1870870 - stack-buffer-overflow in [@ mozilla::dom::KeyframeEffect::SetPerformanceWarning]

Tyson Smith [:tsmith]

Reporter

Description

•

6 months ago

•

Edited

Found with m-c 20231219-05b607c3bbe6 (--enable-address-sanitizer)

This was found by visiting a live website with an ASan build.

This has been triggered by visiting a few different sites so far:

==79053==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffa1d5ea68 at pc 0x7f3aebd2576f bp 0x7fffa1d5e960 sp 0x7fffa1d5e958
READ of size 8 at 0x7fffa1d5ea68 thread T0 (Isolated Web Co)
    #0 0x7f3aebd2576e in nsCSSPropertyIDSet::HasProperty(nsCSSPropertyID) const /builds/worker/workspace/obj-build/dist/include/nsCSSPropertyIDSet.h:65:13
    #1 0x7f3aed7eb324 in mozilla::dom::KeyframeEffect::SetPerformanceWarning(nsCSSPropertyIDSet const&, mozilla::AnimationPerformanceWarning const&) /builds/worker/checkouts/gecko/dom/animation/KeyframeEffect.cpp:1767:15
    #2 0x7f3aed7e3c65 in mozilla::EffectCompositor::SetPerformanceWarning(nsIFrame const*, nsCSSPropertyIDSet const&, mozilla::AnimationPerformanceWarning const&) /builds/worker/checkouts/gecko/dom/animation/EffectCompositor.cpp:754:13
    #3 0x7f3afa91592b in mozilla::nsDisplayTransform::ShouldPrerenderTransformedContent(mozilla::nsDisplayListBuilder*, nsIFrame*, nsRect*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:6345:5
    #4 0x7f3afa15b3e0 in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:3204:21
    #5 0x7f3af9f99f3a in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4254:12
    #6 0x7f3af9f96984 in nsFlexContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:2940:5
    #7 0x7f3afa15d05d in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:3442:5
    #8 0x7f3af9f99f3a in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4254:12
    #9 0x7f3af9f96984 in nsFlexContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:2940:5
    #10 0x7f3afa15d05d in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:3442:5
    #11 0x7f3af9f99f3a in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4254:12
    #12 0x7f3afa138a53 in nsGridContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:9573:5
    #13 0x7f3afa15d05d in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:3442:5
    #14 0x7f3af9f99f3a in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4254:12
    #15 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #16 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #17 0x7f3afa15d05d in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:3442:5
    #18 0x7f3af9f99f3a in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4254:12
    #19 0x7f3afa138a53 in nsGridContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsGridContainerFrame.cpp:9573:5
    #20 0x7f3afa15d05d in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:3442:5
    #21 0x7f3af9f99f3a in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4254:12
    #22 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #23 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #24 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #25 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #26 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #27 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #28 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #29 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #30 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #31 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #32 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #33 0x7f3af9f9a874 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4303:12
    #34 0x7f3af9f96984 in nsFlexContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:2940:5
    #35 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #36 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #37 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #38 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #39 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #40 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #41 0x7f3af9f9a874 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4303:12
    #42 0x7f3af9f96984 in nsFlexContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:2940:5
    #43 0x7f3af9f9a874 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4303:12
    #44 0x7f3af9f96984 in nsFlexContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:2940:5
    #45 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #46 0x7f3afa07cefa in nsHTMLScrollFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:4188:7
    #47 0x7f3af9f9a874 in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4303:12
    #48 0x7f3af9f96984 in nsFlexContainerFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsFlexContainerFrame.cpp:2940:5
    #49 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #50 0x7f3afa07cefa in nsHTMLScrollFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:4188:7
    #51 0x7f3afa15d05d in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:3442:5
    #52 0x7f3af9f99f3a in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4254:12
    #53 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #54 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #55 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #56 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #57 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #58 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #59 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #60 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #61 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #62 0x7f3af9f2044a in DisplayLine(mozilla::nsDisplayListBuilder*, nsLineList_iterator&, bool, mozilla::nsDisplayListSet const&, nsBlockFrame*, mozilla::css::TextOverflow*, unsigned int, int, int&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7335:13
    #63 0x7f3af9f1deec in nsBlockFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsBlockFrame.cpp:7492:9
    #64 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #65 0x7f3af9f2d9c4 in nsCanvasFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsCanvasFrame.cpp:589:5
    #66 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #67 0x7f3afa07cefa in nsHTMLScrollFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/nsGfxScrollFrame.cpp:4188:7
    #68 0x7f3af9f9a5dc in nsIFrame::BuildDisplayListForChild(mozilla::nsDisplayListBuilder*, nsIFrame*, mozilla::nsDisplayListSet const&, mozilla::EnumSet<nsIFrame::DisplayChildFlag, unsigned int>) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:4288:14
    #69 0x7f3af9eae683 in mozilla::ViewportFrame::BuildDisplayList(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayListSet const&) /builds/worker/checkouts/gecko/layout/generic/ViewportFrame.cpp:66:3
    #70 0x7f3afa15d05d in nsIFrame::BuildDisplayListForStackingContext(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayList*, bool*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:3442:5
    #71 0x7f3af9d202c8 in nsLayoutUtils::GetFramesForArea(mozilla::RelativeTo, nsRect const&, nsTArray<nsIFrame*>&, nsLayoutUtils::FrameForPointOptions const&) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:2729:10
    #72 0x7f3b0387c25e in mozilla::a11y::LocalAccessible::BundleFieldsForCache(unsigned long, mozilla::a11y::CacheUpdateType) /builds/worker/checkouts/gecko/accessible/generic/LocalAccessible.cpp:3288:7
    #73 0x7f3b03879a1c in mozilla::a11y::DocAccessible::ProcessQueuedCacheUpdates() /builds/worker/checkouts/gecko/accessible/generic/DocAccessible.cpp:1505:9
    #74 0x7f3b03791c3c in mozilla::a11y::NotificationController::WillRefresh(mozilla::TimeStamp) /builds/worker/checkouts/gecko/accessible/base/NotificationController.cpp:980:16
    #75 0x7f3af9a774dd in nsRefreshDriver::TickObserverArray(unsigned int, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2447:10
    #76 0x7f3af9a70f74 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2738:28
    #77 0x7f3af9a8c2b8 in mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver*, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:13
    #78 0x7f3af9a8bf8b in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:345:7
    #79 0x7f3af9a8babe in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:361:5
    #80 0x7f3af9a8b457 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:951:5
    #81 0x7f3af9a87acf in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:861:5
    #82 0x7f3af9a85ea5 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:758:5
    #83 0x7f3af9a84c16 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:592:14
    #84 0x7f3af9a843e5 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:549:9
    #85 0x7f3af76e08d3 in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
    #86 0x7f3af7f75eb2 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:227:78
    #87 0x7f3af7bc0282 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8263:32
    #88 0x7f3af76763a1 in mozilla::dom::ContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/checkouts/gecko/dom/ipc/ContentChild.cpp:3722:25
    #89 0x7f3aea6a5311 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1813:25
    #90 0x7f3aea6a10fb in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1732:9
    #91 0x7f3aea6a1bb3 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
    #92 0x7f3aea6a343c in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
    #93 0x7f3ae79f39bd in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:557:16
    #94 0x7f3ae79d5a75 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:884:26
    #95 0x7f3ae79d148a in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:707:15
    #96 0x7f3ae79d1c2f in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:493:36
    #97 0x7f3ae7a1216d in mozilla::TaskController::TaskController()::$_1::operator()() const /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:214:37
    #98 0x7f3ae7a120e8 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #99 0x7f3ae7a51840 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
    #100 0x7f3ae7a60685 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
    #101 0x7f3aea6b1e5c in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5
    #102 0x7f3aea6b3e16 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:268:30
    #103 0x7f3aea361bf8 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #104 0x7f3aea361b64 in MessageLoop::RunHandler() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #105 0x7f3aea361acc in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #106 0x7f3af90c8515 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
    #107 0x7f3af935f213 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:470:33
    #108 0x7f3b04eb7f2d in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:721:20
    #109 0x7f3aea6b3c5f in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
    #110 0x7f3aea361bf8 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #111 0x7f3aea361b64 in MessageLoop::RunHandler() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #112 0x7f3aea361acc in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #113 0x7f3b04eb64e2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:34
    #114 0x7f3b04edcf86 in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:67:12
    #115 0x55baa5b9a100 in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #116 0x55baa5b9ab14 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
    #117 0x7f3b34829d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #118 0x7f3b34829e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #119 0x55baa5abf078 in _start (/home/user/workspace/browsers/m-c-20231219152636-fuzzing-asan-noopt/firefox+0x161078) (BuildId: 72a10dfe80f175f3e82ee186e60c057a7c62efbc)

Address 0x7fffa1d5ea68 is located in stack of thread T0 (Isolated Web Co) at offset 104 in frame
    #0 0x7f3aed7eb0ff in mozilla::dom::KeyframeEffect::SetPerformanceWarning(nsCSSPropertyIDSet const&, mozilla::AnimationPerformanceWarning const&) /builds/worker/checkouts/gecko/dom/animation/KeyframeEffect.cpp:1764

  This frame has 3 object(s):
    [32, 88) 'curr' (line 1765) <== Memory access at offset 104 overflows this variable
    [128, 144) '__begin2' (line 1766) <== Memory access at offset 104 underflows this variable
    [160, 176) '__end2' (line 1766)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /builds/worker/workspace/obj-build/dist/include/nsCSSPropertyIDSet.h:65:13 in nsCSSPropertyIDSet::HasProperty(nsCSSPropertyID) const
Shadow bytes around the buggy address:
  0x7fffa1d5e780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fffa1d5e800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fffa1d5e880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fffa1d5e900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fffa1d5e980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7fffa1d5ea00: f1 f1 f1 f1 00 00 00 00 00 00 00 f2 f2[f2]f2 f2
  0x7fffa1d5ea80: 00 00 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00
  0x7fffa1d5eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fffa1d5eb80: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x7fffa1d5ec00: 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 f3
  0x7fffa1d5ec80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==79053==ABORTING

Tyson Smith [:tsmith]

Reporter

Updated

•

6 months ago

User Story: (updated)

Tyson Smith [:tsmith]

Reporter

Comment 1

•

6 months ago

I'm guessing this was regressed by bug 1846516. I will have a Pernosco session shortly.

Keywords: regression

Regressed by: 1846516

Emilio Cobos Álvarez (:emilio)

Assignee

Comment 2

•

6 months ago

Agreed.

Emilio Cobos Álvarez (:emilio)

Assignee

Comment 3

•

6 months ago

Attached file Bug 1870870 - Check for custom properties in KeyframeEffect::SetPerformanceWarning. r=#style,#layout,#animation — Details

I'm doing deeper work in bug 1870832 and co in order to remove
nsCSSPropertyID, but this is the short-term fix.

Phabricator Automation

Updated

•

6 months ago

Assignee: nobody → emilio

Status: NEW → ASSIGNED

Tyson Smith [:tsmith]

Reporter

Comment 4

•

6 months ago

A Pernosco session is available here: https://pernos.co/debug/794932Q-4CA9RKTSdlMy2g/index.html

Keywords: pernosco

BugBot [:suhaib / :marco/ :calixte]

Comment 5

•

6 months ago

Set release status flags based on info from the regressing bug 1846516

status-firefox121: --- → unaffected

status-firefox122: --- → unaffected

status-firefox-esr115: --- → unaffected

Daniel Holbert [:dholbert]

Comment 6

•

6 months ago

toggling needinfo as a reminder to add a testcase when possible, per https://phabricator.services.mozilla.com/D196859#6532000

Flags: needinfo?(emilio)

Pulsebot

Comment 7

•

6 months ago

Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/32032278875d
Check for custom properties in KeyframeEffect::SetPerformanceWarning. r=dholbert

Emilio Cobos Álvarez (:emilio)

Assignee

Comment 8

•

6 months ago

Attached file Bug 1870870 - Add a test. r=dholbert — Details

Emilio Cobos Álvarez (:emilio)

Assignee

Updated

•

6 months ago

Flags: needinfo?(emilio)

Pulsebot

Comment 9

•

6 months ago

Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/97735da9213c
Add a test. r=dholbert

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 10

•

6 months ago

https://hg.mozilla.org/mozilla-central/rev/32032278875d

Group: dom-core-security → core-security-release

Status: ASSIGNED → RESOLVED

Closed: 6 months ago

status-firefox123: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → 123 Branch

Ryan VanderMeulen [:RyanVM]

Comment 11

•

6 months ago

https://hg.mozilla.org/mozilla-central/rev/97735da9213c

tracking-firefox123: --- → +

Flags: in-testsuite+

Daniel Veditz [:dveditz]

Updated

•

5 months ago

Group: core-security-release

Bug 1870870 - Check for custom properties in KeyframeEffect::SetPerformanceWarning. r=#style,#layout,#animation 6 months ago Emilio Cobos Álvarez (:emilio) 48 bytes, text/x-phabricator-request		Details \| Review
Bug 1870870 - Add a test. r=dholbert 6 months ago Emilio Cobos Álvarez (:emilio) 48 bytes, text/x-phabricator-request		Details \| Review

Bugzilla

Quick Search

stack-buffer-overflow in [@ mozilla::dom::KeyframeEffect::SetPerformanceWarning]

Categories

(Core :: DOM: Animation, defect)

Tracking

()

People

(Reporter: tsmith, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(5 keywords)

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Updated

Comment 1

Comment 2

Comment 3

Updated

Comment 4

Comment 5

Comment 6

Comment 7

Comment 8

Updated

Comment 9

Comment 10

Comment 11

Updated

Attachment

General

Description

File Name

Content Type