1848460 - Hit MOZ_CRASH(Invalid object. Dead wrapper?) at /builds/worker/checkouts/gecko/js/src/vm/JSObject.h:649

Status: VERIFIED FIXED

(Core :: Audio/Video: Web Codecs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230811-efb44db563b1 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(Invalid object. Dead wrapper?) at /builds/worker/checkouts/gecko/js/src/vm/JSObject.h:649

#0 0x7fbb25acd233 in maybeUnwrapAs<js::TypedArrayObject> /builds/worker/checkouts/gecko/js/src/vm/JSObject.h:649:3
#1 0x7fbb25acd233 in JS_GetTypedArrayByteOffset(JSObject*) /builds/worker/checkouts/gecko/js/src/vm/TypedArrayObject.cpp:2888:33
#2 0x7fbb1ce0ed83 in GetArrayBufferInfo /builds/worker/checkouts/gecko/dom/media/webcodecs/WebCodecsUtils.cpp:106:7
#3 0x7fbb1ce0ed83 in mozilla::dom::CloneBuffer(JSContext*, mozilla::dom::OwningMaybeSharedArrayBufferViewOrMaybeSharedArrayBuffer&, mozilla::dom::OwningMaybeSharedArrayBufferViewOrMaybeSharedArrayBuffer const&) /builds/worker/checkouts/gecko/dom/media/webcodecs/WebCodecsUtils.cpp:114:7
#4 0x7fbb1cde1d39 in CloneConfiguration /builds/worker/checkouts/gecko/dom/media/webcodecs/VideoDecoder.cpp:400:5
#5 0x7fbb1cde1d39 in mozilla::dom::VideoDecoder::IsConfigSupported(mozilla::dom::GlobalObject const&, mozilla::dom::VideoDecoderConfig const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/media/webcodecs/VideoDecoder.cpp:1047:12
#6 0x7fbb197b7cc6 in mozilla::dom::VideoDecoder_Binding::isConfigSupported(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/VideoDecoderBinding.cpp:1114:39
#7 0x7fbb1a73ca57 in mozilla::dom::StaticMethodPromiseWrapper(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3366:13
#8 0x7fbb254787af in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
#9 0x7fbb254787af in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:12
#10 0x7fbb2549d335 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
#11 0x7fbb2549d335 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:652:10
#12 0x7fbb2549d335 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3395:16
#13 0x7fbb2547755b in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:400:10
#14 0x7fbb2547755b in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:458:13
#15 0x7fbb25478965 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:612:13
#16 0x7fbb2547a8d6 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:647:10
#17 0x7fbb2547a8d6 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
#18 0x7fbb255d506b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#19 0x7fbb1a0cbc90 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:65:37
#20 0x7fbb1b5c54bb in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#21 0x7fbb1b5c3325 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:199:12
#22 0x7fbb1b570289 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1257:22
#23 0x7fbb1b57213d in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1453:21
#24 0x7fbb1b5591d4 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:342:17
#25 0x7fbb1b556ce6 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:559:18
#26 0x7fbb1b55d508 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1152:11
#27 0x7fbb1b5652ae in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp
#28 0x7fbb1b4f160e in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/events/DOMEventTargetHelper.cpp:176:17
#29 0x7fbb1b583a43 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /builds/worker/checkouts/gecko/dom/events/EventTarget.cpp:180:13
#30 0x7fbb1e63b82e in mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool) /builds/worker/checkouts/gecko/dom/workers/MessageEventRunnable.cpp:104:12
#31 0x7fbb1e6ca798 in mozilla::dom::WorkerRunnable::Run() /builds/worker/checkouts/gecko/dom/workers/WorkerRunnable.cpp:372:12
#32 0x7fbb13e2424f in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1193:16
#33 0x7fbb13e31c94 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#34 0x7fbb1e6a9a4b in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3408:7
#35 0x7fbb1e672d41 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:2112:42
#36 0x7fbb13e2424f in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1193:16
#37 0x7fbb13e31c94 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#38 0x7fbb15a2e2d1 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#39 0x7fbb1585761a in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
#40 0x7fbb1585761a in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#41 0x7fbb1585761a in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#42 0x7fbb13e1b28a in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10
#43 0x7fbb3bb03b3f in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#44 0x7fbb3b894b42 in start_thread nptl/pthread_create.c:442:8
#45 0x7fbb3b9269ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Mayank Bansal]

Got this crash from the testcase : https://crash-stats.mozilla.org/report/index/f6397607-f1c7-4204-9e90-6c49e0230812#tab-bugzilla

Comment 2

[Mayank Bansal]

Regression:
Bug 1846102 - Ensure codec string with spaces is valid r=padenot

Differential Revision: https://phabricator.services.mozilla.com/D185606

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1846102

:chunmin, since you are the author of the regressor, bug 1846102, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230811213712-16838b515ded.
The bug appears to have been introduced in the following build range:

Start: 389f1009f2db207be63aacd4c9c54990f9d1104b (20230810215913)
End: 05da0ca6db46baad5f6e45489d80d5097053bb42 (20230811030844)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=389f1009f2db207be63aacd4c9c54990f9d1104b&tochange=05da0ca6db46baad5f6e45489d80d5097053bb42

Comment 5

[C.M.Chang[:chunmin]]

Attachment: Bug 1848460 - Replace JS_GetTypedArray* by JS_GetArrayBufferView*

To cover usage of DataView as well, JS_GetTypedArrayByte{Length,
Offset} should be replaced by JS_GetArrayBufferViewByte{Length, Offset}.

Comment 6

[C.M.Chang[:chunmin]]

Attachment: Bug 1848460 - Add a crash test

Depends on D186194

Comment 7

[C.M.Chang[:chunmin]]

Attachment: Bug 1848460 - Add a WPT to check DataView usage

Depends on D186195

Comment 8

[C.M.Chang[:chunmin]]

The code causing the crash is not added in bug 1846102, so I am going to remove the regression label.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f40b1d76ca48
Replace JS_GetTypedArray* by JS_GetArrayBufferView* r=padenot
https://hg.mozilla.org/integration/autoland/rev/834d2e874f1a
Add a crash test r=padenot
https://hg.mozilla.org/integration/autoland/rev/9a4fe4c0f4d4
Add a WPT to check DataView usage r=padenot

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/41501 for changes under testing/web-platform/tests

Comment 11

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/f40b1d76ca48
https://hg.mozilla.org/mozilla-central/rev/834d2e874f1a
https://hg.mozilla.org/mozilla-central/rev/9a4fe4c0f4d4

Comment 12

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 13

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230816215210-1c8dec8815d5.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.