1832897 - crash near null in [@ mozilla::a11y::DocAccessibleParent::RecvHideEvent]

Status: VERIFIED FIXED

(Core :: Disability Access APIs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230509-44770d5c9e91 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

==125461==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x7f566b429e93 bp 0x7ffe8742cf90 sp 0x7ffe8742cf50 T0)
==125461==The signal is caused by a READ memory access.
==125461==Hint: address points to the zero page.
    #0 0x7f566b429e93 in Hdr /builds/worker/workspace/obj-build/dist/include/nsTArray.h:575:51
    #1 0x7f566b429e93 in Elements /builds/worker/workspace/obj-build/dist/include/nsTArray.h:1185:48
    #2 0x7f566b429e93 in unsigned long nsTArray_Impl<mozilla::a11y::RemoteAccessible*, nsTArrayInfallibleAllocator>::IndexOf<mozilla::a11y::RemoteAccessible*, nsDefaultComparator<mozilla::a11y::RemoteAccessible*, mozilla::a11y::RemoteAccessible*>>(mozilla::a11y::RemoteAccessible* const&, unsigned long, nsDefaultComparator<mozilla::a11y::RemoteAccessible*, mozilla::a11y::RemoteAccessible*> const&) const /builds/worker/workspace/obj-build/dist/include/nsTArray.h:1342:30
    #3 0x7f566b402b36 in RemoveElement<mozilla::a11y::RemoteAccessible *, nsDefaultComparator<mozilla::a11y::RemoteAccessible *, mozilla::a11y::RemoteAccessible *> > /builds/worker/workspace/obj-build/dist/include/nsTArray.h:1953:20
    #4 0x7f566b402b36 in RemoveElement<mozilla::a11y::RemoteAccessible *> /builds/worker/workspace/obj-build/dist/include/nsTArray.h:1966:12
    #5 0x7f566b402b36 in mozilla::a11y::RemoteAccessibleBase<mozilla::a11y::RemoteAccessible>::RemoveChild(mozilla::a11y::RemoteAccessible*) /builds/worker/workspace/obj-build/dist/include/mozilla/a11y/RemoteAccessibleBase.h:132:15
    #6 0x7f566b4021aa in mozilla::a11y::DocAccessibleParent::RecvHideEvent(unsigned long const&, bool const&) /builds/worker/checkouts/gecko/accessible/ipc/DocAccessibleParent.cpp:343:11
    #7 0x7f566b504482 in mozilla::a11y::PDocAccessibleParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PDocAccessibleParent.cpp:8959:52
    #8 0x7f56654f946e in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:6660:32
    #9 0x7f565cc77cb5 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
    #10 0x7f565cc7362c in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
    #11 0x7f565cc74a1a in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
    #12 0x7f565cc75fc3 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
    #13 0x7f565b04c15a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
    #14 0x7f565b03ceaa in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:879:26
    #15 0x7f565b039da7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:702:15
    #16 0x7f565b03a68f in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
    #17 0x7f565b051881 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
    #18 0x7f565b051881 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #19 0x7f565b07d4fb in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1239:16
    #20 0x7f565b08af94 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
    #21 0x7f565cc824ce in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #22 0x7f565caac7ca in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10
    #23 0x7f565caac7ca in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
    #24 0x7f565caac7ca in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
    #25 0x7f56663d8309 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
    #26 0x7f566c09344b in nsAppStartup::Run() /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:295:30
    #27 0x7f566c39054c in XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5657:22
    #28 0x7f566c39223b in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5857:8
    #29 0x7f566c393331 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5913:21
    #30 0x55da00a96383 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:227:22
    #31 0x55da00a96383 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:445:16
    #32 0x7f5681a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #33 0x7f5681a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #34 0x55da009bfd58 in _start (/home/user/workspace/browsers/m-c-20230510213701-fuzzing-asan-opt/firefox+0x107d58) (BuildId: 1a6107a3fe794b68d29433eba1f4d947c1c8bb25)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

prefs.js file for bugmon

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230512180301-33f0079fba2d.
The bug appears to have been introduced in the following build range:

Start: a7a328c86d5bab5e73de7abf526304c96addccc3 (20230508201033)
End: cc7b419c4bbea93ee3364cf6749a0d6dcbb0a991 (20230508213519)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a7a328c86d5bab5e73de7abf526304c96addccc3&tochange=cc7b419c4bbea93ee3364cf6749a0d6dcbb0a991

Comment 3

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1455416

:nlapre, since you are the author of the regressor, bug 1455416, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Donal Meehan [:dmeehan]]

Setting 115 to Fixed as the regressor Bug 1455416 was backed out of central

Comment 5

[James Teh [:Jamie]]

Fixed by backout.

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230519041011-d97636946466.