Closed Bug 1881074 Opened 2 years ago Closed 2 years ago

heap-use-after-free in [@ mozilla::dom::Document::TitleChangeEvent::Run]

Categories

(Core :: DOM: Events, defect, P2)

Product:
Core
Component:
DOM: Events
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
125 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox123 --- wontfix
firefox124 + fixed
firefox125 + verified

People

(Reporter: tsmith, Assigned: emilio)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed][adv-main124+r])

Attachments

(2 files)

testcase.html
539 bytes, text/html
Details
Bug 1881074. r=smaug
48 bytes, text/x-phabricator-request
diannaS
: approval-mozilla-beta+
diannaS
: approval-mozilla-release-
tjr
: sec-approval+
Details | Review
Attached file testcase.html —

Found while fuzzing m-c 20240219-a8a8cdb0966b (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Note: The attached test case uses FuzzingFunctions and requires a fuzzing builds.

==33759==ERROR: AddressSanitizer: heap-use-after-free on address 0x51e0000588a0 at pc 0x7f292d8f5e9e bp 0x7ffef9b83200 sp 0x7ffef9b831f8
READ of size 8 at 0x51e0000588a0 thread T0 (Isolated Web Co)
    #0 0x7f292d8f5e9d in incr /builds/worker/workspace/obj-build/dist/include/nsISupportsImpl.h:243:21
    #1 0x7f292d8f5e9d in incr /builds/worker/workspace/obj-build/dist/include/nsISupportsImpl.h:238:12
    #2 0x7f292d8f5e9d in mozilla::dom::EventTarget::NonVirtualAddRef() /builds/worker/checkouts/gecko/dom/events/EventTarget.cpp:23:18
    #3 0x7f292a428b6e in AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Document.h:5498:1
    #4 0x7f292a428b6e in AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:408:35
    #5 0x7f292a428b6e in RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:108:7
    #6 0x7f292a428b6e in mozilla::dom::Document::TitleChangeEvent::Run() /builds/worker/checkouts/gecko/dom/base/Document.cpp:9256:34
    #7 0x7f29263c656a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:578:16
    #8 0x7f29263ac3eb in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:905:26
    #9 0x7f29263a8fc8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:728:15
    #10 0x7f29263a96c9 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:514:36
    #11 0x7f29263ce661 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:232:37
    #12 0x7f29263ce661 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #13 0x7f29263f65df in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
    #14 0x7f292640431a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
    #15 0x7f29280bc30e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #16 0x7f2927edb2ea in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #17 0x7f2927edb2ea in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #18 0x7f2927edb2ea in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #19 0x7f29318ad4c9 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
    #20 0x7f2931ab9b12 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:470:33
    #21 0x7f29368ac8ae in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:721:20
    #22 0x7f2927edb2ea in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #23 0x7f2927edb2ea in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #24 0x7f2927edb2ea in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #25 0x7f29368abe53 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:656:34
    #26 0x55c204c6f53c in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #27 0x55c204c6f53c in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
    #28 0x7f294f229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #29 0x7f294f229e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #30 0x55c204b93848 in _start (/home/user/workspace/browsers/m-c-20240220094730-fuzzing-asan-opt/firefox+0xdc848) (BuildId: adcf29930d20af1b1c487ab52484075cec03f444)

0x51e0000588a0 is located 32 bytes inside of 2808-byte region [0x51e000058880,0x51e000059378)
freed by thread T0 (Isolated Web Co) here:
    #0 0x55c204c2f406 in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
    #1 0x7f29261b07e6 in SnowWhiteKiller::~SnowWhiteKiller() /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:2471:7
    #2 0x7f29261af595 in nsCycleCollector::FreeSnowWhite(bool) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:2661:3
    #3 0x7f29261bafe7 in nsCycleCollector::BeginCollection(mozilla::CCReason, ccIsManual, nsICycleCollectorListener*) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:3647:3
    #4 0x7f29261b9e5d in nsCycleCollector::Collect(mozilla::CCReason, ccIsManual, js::SliceBudget&, nsICycleCollectorListener*, bool) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:3471:9
    #5 0x7f29261be692 in nsCycleCollector_collect(mozilla::CCReason, nsICycleCollectorListener*) /builds/worker/checkouts/gecko/xpcom/base/nsCycleCollector.cpp:3982:28
    #6 0x7f292a7f134a in nsJSContext::CycleCollectNow(mozilla::CCReason, nsICycleCollectorListener*) /builds/worker/checkouts/gecko/dom/base/nsJSEnvironment.cpp:1434:3
    #7 0x7f292c79065f in mozilla::dom::FuzzingFunctions_Binding::cycleCollect(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./FuzzingFunctionsBinding.cpp:132:3
    #8 0x7f2936cfea15 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:480:13
    #9 0x7f2936cfea15 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:574:12
    #10 0x7f2936d23e15 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:641:10
    #11 0x7f2936d23e15 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:646:10
    #12 0x7f2936d23e15 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3061:16
    #13 0x7f2936cfd797 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:394:10
    #14 0x7f2936cfd797 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:452:13
    #15 0x7f2936cfeb7e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:606:13
    #16 0x7f2936d00b06 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:641:10
    #17 0x7f2936d00b06 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:673:8
    #18 0x7f2936ebeddb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
    #19 0x7f292c4d0302 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
    #20 0x7f292d93b522 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
    #21 0x7f292d938f76 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:199:12
    #22 0x7f292d8e3a39 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1346:22
    #23 0x7f292d8e664a in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1661:12
    #24 0x7f292d8e5086 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1558:35
    #25 0x7f292d8c8182 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:364:17
    #26 0x7f292d8c5777 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:605:16
    #27 0x7f292d8cd14a in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1222:11
    #28 0x7f2930db23c4 in mozilla::(anonymous namespace)::AsyncTimeEventRunner::Run() /builds/worker/checkouts/gecko/dom/smil/SMILTimedElement.cpp:96:12
    #29 0x7f29263c656a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:578:16
    #30 0x7f29263ac3eb in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:905:26
    #31 0x7f29263a8fc8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:728:15
    #32 0x7f29263a96c9 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:514:36
    #33 0x7f29263ce661 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:232:37
    #34 0x7f29263ce661 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #35 0x7f29263f65df in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16

previously allocated by thread T0 (Isolated Web Co) here:
    #0 0x55c204c2f6ae in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x55c204c747c5 in moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52:15
    #2 0x7f292e06a6cf in operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33:10
    #3 0x7f292e06a6cf in operator new /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Document.h:557:45
    #4 0x7f292e06a6cf in NS_NewHTMLDocument(mozilla::dom::Document**, nsIPrincipal*, nsIPrincipal*, bool) /builds/worker/checkouts/gecko/dom/html/nsHTMLDocument.cpp:107:32
    #5 0x7f2932d60bf8 in nsContentDLF::CreateBlankDocument(nsILoadGroup*, nsIPrincipal*, nsIPrincipal*, nsDocShell*) /builds/worker/checkouts/gecko/layout/build/nsContentDLF.cpp:220:22
    #6 0x7f2935676f1c in nsDocShell::CreateAboutBlankDocumentViewer(nsIPrincipal*, nsIPrincipal*, nsIContentSecurityPolicy*, nsIURI*, bool, mozilla::Maybe<nsILoadInfo::CrossOriginEmbedderPolicy> const&, bool, bool, mozilla::dom::WindowGlobalChild*) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6604:16
    #7 0x7f293561a590 in nsDocShell::EnsureDocumentViewer() /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6442:17
    #8 0x7f293558621f in GetDocument /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:3065:3
    #9 0x7f293558621f in nsDocShell::InternalLoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:9439:26
    #10 0x7f293561da4f in nsDocShell::LoadURI(nsDocShellLoadState*, bool, bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:849:8
    #11 0x7f292a74c013 in nsFrameLoader::ReallyStartLoadingInternal() /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:785:18
    #12 0x7f292a74aaf8 in nsFrameLoader::ReallyStartLoading() /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:652:17
    #13 0x7f292a32227f in mozilla::dom::Document::MaybeInitializeFinalizeFrameLoaders() /builds/worker/checkouts/gecko/dom/base/Document.cpp:9443:13
    #14 0x7f292a44372b in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1164:18
    #15 0x7f292a44372b in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
    #16 0x7f292a44372b in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
    #17 0x7f292a44372b in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
    #18 0x7f292a44372b in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
    #19 0x7f292a44372b in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
    #20 0x7f292a44372b in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1213:13
    #21 0x7f2929ed3360 in nsContentUtils::RemoveScriptBlocker() /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:6129:17
    #22 0x7f292a30db46 in mozilla::dom::Document::EndUpdate() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7967:3
    #23 0x7f292a7d2bb8 in ~mozAutoDocUpdate /builds/worker/checkouts/gecko/dom/base/mozAutoDocUpdate.h:34:18
    #24 0x7f292a7d2bb8 in nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:2903:1
    #25 0x7f292b074dc9 in InsertBefore /builds/worker/checkouts/gecko/dom/base/nsINode.h:2183:12
    #26 0x7f292b074dc9 in AppendChild /builds/worker/checkouts/gecko/dom/base/nsINode.h:2190:12
    #27 0x7f292b074dc9 in mozilla::dom::Node_Binding::appendChild(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./NodeBinding.cpp:959:60
    #28 0x7f292ca7b124 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3258:13
    #29 0x7f2936cfea15 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:480:13
    #30 0x7f2936cfea15 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:574:12
    #31 0x7f2936d23e15 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:641:10
    #32 0x7f2936d23e15 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:646:10
    #33 0x7f2936d23e15 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3061:16
    #34 0x7f2936cfd797 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:394:10
    #35 0x7f2936cfd797 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:452:13
    #36 0x7f2936cfeb7e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:606:13
    #37 0x7f2936d00b06 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:641:10
    #38 0x7f2936d00b06 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:673:8
    #39 0x7f2936ebeddb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
    #40 0x7f292c4d0302 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
    #41 0x7f292d93b522 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
    #42 0x7f292d938f76 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:199:12
    #43 0x7f292d8e3a39 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1346:22
    #44 0x7f292d8e664a in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1661:12
    #45 0x7f292d8e5086 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1558:35
    #46 0x7f292d8c8182 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:364:17
Flags: in-testsuite?

I guess this is a regression from Bug 1874766.

Flags: needinfo?(emilio)

Verified bug as reproducible on mozilla-central 20240220212334-bf0897ec442e.
The bug appears to have been introduced in the following build range:

Start: 99bd3eeb6ed504f433837a067962aa5b15aeee49 (20240118163339)
End: 68ff26df33468fe750b39f175b43b8507718ece4 (20240118132123)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=99bd3eeb6ed504f433837a067962aa5b15aeee49&tochange=68ff26df33468fe750b39f175b43b8507718ece4

Keywords: regression
Whiteboard: [bugmon:bisected,confirmed]

The bug in comment 1 is in the range in comment 2, so I'll mark the regression.

Keywords: sec-high
Regressed by: 1874766

Set release status flags based on info from the regressing bug 1874766

status-firefox123: --- → affected
status-firefox124: --- → affected
status-firefox-esr115: --- → unaffected
Attached file Bug 1881074. r=smaug —

There are callers of DoNotifyPossibleTitleChange which don't come from
the runnable. The runnable code deals well with it being revoked while
running.

Assignee: nobody → emilio
Status: NEW → ASSIGNED
Severity: -- → S2
Flags: needinfo?(emilio)
Priority: -- → P2

Comment on attachment 9381819 [details]
Bug 1881074. r=smaug

Beta/Release Uplift Approval Request

  • User impact if declined: Sec-high.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: No
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: none
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): One-liner.
  • String changes made/needed: none
  • Is Android affected?: Yes

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: Somewhat doable. I plan to land the patch without the commit message explanation about why it fixes the bug, but still you can probably figure out with some effort.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: beta/release
  • If not all supported branches, which bug introduced the flaw?: Bug 1874766
  • Do you have backports for the affected branches?: Yes
  • If not, how different, hard to create, and risky will they be?: Should apply cleanly
  • How likely is this patch to cause regressions; how much testing does it need?: One liner to the common code-path.
  • Is the patch ready to land after security approval is given?: No
  • Is Android affected?: Yes
Attachment #9381819 - Flags: sec-approval?
Attachment #9381819 - Flags: approval-mozilla-release?
Attachment #9381819 - Flags: approval-mozilla-beta?

Comment on attachment 9381819 [details]
Bug 1881074. r=smaug

Approved to land, although please remove the commit message like you mentioned; it is in bugzilla now.

Attachment #9381819 - Flags: sec-approval? → sec-approval+
Attachment #9381819 - Attachment description: Bug 1881074 - Revoke rather than forget title change event runnable. r=smaug → Bug 1881074. r=smaug

https://hg.mozilla.org/mozilla-central/rev/56e56fc5bf2b

Group: dom-core-security → core-security-release
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
status-firefox125: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 125 Branch

Verified bug as fixed on rev mozilla-central 20240223034030-d78078443b2c.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox125: fixed → verified
Keywords: bugmon

Comment on attachment 9381819 [details]
Bug 1881074. r=smaug

Approved for 124.0b4

Attachment #9381819 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

Comment on attachment 9381819 [details]
Bug 1881074. r=smaug

This will rollout with 124

Attachment #9381819 - Flags: approval-mozilla-release? → approval-mozilla-release-
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed][adv-main124+r]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: