Closed Bug 1902333 Opened 4 months ago Closed 4 months ago

Crash [@ operator->]

Categories

(Core :: DOM: Core & HTML, defect, P2)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
129 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox127 --- unaffected
firefox128 --- fixed
firefox129 --- verified

People

(Reporter: jkratzer, Assigned: avandolder)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Crash Data

Attachments

(2 files)

Testcase
596 bytes, application/octet-stream
Details
Bug 1902333 - Fix crash when serializing empty shadow tree. r?#dom-core,smaug
48 bytes, text/x-phabricator-request
RyanVM
: approval-mozilla-beta+
Details | Review

Testcase found while fuzzing mozilla-central rev bfd01427a5e8 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build bfd01427a5e8 --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

[@ operator->]

    ==55563==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000030 (pc 0x7d594e4263b6 bp 0x7ffd4176cfe0 sp 0x7ffd4176cf80 T55563)
    ==55563==The signal is caused by a READ memory access.
    ==55563==Hint: address points to the zero page.
        #0 0x7d594e4263b6 in operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:342:5
        #1 0x7d594e4263b6 in NodeType /dom/base/nsINode.h:812:38
        #2 0x7d594e4263b6 in void SerializeNodeToMarkupInternal<(SerializeShadowRoots)0>(nsINode*, bool, (anonymous namespace)::StringBuilder&, bool, mozilla::dom::Sequence<mozilla::OwningNonNull<mozilla::dom::ShadowRoot>> const&) /dom/base/nsContentUtils.cpp:9706:22
        #3 0x7d594e424f44 in bool nsContentUtils::SerializeNodeToMarkup<(SerializeShadowRoots)0>(nsINode*, bool, nsTSubstring<char16_t>&, bool, mozilla::dom::Sequence<mozilla::OwningNonNull<mozilla::dom::ShadowRoot>> const&) /dom/base/nsContentUtils.cpp:9845:3
        #4 0x7d594f7cbc79 in mozilla::dom::Element_Binding::getHTML(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./ElementBinding.cpp:5794:24
        #5 0x7d594fa04797 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3268:13
        #6 0x7d59531c1184 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:481:13
        #7 0x7d59531c096f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:575:12
        #8 0x7d59531d0a09 in CallFromStack /js/src/vm/Interpreter.cpp:647:10
        #9 0x7d59531d0a09 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3190:16
        #10 0x7d59531c00b6 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:453:13
        #11 0x7d59531c0a68 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:607:13
        #12 0x7d59531c1f6f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:674:8
        #13 0x7d59532cca47 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #14 0x7d594f75dab2 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
        #15 0x7d595001a086 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #16 0x7d5950019be9 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1330:43
        #17 0x7d595001ad84 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1653:12
        #18 0x7d595001a5f9 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1550:35
        #19 0x7d595000e14f in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:365:17
        #20 0x7d595000d7c1 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:606:16
        #21 0x7d595001009f in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1221:11
        #22 0x7d595238ff01 in nsDocumentViewer::LoadComplete(nsresult) /layout/base/nsDocumentViewer.cpp:1030:7
        #23 0x7d5952812729 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /docshell/base/nsDocShell.cpp:6259:13
        #24 0x7d5952811ba1 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp:5639:7
        #25 0x7d5952813806 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp
        #26 0x7d594d490fd9 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /uriloader/base/nsDocLoader.cpp:1356:3
        #27 0x7d594d490652 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:962:14
        #28 0x7d594d48e8ac in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:784:9
        #29 0x7d594d48fb11 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:667:5
        #30 0x7d595284aa9f in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:13736:23
        #31 0x7d594c6f9b4f in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:632:22
        #32 0x7d594c6faf7e in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:536:10
        #33 0x7d594e68647c in mozilla::dom::Document::DoUnblockOnload() /dom/base/Document.cpp:11719:18
        #34 0x7d594e66c5e0 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8143:3
        #35 0x7d594e727289 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #36 0x7d594e727289 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #37 0x7d594e727289 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #38 0x7d594e727289 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #39 0x7d594e727289 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #40 0x7d594e727289 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #41 0x7d594e727289 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #42 0x7d594c4cba47 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:580:16
        #43 0x7d594c4c1446 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:907:26
        #44 0x7d594c4bfc07 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:730:15
        #45 0x7d594c4c0085 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:516:36
        #46 0x7d594c4cf3e6 in operator() /xpcom/threads/TaskController.cpp:234:37
        #47 0x7d594c4cf3e6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #48 0x7d594c4e347d in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1204:16
        #49 0x7d594c4ea45f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #50 0x7d594d190715 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #51 0x7d594d0a7ad1 in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #52 0x7d594d0a7ad1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #53 0x7d5951f2d5b8 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #54 0x7d5951fe40c8 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:469:33
        #55 0x7d5952f9b1eb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:712:20
        #56 0x7d594d1915f6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #57 0x7d594d0a7ad1 in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #58 0x7d594d0a7ad1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #59 0x7d5952f9aa7b in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:647:34
        #60 0x61b7d4dd7b1f in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #61 0x61b7d4dd7b1f in main /browser/app/nsBrowserApp.cpp:378:18
        #62 0x7d5960b5ad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #63 0x7d5960b5ae3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #64 0x61b7d4dad558 in _start (/home/jkratzer/builds/m-c-20240613093628-fuzzing-debug/firefox-bin+0x58558) (BuildId: cadf4e58e6288da18b71a307032e6e4bb53ec26a)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:342:5 in operator->
    ==55563==ABORTING
Attached file Testcase —

I get a slightly differnet crash from the testcase : https://crash-stats.mozilla.org/report/index/83283b6d-1de0-4822-b5ac-056a00240613

Crash Signature: [@ operator->] → [@ operator->] [@ nsINode::NodeType ]

Bisection:
Bug 1890428 - Add serialization support for Declarative Shadow DOM. r=webidl,smaug

Differential Revision: https://phabricator.services.mozilla.com/D206955

Keywords: regression
Regressed by: 1890428

Set release status flags based on info from the regressing bug 1890428

:avandolder, since you are the author of the regressor, bug 1890428, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

status-firefox127: --- → unaffected
status-firefox128: --- → affected
status-firefox129: --- → affected
status-firefox-esr115: --- → unaffected
Flags: needinfo?(avandolder)

Verified bug as reproducible on mozilla-central 20240613093628-bfd01427a5e8.
The bug appears to have been introduced in the following build range:

Start: 8a97df11ef6fe5685d068f4e80ba94864c5abf0b (20240515181045)
End: 6459cc1b5bbf309f81d99ed4f39bb0017c58c872 (20240515192339)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=8a97df11ef6fe5685d068f4e80ba94864c5abf0b&tochange=6459cc1b5bbf309f81d99ed4f39bb0017c58c872

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Assignee: nobody → avandolder
Status: NEW → ASSIGNED

It appears there were no test cases for serializing an empty shadow tree. That has been corrected.

Flags: needinfo?(avandolder)
Severity: -- → S3
Priority: -- → P2
Pushed by avandolder@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/7427a6e013ec Fix crash when serializing empty shadow tree. r=smaug,dom-core,peterv
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/46812 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

https://hg.mozilla.org/mozilla-central/rev/7427a6e013ec

Status: ASSIGNED → RESOLVED
Closed: 4 months ago
status-firefox129: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 129 Branch
Upstream PR merged by moz-wptsync-bot

Verified bug as fixed on rev mozilla-central 20240618214224-9b1e1be25a09.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox129: fixed → verified
Keywords: bugmon

The patch landed in nightly and beta is affected.
:avandolder, is this bug important enough to require an uplift?

  • If yes, please nominate the patch for beta approval.
  • If no, please set status-firefox128 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(avandolder)

Comment on attachment 9407304 [details]
Bug 1902333 - Fix crash when serializing empty shadow tree. r?#dom-core,smaug

Beta/Release Uplift Approval Request

  • User impact if declined: Possible crashes if websites attempt to serialize empty shadow trees.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): The change is quite minor and only prevents a possible null-pointer deference.
  • String changes made/needed:
  • Is Android affected?: Yes
Flags: needinfo?(avandolder)
Attachment #9407304 - Flags: approval-mozilla-beta?
Flags: in-testsuite+

Comment on attachment 9407304 [details]
Bug 1902333 - Fix crash when serializing empty shadow tree. r?#dom-core,smaug

Approved for 128.0b6.

Attachment #9407304 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: