Closed Bug 1846835 Opened 3 years ago Closed 3 years ago

Intermittent SUMMARY: AddressSanitizer: stack-use-after-scope /builds/worker/checkouts/gecko/js/src/vm/StructuredClone.cpp:2482:20 in JSStructuredCloneReader::NurseryCollectionCallback(JSContext*, JS::GCNurseryProgress, JS::GCReason, void*)

Categories

(Core :: JavaScript: GC, defect)

Product:
Core
Component:
JavaScript: GC
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
118 Branch
Tracking Flags:
Tracking Status
firefox-esr102 --- unaffected
firefox-esr115 --- unaffected
firefox116 --- unaffected
firefox117 --- fixed
firefox118 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

(Regression)

Details

(Keywords: intermittent-failure, regression, sec-high)

Attachments

(2 external files)

Filed by: nbeleuzu [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=424685697&repo=mozilla-beta
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/Ocj_qhC0R8qlBltHrM30fA/runs/0/artifacts/public/logs/live_backing.log

[task 2023-08-02T18:59:24.546Z] 18:59:24     INFO - TEST-START | browser/base/content/test/tabdialogs/browser_multiple_dialog_navigation.js
[task 2023-08-02T18:59:25.247Z] 18:59:25     INFO - GECKO(3143) | JavaScript error: resource://gre/modules/XULStore.sys.mjs, line 60: Error: Can't find profile directory.
[task 2023-08-02T18:59:27.166Z] 18:59:27     INFO - GECKO(3143) | JavaScript error: resource://gre/modules/Prompter.sys.mjs, line 1201: SecurityError: Permission denied to access property "windowUtils" on cross-origin object
[task 2023-08-02T18:59:27.329Z] 18:59:27     INFO - GECKO(3143) | =================================================================
[task 2023-08-02T18:59:27.332Z] 18:59:27    ERROR - GECKO(3143) | ==3143==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffc0be78fc0 at pc 0x7f2cf6e0a7c0 bp 0x7ffc0be784b0 sp 0x7ffc0be784a8
[task 2023-08-02T18:59:27.332Z] 18:59:27     INFO - GECKO(3143) | WRITE of size 1 at 0x7ffc0be78fc0 thread T0
[task 2023-08-02T18:59:28.524Z] 18:59:28     INFO - GECKO(3143) |     #0 0x7f2cf6e0a7bf in JSStructuredCloneReader::NurseryCollectionCallback(JSContext*, JS::GCNurseryProgress, JS::GCReason, void*) /builds/worker/checkouts/gecko/js/src/vm/StructuredClone.cpp:2482:20
[task 2023-08-02T18:59:28.526Z] 18:59:28     INFO - GECKO(3143) |     #1 0x7f2cf76a69af in js::gc::GCRuntime::callNurseryCollectionCallbacks(JS::GCNurseryProgress, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:1526:5
[task 2023-08-02T18:59:28.527Z] 18:59:28     INFO - GECKO(3143) |     #2 0x7f2cf772a243 in js::Nursery::collect(JS::GCOptions, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/Nursery.cpp:1244:7
[task 2023-08-02T18:59:28.529Z] 18:59:28     INFO - GECKO(3143) |     #3 0x7f2cf76bd434 in js::gc::GCRuntime::collectNursery(JS::GCOptions, JS::GCReason, js::gcstats::PhaseKind) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:4609:13
[task 2023-08-02T18:59:28.531Z] 18:59:28     INFO - GECKO(3143) |     #4 0x7f2cf76bbb57 in collectNurseryFromMajorGC /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:3755:3
[task 2023-08-02T18:59:28.534Z] 18:59:28     INFO - GECKO(3143) |     #5 0x7f2cf76bbb57 in js::gc::GCRuntime::incrementalSlice(js::SliceBudget&, JS::GCReason, bool) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:3593:9
[task 2023-08-02T18:59:28.538Z] 18:59:28     INFO - GECKO(3143) |     #6 0x7f2cf76c05be in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget const&, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:4181:3
[task 2023-08-02T18:59:28.540Z] 18:59:28     INFO - GECKO(3143) |     #7 0x7f2cf76c2500 in js::gc::GCRuntime::collect(bool, js::SliceBudget const&, JS::GCReason) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:4372:9
[task 2023-08-02T18:59:28.541Z] 18:59:28     INFO - GECKO(3143) |     #8 0x7f2cf76a8a96 in gcSlice /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:4472:3
[task 2023-08-02T18:59:28.542Z] 18:59:28     INFO - GECKO(3143) |     #9 0x7f2cf76a8a96 in js::gc::GCRuntime::gcIfRequestedImpl(bool) /builds/worker/checkouts/gecko/js/src/gc/GC.cpp:4648:5
[task 2023-08-02T18:59:28.542Z] 18:59:28     INFO - GECKO(3143) |     #10 0x7f2cf767af22 in gcIfRequested /builds/worker/checkouts/gecko/js/src/gc/GCRuntime.h:327:33
[task 2023-08-02T18:59:28.543Z] 18:59:28     INFO - GECKO(3143) |     #11 0x7f2cf767af22 in void* js::gc::CellAllocator::TryNewTenuredCell<(js::AllowGC)1>(JS::RootingContext*, js::gc::AllocKind, unsigned long) /builds/worker/checkouts/gecko/js/src/gc/Allocator.cpp:156:25
[task 2023-08-02T18:59:28.544Z] 18:59:28     INFO - GECKO(3143) |     #12 0x7f2cf685de91 in AllocNurseryOrTenuredCell<(JS::TraceKind)0, (js::AllowGC)1> /builds/worker/checkouts/gecko/js/src/gc/Allocator.h:117:12
[task 2023-08-02T18:59:28.544Z] 18:59:28     INFO - GECKO(3143) |     #13 0x7f2cf685de91 in js::NativeObject* js::gc::CellAllocator::NewObject<js::NativeObject, (js::AllowGC)1>(JS::RootingContext*, js::gc::AllocKind, js::gc::Heap, JSClass const*, js::gc::AllocSite*) /builds/worker/checkouts/gecko/js/src/gc/Allocator.h:161:18
[task 2023-08-02T18:59:28.544Z] 18:59:28     INFO - GECKO(3143) |     #14 0x7f2cf6851efb in NewCell<js::NativeObject, (js::AllowGC)1, js::gc::AllocKind &, js::gc::Heap &, const JSClass *&, js::gc::AllocSite *&> /builds/worker/checkouts/gecko/js/src/gc/Allocator.h:196:12
[task 2023-08-02T18:59:28.545Z] 18:59:28     INFO - GECKO(3143) |     #15 0x7f2cf6851efb in newCell<js::NativeObject, (js::AllowGC)1, js::gc::AllocKind &, js::gc::Heap &, const JSClass *&, js::gc::AllocSite *&> /builds/worker/checkouts/gecko/js/src/vm/JSContext.h:217:12
[task 2023-08-02T18:59:28.545Z] 18:59:28     INFO - GECKO(3143) |     #16 0x7f2cf6851efb in js::NativeObject::create(JSContext*, js::gc::AllocKind, js::gc::Heap, JS::Handle<js::SharedShape*>, js::gc::AllocSite*) /builds/worker/checkouts/gecko/js/src/vm/NativeObject-inl.h:495:28
[task 2023-08-02T18:59:28.546Z] 18:59:28     INFO - GECKO(3143) |     #17 0x7f2cf6afeb01 in NewObject /builds/worker/checkouts/gecko/js/src/vm/JSObject.cpp:774:23
[task 2023-08-02T18:59:28.546Z] 18:59:28     INFO - GECKO(3143) |     #18 0x7f2cf6afeb01 in js::NewObjectWithGivenTaggedProto(JSContext*, JSClass const*, JS::Handle<js::TaggedProto>, js::gc::AllocKind, js::NewObjectKind) /builds/worker/checkouts/gecko/js/src/vm/JSObject.cpp:788:10
[task 2023-08-02T18:59:28.547Z] 18:59:28     INFO - GECKO(3143) |     #19 0x7f2cec228f20 in CreateObject /builds/worker/workspace/obj-build/dist/include/mozilla/dom/BindingUtils.h:2712:20
[task 2023-08-02T18:59:28.548Z] 18:59:28     INFO - GECKO(3143) |     #20 0x7f2cec228f20 in mozilla::dom::DOMException_Binding::Wrap(JSContext*, mozilla::dom::DOMException*, nsWrapperCache*, JS::Handle<JSObject*>, JS::MutableHandle<JSObject*>) /builds/worker/workspace/obj-build/dom/bindings/DOMExceptionBinding.cpp:842:11
[task 2023-08-02T18:59:28.549Z] 18:59:28     INFO - GECKO(3143) |     #21 0x7f2cea07f8f4 in Wrap<mozilla::dom::DOMException> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/DOMExceptionBinding.h:67:12
[task 2023-08-02T18:59:28.550Z] 18:59:28     INFO - GECKO(3143) |     #22 0x7f2cea07f8f4 in mozilla::dom::DOMException::WrapObject(JSContext*, JS::Handle<JSObject*>) /builds/worker/checkouts/gecko/dom/base/DOMException.cpp:374:10
[task 2023-08-02T18:59:28.551Z] 18:59:28     INFO - GECKO(3143) |     #23 0x7f2ceff2b785 in DoGetOrCreateDOMReflector<mozilla::dom::Exception, (mozilla::dom::binding_detail::GetOrCreateReflectorWrapBehavior)0> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/BindingUtils.h:1094:18
[task 2023-08-02T18:59:28.552Z] 18:59:28     INFO - GECKO(3143) |     #24 0x7f2ceff2b785 in GetOrCreateDOMReflector<mozilla::dom::Exception> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/BindingUtils.h:1163:10
[task 2023-08-02T18:59:28.553Z] 18:59:28     INFO - GECKO(3143) |     #25 0x7f2ceff2b785 in GetOrCreate /builds/worker/workspace/obj-build/dist/include/mozilla/dom/BindingUtils.h:1752:12
[task 2023-08-02T18:59:28.553Z] 18:59:28     INFO - GECKO(3143) |     #26 0x7f2ceff2b785 in GetOrCreateDOMReflector<mozilla::dom::Exception> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/BindingUtils.h:1760:10
[task 2023-08-02T18:59:28.553Z] 18:59:28     INFO - GECKO(3143) |     #27 0x7f2ceff2b785 in ToJSValue<mozilla::dom::Exception> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/ToJSValue.h:143:10
[task 2023-08-02T18:59:28.554Z] 18:59:28     INFO - GECKO(3143) |     #28 0x7f2ceff2b785 in ToJSValue<mozilla::dom::Exception> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/ToJSValue.h:268:10
[task 2023-08-02T18:59:28.554Z] 18:59:28     INFO - GECKO(3143) |     #29 0x7f2ceff2b785 in mozilla::dom::ClonedErrorHolder::ToErrorValue(JSContext*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/dom/ipc/ClonedErrorHolder.cpp:343:10
[task 2023-08-02T18:59:28.554Z] 18:59:28     INFO - GECKO(3143) |     #30 0x7f2ceff2aafb in mozilla::dom::ClonedErrorHolder::ReadStructuredClone(JSContext*, JSStructuredCloneReader*, mozilla::dom::StructuredCloneHolder*) /builds/worker/checkouts/gecko/dom/ipc/ClonedErrorHolder.cpp:226:43
[task 2023-08-02T18:59:28.556Z] 18:59:28     INFO - GECKO(3143) |     #31 0x7f2cea440709 in mozilla::dom::StructuredCloneHolder::CustomReadHandler(JSContext*, JSStructuredCloneReader*, JS::CloneDataPolicy const&, unsigned int, unsigned int) /builds/worker/checkouts/gecko/dom/base/StructuredCloneHolder.cpp:1105:12
[task 2023-08-02T18:59:28.558Z] 18:59:28     INFO - GECKO(3143) |     #32 0x7f2cf6e0cf94 in JSStructuredCloneReader::startRead(JS::MutableHandle<JS::Value>, JSStructuredCloneReader::ShouldAtomizeStrings) /builds/worker/checkouts/gecko/js/src/vm/StructuredClone.cpp:3196:11
[task 2023-08-02T18:59:28.559Z] 18:59:28     INFO - GECKO(3143) |     #33 0x7f2cf6df4e37 in JSStructuredCloneReader::read(JS::MutableHandle<JS::Value>, unsigned long) /builds/worker/checkouts/gecko/js/src/vm/StructuredClone.cpp:3763:8
[task 2023-08-02T18:59:28.559Z] 18:59:28     INFO - GECKO(3143) |     #34 0x7f2cf6df4879 in ReadStructuredClone(JSContext*, JSStructuredCloneData const&, JS::StructuredCloneScope, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, JSStructuredCloneCallbacks const*, void*) /builds/worker/checkouts/gecko/js/src/vm/StructuredClone.cpp:777:12
[task 2023-08-02T18:59:28.560Z] 18:59:28     INFO - GECKO(3143) |     #35 0x7f2cf6e192a1 in JS_ReadStructuredClone(JSContext*, JSStructuredCloneData const&, unsigned int, JS::StructuredCloneScope, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, JSStructuredCloneCallbacks const*, void*) /builds/worker/checkouts/gecko/js/src/vm/StructuredClone.cpp:3915:10
[task 2023-08-02T18:59:28.560Z] 18:59:28     INFO - GECKO(3143) |     #36 0x7f2cea43d982 in ReadFromBuffer /builds/worker/checkouts/gecko/dom/base/StructuredCloneHolder.cpp:425:8
[task 2023-08-02T18:59:28.560Z] 18:59:28     INFO - GECKO(3143) |     #37 0x7f2cea43d982 in mozilla::dom::StructuredCloneHolder::ReadFromBuffer(nsIGlobalObject*, JSContext*, JSStructuredCloneData&, JS::MutableHandle<JS::Value>, JS::CloneDataPolicy const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/StructuredCloneHolder.cpp:411:3
[task 2023-08-02T18:59:28.562Z] 18:59:28     INFO - GECKO(3143) |     #38 0x7f2ceffe6bd3 in Read /builds/worker/checkouts/gecko/dom/ipc/StructuredCloneData.cpp:114:3
[task 2023-08-02T18:59:28.564Z] 18:59:28     INFO - GECKO(3143) |     #39 0x7f2ceffe6bd3 in mozilla::dom::ipc::StructuredCloneData::Read(JSContext*, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/ipc/StructuredCloneData.cpp:102:3
[task 2023-08-02T18:59:28.564Z] 18:59:28     INFO - GECKO(3143) |     #40 0x7f2cf03eeba9 in mozilla::dom::JSActorManager::ReceiveRawMessage(mozilla::dom::JSActorMessageMeta const&, mozilla::Maybe<mozilla::dom::ipc::StructuredCloneData>&&, mozilla::Maybe<mozilla::dom::ipc::StructuredCloneData>&&) /builds/worker/checkouts/gecko/dom/ipc/jsactor/JSActorManager.cpp:189:12
[task 2023-08-02T18:59:28.565Z] 18:59:28     INFO - GECKO(3143) |     #41 0x7f2cf041817b in operator() /builds/worker/checkouts/gecko/dom/ipc/jsactor/JSActor.cpp:378:22
[task 2023-08-02T18:59:28.565Z] 18:59:28     INFO - GECKO(3143) |     #42 0x7f2cf041817b in mozilla::detail::RunnableFunction<mozilla::dom::JSActor::SendRawMessageInProcess(mozilla::dom::JSActorMessageMeta const&, mozilla::Maybe<mozilla::dom::ipc::StructuredCloneData>&&, mozilla::Maybe<mozilla::dom::ipc::StructuredCloneData>&&, std::function<already_AddRefed<mozilla::dom::JSActorManager> ()>&&)::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:548:5
[task 2023-08-02T18:59:28.566Z] 18:59:28     INFO - GECKO(3143) |     #43 0x7f2ce6a8dbea in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:559:16
[task 2023-08-02T18:59:28.566Z] 18:59:28     INFO - GECKO(3143) |     #44 0x7f2ce6a852db in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:886:26
[task 2023-08-02T18:59:28.568Z] 18:59:28     INFO - GECKO(3143) |     #45 0x7f2ce6a823c7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:709:15
[task 2023-08-02T18:59:28.569Z] 18:59:28     INFO - GECKO(3143) |     #46 0x7f2ce6a82ca9 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:495:36
[task 2023-08-02T18:59:28.570Z] 18:59:28     INFO - GECKO(3143) |     #47 0x7f2ce6a94a11 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
[task 2023-08-02T18:59:28.571Z] 18:59:28     INFO - GECKO(3143) |     #48 0x7f2ce6a94a11 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
[task 2023-08-02T18:59:28.571Z] 18:59:28     INFO - GECKO(3143) |     #49 0x7f2ce6abe384 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
[task 2023-08-02T18:59:28.572Z] 18:59:28     INFO - GECKO(3143) |     #50 0x7f2ce6acbc34 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
[task 2023-08-02T18:59:28.572Z] 18:59:28     INFO - GECKO(3143) |     #51 0x7f2ce8497308 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
[task 2023-08-02T18:59:28.572Z] 18:59:28     INFO - GECKO(3143) |     #52 0x7f2ce82eb19a in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
[task 2023-08-02T18:59:28.573Z] 18:59:28     INFO - GECKO(3143) |     #53 0x7f2ce82eb19a in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
[task 2023-08-02T18:59:28.573Z] 18:59:28     INFO - GECKO(3143) |     #54 0x7f2ce82eb19a in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
[task 2023-08-02T18:59:28.573Z] 18:59:28     INFO - GECKO(3143) |     #55 0x7f2cf10c0809 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
[task 2023-08-02T18:59:28.573Z] 18:59:28     INFO - GECKO(3143) |     #56 0x7f2cf612831b in nsAppStartup::Run() /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:295:30
[task 2023-08-02T18:59:28.574Z] 18:59:28     INFO - GECKO(3143) |     #57 0x7f2cf641a891 in XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5672:22
[task 2023-08-02T18:59:28.575Z] 18:59:28     INFO - GECKO(3143) |     #58 0x7f2cf641ca44 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5873:8
[task 2023-08-02T18:59:28.576Z] 18:59:28     INFO - GECKO(3143) |     #59 0x7f2cf641dc41 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5929:21
[task 2023-08-02T18:59:28.577Z] 18:59:28     INFO - GECKO(3143) |     #60 0x56046ac23e24 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:227:22
[task 2023-08-02T18:59:28.577Z] 18:59:28     INFO - GECKO(3143) |     #61 0x56046ac23e24 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:445:16
[task 2023-08-02T18:59:28.578Z] 18:59:28     INFO - GECKO(3143) |     #62 0x7f2d0b8f3b96 in __libc_start_main /tmp/glibc/csu/../csu/libc-start.c:310
[task 2023-08-02T18:59:28.578Z] 18:59:28     INFO - GECKO(3143) |     #63 0x56046ab4d858 in _start (/builds/worker/workspace/build/application/firefox/firefox+0xf8858) (BuildId: 9361cf65e2ab743c17baa1cd2bbb79ba9e4c02e2)
[task 2023-08-02T18:59:28.578Z] 18:59:28     INFO - GECKO(3143) | Address 0x7ffc0be78fc0 is located in stack of thread T0 at offset 64 in frame
[task 2023-08-02T18:59:28.579Z] 18:59:28     INFO - GECKO(3143) |     #0 0x7f2cec22882f in mozilla::dom::DOMException_Binding::Wrap(JSContext*, mozilla::dom::DOMException*, nsWrapperCache*, JS::Handle<JSObject*>, JS::MutableHandle<JSObject*>) /builds/worker/workspace/obj-build/dom/bindings/DOMExceptionBinding.cpp:780
[task 2023-08-02T18:59:28.579Z] 18:59:28     INFO - GECKO(3143) |   This frame has 7 object(s):
[task 2023-08-02T18:59:28.579Z] 18:59:28     INFO - GECKO(3143) |     [32, 40) 'ref.tmp.i290'
[task 2023-08-02T18:59:28.579Z] 18:59:28     INFO - GECKO(3143) |     [64, 72) 'ref.tmp16.i' <== Memory access at offset 64 is inside this variable
[task 2023-08-02T18:59:28.580Z] 18:59:28     INFO - GECKO(3143) |     [96, 104) 'ref.tmp.i' (line 424)
[task 2023-08-02T18:59:28.581Z] 18:59:28     INFO - GECKO(3143) |     [128, 152) 'global' (line 804)
[task 2023-08-02T18:59:28.582Z] 18:59:28     INFO - GECKO(3143) |     [192, 208) 'ar' (line 821)
[task 2023-08-02T18:59:28.582Z] 18:59:28     INFO - GECKO(3143) |     [224, 248) 'proto' (line 826)
[task 2023-08-02T18:59:28.582Z] 18:59:28     INFO - GECKO(3143) |     [288, 320) 'creator' (line 841)
[task 2023-08-02T18:59:28.582Z] 18:59:28     INFO - GECKO(3143) | HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
[task 2023-08-02T18:59:28.583Z] 18:59:28     INFO - GECKO(3143) |       (longjmp and C++ exceptions *are* supported)
[task 2023-08-02T18:59:28.583Z] 18:59:28     INFO - GECKO(3143) | SUMMARY: AddressSanitizer: stack-use-after-scope /builds/worker/checkouts/gecko/js/src/vm/StructuredClone.cpp:2482:20 in JSStructuredCloneReader::NurseryCollectionCallback(JSContext*, JS::GCNurseryProgress, JS::GCReason, void*)
Group: javascript-core-security
Severity: S4 → --
Component: JavaScript Engine → JavaScript: GC
Priority: P5 → --
Keywords: regression
Regressed by: 1713022

Set release status flags based on info from the regressing bug 1713022

:jonco, since you are the author of the regressor, bug 1713022, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

status-firefox116: --- → unaffected
status-firefox117: --- → affected
status-firefox118: --- → affected
status-firefox-esr102: --- → unaffected
status-firefox-esr115: --- → unaffected
Flags: needinfo?(jcoppeard)

I think what's happening here is that structured clone callbacks can themselves perform structured cloning, therefore making it reentrant. Structured cloning now temporarily adds a GC callback (to observe nursery collections). However the code to add/remove GC callbacks assumes at most one callback with the same handler address and will remove the wrong instance of the callback if callbacks added/removed in a nested fashion.

Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)

This adds the data parameter to the remove API and only removes when both
callback and data argument match, allowing the same callback to be registered
more than once with different data pointers. This also asserts that the
callback is found when removal is requestd.

Comment on attachment 9347176 [details]
Bug 1846835 - Part 1: Allow the same nursery collection callback to be registered more than once r?sfink

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: Difficult to exploit.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which older supported branches are affected by this flaw?: 117
  • If not all supported branches, which bug introduced the flaw?: Bug 1713022
  • Do you have backports for the affected branches?: No
  • If not, how different, hard to create, and risky will they be?: The same patch should apply cleanly. (Only the first patch is required to fix bug).
  • How likely is this patch to cause regressions; how much testing does it need?: Unlikely. This is a simple change to tighten up handling of removing callbacks, adding an extra check and there's an assertion that it matches as expected.
  • Is Android affected?: Yes
Attachment #9347176 - Flags: sec-approval?
Attachment #9347177 - Flags: sec-approval?
Keywords: sec-high

Comment on attachment 9347176 [details]
Bug 1846835 - Part 1: Allow the same nursery collection callback to be registered more than once r?sfink

sec-approval+ = dveditz -- land any time, we're early in the cycle. Earlier is better for uplifts to beta

Attachment #9347176 - Flags: sec-approval? → sec-approval+
Attachment #9347177 - Flags: sec-approval? → sec-approval+
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/9c5dab693a40 Part 1: Allow the same nursery collection callback to be registered more than once r=sfink https://hg.mozilla.org/integration/autoland/rev/ae9f026e64dd Part 2: Also assert that other callbacks are found when removal requested r=sfink

https://hg.mozilla.org/mozilla-central/rev/9c5dab693a40
Part 1: Allow the same nursery collection callback to be registered more than once r=sfink
https://hg.mozilla.org/mozilla-central/rev/ae9f026e64dd
Part 2: Also assert that other callbacks are found when removal requested r=sfink

Group: javascript-core-security → core-security
Status: NEW → RESOLVED
Closed: 3 years ago
status-firefox118: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 118 Branch
Group: core-security → core-security-release

The patch landed in nightly and beta is affected.
:jonco, is this bug important enough to require an uplift?

  • If yes, please nominate the patch for beta approval.
  • If no, please set status-firefox117 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(jcoppeard)

Comment on attachment 9347176 [details]
Bug 1846835 - Part 1: Allow the same nursery collection callback to be registered more than once r?sfink

Beta/Release Uplift Approval Request

  • User impact if declined: Possible crash / security vulnerability
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This is a simple change to check an extra parameter when removing a callback.
  • String changes made/needed: None
  • Is Android affected?: Yes
Flags: needinfo?(jcoppeard)
Attachment #9347176 - Flags: approval-mozilla-beta?

Comment on attachment 9347176 [details]
Bug 1846835 - Part 1: Allow the same nursery collection callback to be registered more than once r?sfink

Approved for 117.0b8.

Attachment #9347176 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
QA Whiteboard: [post-critsmash-triage]
Flags: qe-verify-
Group: core-security-release
Regressions: 1982134
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: