (BuildId: 32bcadd0083bdd09a566faa8cf12852ea688fe2b)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

prefs.js file for bugmon

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230224160401-25a8668d9243.
The bug appears to have been introduced in the following build range:

Start: dafb2e6890e11b74ec00d49c8f2767903a67aa92 (20230213153318)
End: 073223bab35f4149bf5665ec59b16684b7b9a65b (20230213163401)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=dafb2e6890e11b74ec00d49c8f2767903a67aa92&tochange=073223bab35f4149bf5665ec59b16684b7b9a65b

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1815913

:sefeng, since you are the author of the regressor, bug 1815913, could you take a look?

For more information, please visit auto_nag documentation.

Comment 4

[Sean Feng [:sefeng]]

Not exactly sure what is being null here. Tyson, can bugmon generate a pernosco session for it?

Comment 5

[Tyson Smith [:tsmith]]

Yes it should be able to. If bugmon has reproduced the issue adding the pernosco-wanted keyword will do the job.

Comment 6

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 7

[Jason Kratzer [:jkratzer]]

Apparently bugmon recorded a pernosco session but the session was invalid. We'll have a manual trace for this shortly.

Comment 8

[Sean Feng [:sefeng]]

Thanks, please let me know when it's ready!

Comment 9

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/yMX6PyiDKNi7LbPM8kujDg/index.html

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1815913

Comment 11

[Ryan VanderMeulen [:RyanVM]]

(In reply to Tyson Smith [:tsmith] from comment #9)

A Pernosco session is available here: https://pernos.co/debug/yMX6PyiDKNi7LbPM8kujDg/index.html

Sean, does this help?

Comment 12

[Sean Feng [:sefeng]]

Attachment: Bug 1818836 - Fix a null pointer crash in DocAccessible.cpp r=jamie

Comment 13

[Sean Feng [:sefeng]]

Yeah, this helps, thanks!!

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/31fd1782729f
Fix a null pointer crash in DocAccessible.cpp r=Jamie

Comment 15

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/31fd1782729f

Comment 16

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230504093414-0d4a9640bffd.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.