Closed Bug 1902532 Opened 2 years ago Closed 21 days ago

heap-use-after-free in [@ mozilla::MediaTrackGraphImpl::GetInstance]

Categories

(Core :: Audio/Video, defect)

Product:
Core
Component:
Audio/Video
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1988931
Tracking Flags:
Tracking Status
firefox128 --- affected
firefox129 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-uaf, sec-moderate, testcase-wanted, Whiteboard: [scan:tjr-poc-mitigated])

Found while fuzzing 20240514-b2c1906d3f6e (--enable-address-sanitizer --enable-fuzzing)

This has been reported regularly (once a day or so) since it was initially found. We have been waiting for a reproducible test case to reduce or get a Pernosco session but it doesn't look like that is going to happen. Hopefully the ASan report is helpful.

==188559==ERROR: AddressSanitizer: heap-use-after-free on address 0x5080000e6d30 at pc 0x70e5c154be95 bp 0x7ffc26acfe50 sp 0x7ffc26acfe48
READ of size 4 at 0x5080000e6d30 thread T0 (Isolated Web Co)
    #0 0x70e5c154be94 in isRemoved /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:1176:35
    #1 0x70e5c154be94 in add<mozilla::MediaTrackGraphImpl *&> /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:2155:27
    #2 0x70e5c154be94 in add<mozilla::MediaTrackGraphImpl *&> /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:623:18
    #3 0x70e5c154be94 in mozilla::MediaTrackGraphImpl::GetInstance(mozilla::MediaTrackGraph::GraphDriverType, unsigned long, int, void const*, nsISerialEventTarget*) /gecko/dom/media/MediaTrackGraph.cpp:3587:3
    #4 0x70e5c202d483 in mozilla::dom::AudioDestinationNode::AudioDestinationNode(mozilla::dom::AudioContext*, bool, unsigned int, unsigned int) /gecko/dom/media/webaudio/AudioDestinationNode.cpp:310:28
    #5 0x70e5c201dda6 in mozilla::dom::AudioContext::AudioContext(nsPIDOMWindowInner*, bool, unsigned int, unsigned int, float) /gecko/dom/media/webaudio/AudioContext.cpp:189:11
    #6 0x70e5c2020935 in mozilla::dom::AudioContext::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::AudioContextOptions const&, mozilla::ErrorResult&) /gecko/dom/media/webaudio/AudioContext.cpp:297:11
    #7 0x70e5be3cb952 in mozilla::dom::AudioContext_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./AudioContextBinding.cpp:815:58
    #8 0x70e5c6cbe30b in CallJSNative /gecko/js/src/vm/Interpreter.cpp:481:13
    #9 0x70e5c6cbe30b in CallJSNativeConstructor /gecko/js/src/vm/Interpreter.cpp:497:8
    #10 0x70e5c6cbe30b in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:703:14
    #11 0x70e5c6cd7f15 in ConstructFromStack /gecko/js/src/vm/Interpreter.cpp:750:10
    #12 0x70e5c6cd7f15 in js::Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:3175:16
    #13 0x70e5c6cba7df in MaybeEnterInterpreterTrampoline /gecko/js/src/vm/Interpreter.cpp:395:10
    #14 0x70e5c6cba7df in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:453:13
    #15 0x70e5c6cbba2a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:607:13
    #16 0x70e5c6cbd7bc in InternalCall /gecko/js/src/vm/Interpreter.cpp:642:10
    #17 0x70e5c6cbd7bc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:674:8
    #18 0x70e5c6e217df in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/CallAndConstruct.cpp:119:10
    #19 0x70e5bf8e2532 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
    #20 0x70e5c09a3e2b in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
    #21 0x70e5c09a349c in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /gecko/dom/events/EventListenerManager.cpp:1330:43
    #22 0x70e5c09a57f4 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /gecko/dom/events/EventListenerManager.cpp:1653:12
    #23 0x70e5c09a4673 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /gecko/dom/events/EventListenerManager.cpp:1550:35
    #24 0x70e5c098c572 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:365:17
    #25 0x70e5c0989db1 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:606:16
    #26 0x70e5c09906ba in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /gecko/dom/events/EventDispatcher.cpp:1221:11
    #27 0x70e5c50b3495 in nsDocumentViewer::LoadComplete(nsresult) /gecko/layout/base/nsDocumentViewer.cpp:1030:7
    #28 0x70e5c59dc7cf in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /gecko/docshell/base/nsDocShell.cpp:6259:13
    #29 0x70e5c59db78a in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp:5639:7
    #30 0x70e5c59ddc06 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /gecko/docshell/base/nsDocShell.cpp
    #31 0x70e5bb6a3319 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:1356:3
    #32 0x70e5bb6a20b5 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:962:14
    #33 0x70e5bb69e85f in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /gecko/uriloader/base/nsDocLoader.cpp:784:9
    #34 0x70e5bb6a107e in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /gecko/uriloader/base/nsDocLoader.cpp:667:5
    #35 0x70e5c5a26264 in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /gecko/docshell/base/nsDocShell.cpp:13736:23
    #36 0x70e5b9be3873 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:632:22
    #37 0x70e5b9be61e3 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /gecko/netwerk/base/nsLoadGroup.cpp:536:10
    #38 0x70e5bde0bc02 in DoUnblockOnload /gecko/dom/base/Document.cpp:11719:18
    #39 0x70e5bde0bc02 in mozilla::dom::Document::UnblockOnload(bool) /gecko/dom/base/Document.cpp:11657:9
    #40 0x70e5bde39289 in mozilla::dom::Document::DispatchContentLoadedEvents() /gecko/dom/base/Document.cpp:8143:3
    #41 0x70e5bdf4ca4b in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
    #42 0x70e5bdf4ca4b in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
    #43 0x70e5bdf4ca4b in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
    #44 0x70e5bdf4ca4b in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
    #45 0x70e5bdf4ca4b in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
    #46 0x70e5bdf4ca4b in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
    #47 0x70e5bdf4ca4b in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
    #48 0x70e5b9886d8a in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:580:16
    #49 0x70e5b98728bd in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:907:26
    #50 0x70e5b986fe98 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:730:15
    #51 0x70e5b98704b6 in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:516:36
    #52 0x70e5b988dfb1 in operator() /gecko/xpcom/threads/TaskController.cpp:234:37
    #53 0x70e5b988dfb1 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /gecko/xpcom/threads/nsThreadUtils.h:548:5
    #54 0x70e5b98b06c4 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1204:16
    #55 0x70e5b98bba48 in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:480:10
    #56 0x70e5bb1834ae in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:85:21
    #57 0x70e5bafd0354 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #58 0x70e5bafd0354 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #59 0x70e5bafd0354 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #60 0x70e5c48435e9 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:148:27
    #61 0x70e5c49f720a in nsAppShell::Run() /gecko/widget/gtk/nsAppShell.cpp:469:33
    #62 0x70e5c68f1f9d in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:712:20
    #63 0x70e5bafd0354 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:370:10
    #64 0x70e5bafd0354 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:363:3
    #65 0x70e5bafd0354 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:345:3
    #66 0x70e5c68f1585 in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:647:34
    #67 0x5df311125670 in content_process_main /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #68 0x5df311125670 in main /gecko/browser/app/nsBrowserApp.cpp:378:18
    #69 0x70e5dc6cad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #70 0x70e5dc6cae3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #71 0x5df31104ccd8 in _start (/home/worker/builds/m-c-20240611133415-fuzzing-asan-opt/firefox+0xd6cd8) (BuildId: 52e4c6dd86e81b80754fcc9f5ce192b33880fb96)

0x5080000e6d30 is located 16 bytes inside of 96-byte region [0x5080000e6d20,0x5080000e6d80)
freed by thread T0 (Isolated Web Co) here:
    #0 0x5df3110e5566 in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
    #1 0x70e5c15bac6d in free_<mozilla::detail::HashTable<mozilla::MediaTrackGraphImpl *const, mozilla::HashSet<mozilla::MediaTrackGraphImpl *, mozilla::(anonymous namespace)::GraphHasher, InfallibleAllocPolicy>::SetHashPolicy, InfallibleAllocPolicy>::FakeSlot> /builds/worker/workspace/obj-build/dist/include/mozilla/mozalloc.h:179:5
    #2 0x70e5c15bac6d in freeTable /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:1701:18
    #3 0x70e5c15bac6d in mozilla::detail::HashTable<mozilla::MediaTrackGraphImpl* const, mozilla::HashSet<mozilla::MediaTrackGraphImpl*, mozilla::(anonymous namespace)::GraphHasher, InfallibleAllocPolicy>::SetHashPolicy, InfallibleAllocPolicy>::changeTableSize(unsigned int, mozilla::detail::HashTable<mozilla::MediaTrackGraphImpl* const, mozilla::HashSet<mozilla::MediaTrackGraphImpl*, mozilla::(anonymous namespace)::GraphHasher, InfallibleAllocPolicy>::SetHashPolicy, InfallibleAllocPolicy>::FailureBehavior) /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:1887:5
    #4 0x70e5c1548b74 in shrinkIfUnderloaded /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:1943:13
    #5 0x70e5c1548b74 in remove /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:2254:5
    #6 0x70e5c1548b74 in remove /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:644:33
    #7 0x70e5c1548b74 in mozilla::MediaTrackGraphImpl::RemoveTrack(mozilla::MediaTrack*) /gecko/dom/media/MediaTrackGraph.cpp:3849:15
    #8 0x70e5c1547e83 in mozilla::MediaTrack::Destroy() /gecko/dom/media/MediaTrackGraph.cpp:2365:10
    #9 0x70e5c1518725 in mozilla::dom::MediaStreamTrack::SetReadyState(mozilla::dom::MediaStreamTrackState) /gecko/dom/media/MediaStreamTrack.cpp:554:15
    #10 0x70e5c1517c05 in mozilla::dom::MediaStreamTrack::Destroy() /gecko/dom/media/MediaStreamTrack.cpp:236:3
    #11 0x70e5c151908c in mozilla::dom::MediaStreamTrack::cycleCollection::Unlink(void*) /gecko/dom/media/MediaStreamTrack.cpp:251:8
    #12 0x70e5b96deaac in nsCycleCollector::CollectWhite() /gecko/xpcom/base/nsCycleCollector.cpp:3161:26
    #13 0x70e5b96e24a9 in nsCycleCollector::Collect(mozilla::CCReason, ccIsManual, js::SliceBudget&, nsICycleCollectorListener*, bool) /gecko/xpcom/base/nsCycleCollector.cpp:3531:26
    #14 0x70e5b96e3ca5 in nsCycleCollector::FinishAnyCurrentCollection(mozilla::CCReason) /gecko/xpcom/base/nsCycleCollector.cpp:3590:3
    #15 0x70e5b9696483 in mozilla::CycleCollectedJSRuntime::OnGC(JSContext*, JSGCStatus, JS::GCReason) /gecko/xpcom/base/CycleCollectedJSRuntime.cpp:1796:7
    #16 0x70e5c7a5e3fc in callGCCallback /gecko/js/src/gc/GC.cpp:1589:3
    #17 0x70e5c7a5e3fc in js::gc::GCRuntime::maybeCallGCCallback(JSGCStatus, JS::GCReason) /gecko/js/src/gc/GC.cpp:4318:3
    #18 0x70e5c7a5ea8a in AutoCallGCCallbacks /gecko/js/src/gc/GC.cpp:4289:9
    #19 0x70e5c7a5ea8a in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget const&, JS::GCReason) /gecko/js/src/gc/GC.cpp:4365:23
    #20 0x70e5c7a60b63 in js::gc::GCRuntime::collect(bool, js::SliceBudget const&, JS::GCReason) /gecko/js/src/gc/GC.cpp:4593:9
    #21 0x70e5c7a2070c in js::gc::GCRuntime::runDebugGC() /gecko/js/src/gc/GC.cpp:5071:5
    #22 0x70e5c7a1eb94 in bool js::gc::CellAllocator::PreAllocChecks<(js::AllowGC)1>(JSContext*, js::gc::AllocKind) /gecko/js/src/gc/Allocator.cpp:258:11
    #23 0x70e5c6c9f079 in void* js::gc::CellAllocator::AllocNurseryOrTenuredCell<(JS::TraceKind)0, (js::AllowGC)1>(JSContext*, js::gc::AllocKind, unsigned long, js::gc::Heap, js::gc::AllocSite*) /gecko/js/src/gc/Allocator-inl.h:114:8
    #24 0x70e5c6f5b575 in NewObject<js::NativeObject, (js::AllowGC)1> /gecko/js/src/gc/Allocator-inl.h:94:16
    #25 0x70e5c6f5b575 in NewCell<js::NativeObject, (js::AllowGC)1, js::gc::AllocKind &, js::gc::Heap &, const JSClass *&> /gecko/js/src/gc/Allocator-inl.h:35:12
    #26 0x70e5c6f5b575 in newCell<js::NativeObject, (js::AllowGC)1, js::gc::AllocKind &, js::gc::Heap &, const JSClass *&> /gecko/js/src/vm/JSContext-inl.h:359:10
    #27 0x70e5c6f5b575 in JSFunction::create(JSContext*, js::gc::AllocKind, js::gc::Heap, JS::Handle<js::SharedShape*>) /gecko/js/src/vm/JSFunction-inl.h:63:28
    #28 0x70e5c6f5c368 in NewFunctionClone(JSContext*, JS::Handle<JSFunction*>, JS::Handle<JSObject*>) /gecko/js/src/vm/JSFunction.cpp:1815:7
    #29 0x70e5c6f5bf3c in js::CloneFunctionReuseScript(JSContext*, JS::Handle<JSFunction*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>) /gecko/js/src/vm/JSFunction.cpp:1848:23
    #30 0x70e5c6cef0d8 in js::Lambda(JSContext*, JS::Handle<JSFunction*>, JS::Handle<JSObject*>) /gecko/js/src/vm/Interpreter.cpp:4644:13
    #31 0x1ef35c61363e  ([anon:js-executable-memory]+0x463e)
    #32 0x1ef35ce22c1b  ([anon:js-executable-memory]+0x3c1b)
    #33 0x1ef35c630aa3  ([anon:js-executable-memory]+0x1aa3)
    #34 0x1ef35ce2182e  ([anon:js-executable-memory]+0x282e)
    #35 0x1ef35c630aa3  ([anon:js-executable-memory]+0x1aa3)
    #36 0x1ef35ce21042  ([anon:js-executable-memory]+0x2042)
    #37 0x1ef35c630aa3  ([anon:js-executable-memory]+0x1aa3)
    #38 0x1ef35ce20e85  ([anon:js-executable-memory]+0x1e85)
    #39 0x1ef35c630aa3  ([anon:js-executable-memory]+0x1aa3)

previously allocated by thread T0 (Isolated Web Co) here:
    #0 0x5df3110e57ff in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
    #1 0x5df311129d95 in moz_xmalloc /gecko/memory/mozalloc/mozalloc.cpp:52:15
    #2 0x70e5c15ba763 in createTable /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h
    #3 0x70e5c15ba763 in mozilla::detail::HashTable<mozilla::MediaTrackGraphImpl* const, mozilla::HashSet<mozilla::MediaTrackGraphImpl*, mozilla::(anonymous namespace)::GraphHasher, InfallibleAllocPolicy>::SetHashPolicy, InfallibleAllocPolicy>::changeTableSize(unsigned int, mozilla::detail::HashTable<mozilla::MediaTrackGraphImpl* const, mozilla::HashSet<mozilla::MediaTrackGraphImpl*, mozilla::(anonymous namespace)::GraphHasher, InfallibleAllocPolicy>::SetHashPolicy, InfallibleAllocPolicy>::FailureBehavior) /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:1864:22
    #4 0x70e5c154b904 in add<mozilla::MediaTrackGraphImpl *&> /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:2148:30
    #5 0x70e5c154b904 in add<mozilla::MediaTrackGraphImpl *&> /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:623:18
    #6 0x70e5c154b904 in mozilla::MediaTrackGraphImpl::GetInstance(mozilla::MediaTrackGraph::GraphDriverType, unsigned long, int, void const*, nsISerialEventTarget*) /gecko/dom/media/MediaTrackGraph.cpp:3587:3
    #7 0x70e5c10e08c9 in mozilla::dom::CanvasCaptureMediaStream::Init(mozilla::dom::Optional<double> const&, nsIPrincipal*) /gecko/dom/media/CanvasCaptureMediaStream.cpp:174:28
    #8 0x70e5c0e0cf70 in mozilla::dom::HTMLCanvasElement::CaptureStream(mozilla::dom::Optional<double> const&, nsIPrincipal&, mozilla::ErrorResult&) /gecko/dom/html/HTMLCanvasElement.cpp:877:25
    #9 0x70e5bfc27d5f in mozilla::dom::HTMLCanvasElement_Binding::captureStream(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./HTMLCanvasElementBinding.cpp:653:91
    #10 0x70e5bfd6d524 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /gecko/dom/bindings/BindingUtils.cpp:3268:13
    #11 0x70e5c6cbb8b4 in CallJSNative /gecko/js/src/vm/Interpreter.cpp:481:13
    #12 0x70e5c6cbb8b4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:575:12
    #13 0x70e5c7d22771 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /gecko/js/src/jit/BaselineIC.cpp:1663:10
    #14 0x1ef35c611923  ([anon:js-executable-memory]+0x2923)
    #15 0x1ef35c616d35  ([anon:js-executable-memory]+0x7d35)
    #16 0x1ef35c7be586  ([anon:js-executable-memory]+0x4f586)
    #17 0x1ef35c60f4e5  ([anon:js-executable-memory]+0x4e5)
    #18 0x70e5c7d32733 in EnterBaseline /gecko/js/src/jit/BaselineJIT.cpp:143:5
    #19 0x70e5c7d32733 in js::jit::EnterBaselineInterpreterAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*) /gecko/js/src/jit/BaselineJIT.cpp:199:26
    #20 0x70e5c6cdf0dc in js::Interpret(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:1991:17
    #21 0x70e5c6cba7df in MaybeEnterInterpreterTrampoline /gecko/js/src/vm/Interpreter.cpp:395:10
    #22 0x70e5c6cba7df in js::RunScript(JSContext*, js::RunState&) /gecko/js/src/vm/Interpreter.cpp:453:13
    #23 0x70e5c6cbba2a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:607:13
    #24 0x70e5c6cbd7bc in InternalCall /gecko/js/src/vm/Interpreter.cpp:642:10
    #25 0x70e5c6cbd7bc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /gecko/js/src/vm/Interpreter.cpp:674:8
    #26 0x70e5c6e217df in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /gecko/js/src/vm/CallAndConstruct.cpp:119:10
    #27 0x70e5bf8e2532 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
    #28 0x70e5c09a3e2b in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
    #29 0x70e5c09a349c in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /gecko/dom/events/EventListenerManager.cpp:1330:43
    #30 0x70e5c09a57f4 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /gecko/dom/events/EventListenerManager.cpp:1653:12
    #31 0x70e5c09a4673 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /gecko/dom/events/EventListenerManager.cpp:1550:35
    #32 0x70e5c098c572 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:365:17
    #33 0x70e5c0989db1 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /gecko/dom/events/EventDispatcher.cpp:606:16
    #34 0x70e5c09906ba in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /gecko/dom/events/EventDispatcher.cpp:1221:11
    #35 0x70e5c50b3495 in nsDocumentViewer::LoadComplete(nsresult) /gecko/layout/base/nsDocumentViewer.cpp:1030:7
    #36 0x70e5c59dc7cf in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /gecko/docshell/base/nsDocShell.cpp:6259:13

SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/obj-build/dist/include/mozilla/HashTable.h:1176:35 in isRemoved
Shadow bytes around the buggy address:
  0x5080000e6a80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x5080000e6b00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 04
  0x5080000e6b80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 04 fa
  0x5080000e6c00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x5080000e6c80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
=>0x5080000e6d00: fa fa fa fa fd fd[fd]fd fd fd fd fd fd fd fd fd
  0x5080000e6d80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 04 fa
  0x5080000e6e00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 04 fa
  0x5080000e6e80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x5080000e6f00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x5080000e6f80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
Has STR: --- → no
Keywords: testcase-wanted

The free stack shows that we're running JIT code, trying to allocate an object, which in turn (maybe due to some kind of GC zeal?) triggers a GC, which finishes off an incremental CC that is in progress, which destroys a hash table. Maybe the use stack is "under" the free stack and there was some kind of raw pointer to the hash table that was invalidated when we ran the CC (via the GC)? I dunno if there's anywhere in AudioContext::Constructor where we obviously run JS.

I put a "see also" on bug 1897240 which is vaguely in the same family of "bad things happen if we finish off a CC in the middle of running JS".

Looking at the use location, MediaTrackGraphImpl::GetInstance() gets a raw pointer into a hash set, stores it to the stack, then uses it. That use of graphs on line 3587 is where our UAF happens, so could we be running JS in between there, somehow? It isn't obvious to me how that could happen, but a raw pointer being alive for that long is concerning.

Keywords: sec-high

MediaTrackGraphImpl::Init() runs in between there, and can run both AddShutdownBlocker and RemoveShutdownBlocker, which are implemented in chrome JS, so that could be the problem. If that's the only place we can run JS, then I'd say this is more of a sec-moderate because it would be harder for content to trigger it. Memory pressure is at least somewhat shared between chrome and content, so it isn't impossible but I'm not sure how hard it would be.

Severity: -- → S3

This is an automated comment. To help with triage and priority, we are experimenting with an automated exploitation analysis.

The analysis re-ran the prior proofs of concept and adapted probes against a current ASAN build (revision 83cebcf5a522, 2026-10-09) on an unmodified tree, with no fix reverted, and did not reproduce the defect. The track insertion this bug depends on now happens after Init(), the change made by bug 1988931 (commit fe6c46f32891). The vulnerable ordering is therefore no longer in the tree, and this bug is resolved as a duplicate of the bug whose fix removed it.

If this analysis is demonstrably incorrect, please needinfo :tjr.

Status: NEW → RESOLVED
Closed: 21 days ago
Duplicate of bug: CVE-2025-11708
Resolution: --- → DUPLICATE
Whiteboard: [scan:tjr-poc-mitigated]
Group: media-core-security
You need to log in before you can comment on or make changes to this bug.