1876138 - AddressSanitizer: SEGV /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:931:52 in GetWorkerPrivate

Status: RESOLVED FIXED

(Core :: DOM: Performance APIs, defect)

Description

[Jason Kratzer [:jkratzer]]

When trying to instantiate a new PerformanceMark in xpcshell, the following crash is raised due to a missing null check in GetWorkerFromPrivateContext.

==21748==ERROR: AddressSanitizer: SEGV on unknown address 0x000000006db8 (pc 0x7fdeb86f6888 bp 0x7ffdf7f446b0 sp 0x7ffdf7f446b0 T0)
==21748==The signal is caused by a READ memory access.
    #0 0x7fdeb86f6888 in GetWorkerPrivate /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:931:52
    #1 0x7fdeb86f6888 in mozilla::dom::GetWorkerPrivateFromContext(JSContext*) /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:2305:22
    #2 0x7fdeb8c98373 in mozilla::dom::Performance::Get(JSContext*, nsIGlobalObject*) /builds/worker/checkouts/gecko/dom/performance/Performance.cpp:87:42
    #3 0x7fdeb8cb8b82 in mozilla::dom::PerformanceMark::Constructor(JSContext*, nsIGlobalObject*, nsTSubstring<char16_t> const&, mozilla::dom::PerformanceMarkOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/performance/PerformanceMark.cpp:40:37
    #4 0x7fdeb8c9e257 in mozilla::dom::PerformanceMark::Constructor(mozilla::dom::GlobalObject const&, nsTSubstring<char16_t> const&, mozilla::dom::PerformanceMarkOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/performance/PerformanceMark.cpp:33:10
    #5 0x7fdeb2d617e2 in mozilla::dom::PerformanceMark_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./PerformanceMarkBinding.cpp:224:61
    #6 0x7fdebe9046e1 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:479:13
    #7 0x7fdebe9046e1 in CallJSNativeConstructor /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:495:8
    #8 0x7fdebe9046e1 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:720:10
    #9 0x7fdebe926395 in ConstructFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:748:10
    #10 0x7fdebe926395 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3045:16
    #11 0x7fdebe9002a7 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:393:10
    #12 0x7fdebe9002a7 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:451:13
    #13 0x7fdebe905bb3 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JS::Handle<JSObject*>, js::AbstractFramePtr, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:838:13
    #14 0x7fdebeab1378 in ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:494:10
    #15 0x7fdebeab0fe4 in JS_ExecuteScript(JSContext*, JS::Handle<JSScript*>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CompilationAndEvaluation.cpp:511:10
    #16 0x7fdeb0079e0b in ProcessFile(mozilla::dom::AutoJSAPI&, char const*, _IO_FILE*, bool) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCShellImpl.cpp:776:27
    #17 0x7fdeb007a325 in Process(mozilla::dom::AutoJSAPI&, char const*, bool) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCShellImpl.cpp:832:13
    #18 0x7fdeb00292bc in ProcessArgs(mozilla::dom::AutoJSAPI&, char**, int, XPCShellDirProvider*) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCShellImpl.cpp:986:12
    #19 0x7fdeb0024cc2 in XRE_XPCShellMain(int, char**, char**, XREShellData const*) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCShellImpl.cpp:1376:16
    #20 0x55ff67b123d7 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:196:24
    #21 0x55ff67b123d7 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:445:16
    #22 0x7fded5c09d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #23 0x7fded5c09e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #24 0x55ff67a36848 in _start (/home/jkratzer/builds/xpcshell/firefox+0xdc848) (BuildId: 036ce1e70a838dc62bfe1c2baeb85f6c42cf295a)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:931:52 in GetWorkerPrivate

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Bug 1876138: Check if in main thread before attempting to create PerformanceMark. r=#dom-workers

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4708de99227c
Check if in main thread before attempting to create PerformanceMark. r=dom-worker-reviewers,asuth

Comment 3

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/4708de99227c