1832812 - Crash [@ mozilla::ipc::IProtocol::CanSend] through [@ mozilla::dom::ContentParent::RecvBlurToParent]

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect, P2)

Description

[Christian Holler (:decoder)]

In experimental IPC fuzzing, we found the following crash on mozilla-central revision f14ed3bab724+ (fuzzing-asan-nyx-opt build):

==3886601==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000011 (pc 0x7fd005ee97ad bp 0x7ffdcc374090 sp 0x7ffdcc374070 T0)
    #0 0x7fd005ee97ad in mozilla::ipc::IProtocol::CanSend() const objdir-ff-asan-vanilla/dist/include/mozilla/ipc/ProtocolUtils.h:222:45
    #1 0x7fd007cf741a in mozilla::ipc::IProtocol::ChannelSend(mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) ipc/glue/ProtocolUtils.cpp:478:7
    #2 0x7fd01295f942 in mozilla::dom::PContentParent::SendBlurToChild(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, bool const&, bool const&, unsigned long const&) objdir-ff-asan-vanilla/ipc/ipdl/PContentParent.cpp:6015:21
    #3 0x7fd012670aac in mozilla::dom::ContentParent::RecvBlurToParent(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, bool, bool, bool, bool, unsigned long) dom/ipc/ContentParent.cpp:7682:17
    #4 0x7fd01299c59c in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) objdir-ff-asan-vanilla/ipc/ipdl/PContentParent.cpp:15939:81
    #5 0x7fd007cd8281 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) ipc/glue/MessageChannel.cpp:1806:25
    [...]

This looks like just more null checks missing, patch coming up.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Christian Holler (:decoder)]

Attachment: Bug 1832812 - Add missing null checks to ContentParent::RecvBlurToParent. r?nika

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Content Processes' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dd2c98ec091f
Add missing null checks to ContentParent::RecvBlurToParent. r=nika

Comment 6

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/dd2c98ec091f