1978189 - ThreadSanitizer: data race [@ ForgetHashEntry] vs. [@ gfxFontEntry::FontTableBlobData::~FontTableBlobData]

Tyson Smith [:tsmith]

Reporter

Description

•

1 year ago

Attached file tsan_log.txt — Details

Found with m-c 20250717-7ec5a911287f (--enable-thread-sanitizer)

This was found by visiting a live website with a TSan build.

WARNING: ThreadSanitizer: data race (pid=810025)
  Read of size 8 at 0x72080065ec88 by thread T39:
    #0 gfxFontEntry::FontTableBlobData::~FontTableBlobData() /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:421:9 (libxul.so+0x5162951) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #1 gfxFontEntry::FontTableHashEntry::DeleteFontTableBlobData(void*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:509:3 (libxul.so+0x516291a) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #2 destroy_user_data /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-blob.hh:47:7 (libxul.so+0x4f5fb48) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #3 ~hb_blob_t /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-blob.hh:41:19 (libxul.so+0x4f5fb48)
    #4 hb_object_destroy<hb_blob_t> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-object.hh:297:11 (libxul.so+0x4f5fb48)
    #5 hb_blob_destroy /builds/worker/checkouts/gecko/gfx/harfbuzz/src/hb-blob.cc:264:8 (libxul.so+0x4f5fb48)
    #6 destroy /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-machinery.hh:303:40 (libxul.so+0x4f5fb48)
    #7 do_destroy /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-machinery.hh:202:7 (libxul.so+0x4f5fb48)
    #8 fini /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-machinery.hh:188:19 (libxul.so+0x4f5fb48)
    #9 hb_ot_face_t::fini() /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-ot-face-table-list.hh:122:1 (libxul.so+0x4f5fb48)
    #10 hb_face_destroy /builds/worker/checkouts/gecko/gfx/harfbuzz/src/hb-face.cc:593:15 (libxul.so+0x4f5e9a6) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #11 hb_font_destroy /builds/worker/checkouts/gecko/gfx/harfbuzz/src/hb-font.cc:2097:3 (libxul.so+0x4f65a0b) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #12 gfxFont::GetBaselines(nsFontMetrics::FontOrientation) /builds/worker/checkouts/gecko/gfx/thebes/gfxFont.cpp:4472:3 (libxul.so+0x515f556) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    ...

  Previous write of size 8 at 0x72080065ec88 by thread T38 (mutexes: write M0):
    #0 ForgetHashEntry /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:443:16 (libxul.so+0x5162675) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #1 Clear /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:496:22 (libxul.so+0x5162675)
    #2 gfxFontEntry::FontTableHashEntry::ShareTableAndGetBlob(nsTArray<unsigned char>&&, gfxFontEntry*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:470:3 (libxul.so+0x5162675)
    #3 gfxFontEntry::ShareFontTableAndGetBlob(unsigned int, nsTArray<unsigned char>*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:550:17 (libxul.so+0x5162b37) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #4 gfxFontEntry::GetFontTable(unsigned int) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:571:10 (libxul.so+0x5162e4d) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #5 gfxFontconfigFontEntry::GetFontTable(unsigned int) /builds/worker/checkouts/gecko/gfx/thebes/gfxFcPlatformFontList.cpp:531:24 (libxul.so+0x50fcb5d) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #6 gfxFontEntry::HBGetTable(hb_face_t*, unsigned int, void*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:593:21 (libxul.so+0x5162f2b) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #7 reference_table /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-face.hh:83:12 (libxul.so+0x50762fa) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #8 hb_face_reference_table /builds/worker/checkouts/gecko/gfx/harfbuzz/src/hb-face.cc:701:16 (libxul.so+0x50762fa)
    #9 reference_table<OT::BASE> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-sanitize.hh:500:33 (libxul.so+0x50762fa)
    #10 hb_table_lazy_loader_t<OT::BASE, 27u, true>::create(hb_face_t*) /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-machinery.hh:301:14 (libxul.so+0x50762fa)
    ...

  Location is heap block of size 24 at 0x72080065ec80 allocated by thread T39:
    #0 malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:666:5 (firefox-bin+0xc1c70) (BuildId: a894af453178f0faa300c8d0666024d702930097)
    #1 moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52:15 (firefox-bin+0x1490d8) (BuildId: a894af453178f0faa300c8d0666024d702930097)
    #2 operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33:10 (libxul.so+0x51626da) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #3 gfxFontEntry::FontTableHashEntry::ShareTableAndGetBlob(nsTArray<unsigned char>&&, gfxFontEntry*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:472:21 (libxul.so+0x51626da)
    #4 gfxFontEntry::ShareFontTableAndGetBlob(unsigned int, nsTArray<unsigned char>*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:550:17 (libxul.so+0x5162b37) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #5 gfxFontEntry::GetFontTable(unsigned int) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:571:10 (libxul.so+0x5162e4d) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #6 gfxFontconfigFontEntry::GetFontTable(unsigned int) /builds/worker/checkouts/gecko/gfx/thebes/gfxFcPlatformFontList.cpp:531:24 (libxul.so+0x50fcb5d) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #7 gfxFontEntry::HBGetTable(hb_face_t*, unsigned int, void*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:593:21 (libxul.so+0x5162f2b) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #8 reference_table /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-face.hh:83:12 (libxul.so+0x50762fa) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #9 hb_face_reference_table /builds/worker/checkouts/gecko/gfx/harfbuzz/src/hb-face.cc:701:16 (libxul.so+0x50762fa)
    #10 reference_table<OT::BASE> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-sanitize.hh:500:33 (libxul.so+0x50762fa)
    ...

  Mutex M0 (0x725400240930) created at:
    #0 pthread_rwlock_init /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1486:3 (firefox-bin+0xc6960) (BuildId: a894af453178f0faa300c8d0666024d702930097)
    #1 mozilla::detail::RWLockImpl::RWLockImpl() /builds/worker/checkouts/gecko/mozglue/misc/RWLock_posix.cpp:19:3 (firefox-bin+0x1b1f87) (BuildId: a894af453178f0faa300c8d0666024d702930097)
    #2 mozilla::RWLock::RWLock(char const*) /builds/worker/checkouts/gecko/xpcom/threads/RWLock.cpp:11:9 (libxul.so+0x39ce145) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #3 gfxFontEntry::gfxFontEntry(nsTSubstring<char> const&, bool) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:61:7 (libxul.so+0x516170a) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #4 gfxFT2FontEntryBase /builds/worker/checkouts/gecko/gfx/thebes/gfxFT2FontBase.h:21:59 (libxul.so+0x510456d) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #5 gfxFontconfigFontEntry /builds/worker/checkouts/gecko/gfx/thebes/gfxFcPlatformFontList.cpp:285:7 (libxul.so+0x510456d)
    #6 gfxFcPlatformFontList::CreateFontEntry(mozilla::fontlist::Face*, mozilla::fontlist::Family const*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFcPlatformFontList.cpp:2126:18 (libxul.so+0x510456d)
    #7 operator() /builds/worker/checkouts/gecko/gfx/thebes/gfxPlatformFontList.cpp:1938:40 (libxul.so+0x51a87cc) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #8 OrInsertWith<(lambda at /builds/worker/checkouts/gecko/gfx/thebes/gfxPlatformFontList.cpp:1938:27)> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:739:23 (libxul.so+0x51a87cc)
    #9 operator()<nsBaseHashtable<nsPtrHashKey<const mozilla::fontlist::Face>, RefPtr<gfxFontEntry>, gfxFontEntry *, nsDefaultConverter<RefPtr<gfxFontEntry>, gfxFontEntry *> >::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:436:26 (libxul.so+0x51a87cc)
    #10 operator()<nsTHashtable<nsBaseHashtableET<nsPtrHashKey<const mozilla::fontlist::Face>, RefPtr<gfxFontEntry> > >::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:849:18 (libxul.so+0x51a87cc)
    ...

  Thread T39 'DOM Worker' (tid=810410, running) created by main thread at:
    #0 pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1023:3 (firefox-bin+0xc37d1) (BuildId: a894af453178f0faa300c8d0666024d702930097)
    #1 _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:429:10 (libnspr4.so+0x423fe) (BuildId: c1e451a527113ad803ecfa8126ff6ef268720a94)
    #2 PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:496:10 (libnspr4.so+0x37704) (BuildId: c1e451a527113ad803ecfa8126ff6ef268720a94)
    #3 nsThread::Init(nsTSubstring<char> const&) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:615:20 (libxul.so+0x39f1597) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #4 mozilla::dom::WorkerThread::Create(mozilla::dom::WorkerThreadFriendKey const&) /builds/worker/checkouts/gecko/dom/workers/WorkerThread.cpp:97:7 (libxul.so+0x8bd545b) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #5 mozilla::dom::workerinternals::RuntimeService::ScheduleWorker(mozilla::dom::WorkerPrivate&) /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:1408:37 (libxul.so+0x8b82e93) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #6 mozilla::dom::workerinternals::RuntimeService::RegisterWorker(mozilla::dom::WorkerPrivate&) /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:1291:19 (libxul.so+0x8b8221e) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #7 mozilla::dom::WorkerPrivate::Constructor(JSContext*, nsTSubstring<char16_t> const&, bool, mozilla::dom::WorkerKind, mozilla::dom::RequestCredentials, mozilla::dom::WorkerType, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::WorkerLoadInfo*, mozilla::ErrorResult&, nsTString<char16_t>, std::function<void (bool)>&&, std::function<void ()>&&, mozilla::ipc::Endpoint<mozilla::dom::PRemoteWorkerNonLifeCycleOpControllerChild>&&) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3134:24 (libxul.so+0x8bb4bd4) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #8 mozilla::dom::Worker::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::TrustedScriptURLOrUSVString const&, mozilla::dom::WorkerOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/workers/Worker.cpp:80:41 (libxul.so+0x8b905de) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #9 mozilla::dom::Worker_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./WorkerBinding.cpp:1084:52 (libxul.so+0x668affc) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #10 mozilla::dom::InterfaceObjectJSNative(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:761:10 (libxul.so+0x6bf11c5) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    ...

  Thread T38 'DOM Worker' (tid=810399, running) created by main thread at:
    #0 pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1023:3 (firefox-bin+0xc37d1) (BuildId: a894af453178f0faa300c8d0666024d702930097)
    #1 _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:429:10 (libnspr4.so+0x423fe) (BuildId: c1e451a527113ad803ecfa8126ff6ef268720a94)
    #2 PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:496:10 (libnspr4.so+0x37704) (BuildId: c1e451a527113ad803ecfa8126ff6ef268720a94)
    #3 nsThread::Init(nsTSubstring<char> const&) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:615:20 (libxul.so+0x39f1597) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #4 mozilla::dom::WorkerThread::Create(mozilla::dom::WorkerThreadFriendKey const&) /builds/worker/checkouts/gecko/dom/workers/WorkerThread.cpp:97:7 (libxul.so+0x8bd545b) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #5 mozilla::dom::workerinternals::RuntimeService::ScheduleWorker(mozilla::dom::WorkerPrivate&) /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:1408:37 (libxul.so+0x8b82e93) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #6 mozilla::dom::workerinternals::RuntimeService::RegisterWorker(mozilla::dom::WorkerPrivate&) /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:1291:19 (libxul.so+0x8b8221e) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #7 mozilla::dom::WorkerPrivate::Constructor(JSContext*, nsTSubstring<char16_t> const&, bool, mozilla::dom::WorkerKind, mozilla::dom::RequestCredentials, mozilla::dom::WorkerType, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::WorkerLoadInfo*, mozilla::ErrorResult&, nsTString<char16_t>, std::function<void (bool)>&&, std::function<void ()>&&, mozilla::ipc::Endpoint<mozilla::dom::PRemoteWorkerNonLifeCycleOpControllerChild>&&) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3134:24 (libxul.so+0x8bb4bd4) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #8 mozilla::dom::Worker::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::TrustedScriptURLOrUSVString const&, mozilla::dom::WorkerOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/workers/Worker.cpp:80:41 (libxul.so+0x8b905de) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #9 mozilla::dom::Worker_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./WorkerBinding.cpp:1084:52 (libxul.so+0x668affc) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    #10 mozilla::dom::InterfaceObjectJSNative(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:761:10 (libxul.so+0x6bf11c5) (BuildId: 37cffb64e5c7956d1e78f55da431888a9c666f82)
    ...

Andrew McCreight [:mccr8]

Comment 1

•

1 year ago

The previous write stack looks similar to bug 1909367.

Updated

•

1 year ago

Keywords: sec-moderate

Tyson Smith [:tsmith]

Reporter

Updated

•

1 year ago

Updated

•

1 year ago

Comment 2

•

1 year ago

The severity field is not set for this bug.
:lsalzman, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(lsalzman)

Lee Salzman [:lsalzman]

Updated

•

1 year ago

Component: Graphics: Text → Layout: Text and Fonts

Flags: needinfo?(lsalzman)

Andrew McCreight [:mccr8]

Updated

•

1 year ago

Group: gfx-core-security → layout-core-security

Emily McDonough [:alaskanemily]

Comment 3

•

1 year ago

Hey jkew, I saw your comment on bug 1909367 that there was a pending patch for 141 that might fix this. It looks like this is happening in 142.

Flags: needinfo?(jfkthame)

Jonathan Kew [:jfkthame]

Comment 4

•

1 year ago

There's also bug 1976782 which may be related; a patch landed there for 143 (and has been uplifted to 142 and esr). We'll need to keep an eye on this (and bug 1909367) to see whether they come up again, but without reliable STR it's difficult to verify fixes.

Flags: needinfo?(jfkthame)

Jonathan Kew [:jfkthame]

Updated

•

1 year ago

URL: 1976782

Jonathan Kew [:jfkthame]

Updated

•

1 year ago

URL: 1976782

Comment 5

•

1 year ago

The severity field is not set for this bug.
:jwatt, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(jwatt)

Tyson Smith [:tsmith]

Reporter

Comment 6

•

1 year ago

Attached file tsan_log_2.txt — Details

Tyson Smith [:tsmith]

Reporter

Comment 7

•

1 year ago

Attached file asan_log.txt — Details

I am able to reproduce the race and a UAF by visiting the URL in: https://crash-stats.mozilla.org/report/index/dc117f2b-4df1-476f-8a5d-9e02f0250822
It happens within a few seconds and only took a few (3) reloads.

==481986==ERROR: AddressSanitizer: heap-use-after-free on address 0x5110008128a8 at pc 0x7fffdf0077c6 bp 0x7fffb4383260 sp 0x7fffb4383258
READ of size 2 at 0x5110008128a8 thread T37
    #0 0x7fffdf0077c5 in operator unsigned short /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-algs.hh:143:63
    #1 0x7fffdf0077c5 in operator unsigned int /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-open-type.hh:73:39
    #2 0x7fffdf0077c5 in sanitize_shallow /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-open-type.hh:510:9
    #3 0x7fffdf0077c5 in sanitize<> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-open-type.hh:521:5
    #4 0x7fffdf0077c5 in OT::BaseScript::sanitize(hb_sanitize_context_t*) const /builds/worker/checkouts/gecko/gfx/harfbuzz/src/hb-ot-layout-base-table.hh:497:5
    #5 0x7fffdf006f70 in _dispatch<OT::BaseScript> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-sanitize.hh:153:56
    #6 0x7fffdf006f70 in dispatch<OT::BaseScript> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-sanitize.hh:160:39
    #7 0x7fffdf006f70 in sanitize<> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-open-type.hh:521:5
    #8 0x7fffdf006f70 in OT::BaseScriptRecord::sanitize(hb_sanitize_context_t*, void const*) const /builds/worker/checkouts/gecko/gfx/harfbuzz/src/hb-ot-layout-base-table.hh:554:5
    #9 0x7fffdf006cd6 in _dispatch<OT::BaseScriptRecord, const OT::BaseScriptList *> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-sanitize.hh:153:56
    #10 0x7fffdf006cd6 in dispatch<OT::BaseScriptRecord, const OT::BaseScriptList *> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-sanitize.hh:160:39
    ...

0x5110008128a8 is located 168 bytes inside of 248-byte region [0x511000812800,0x5110008128f8)
freed by thread T36 here:
    #0 0x5555556af596 in __interceptor_free _asan_rtl_:3
    #1 0x7fffdf1c6e7c in ~FontTableBlobData /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:425:3
    #2 0x7fffdf1c6e7c in gfxFontEntry::FontTableHashEntry::DeleteFontTableBlobData(void*) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:509:3
    #3 0x7fffdedcbdbc in destroy_user_data /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-blob.hh:47:7
    #4 0x7fffdedcbdbc in ~hb_blob_t /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-blob.hh:41:19
    #5 0x7fffdedcbdbc in hb_object_destroy<hb_blob_t> /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-object.hh:297:11
    #6 0x7fffdedcbdbc in hb_blob_destroy /builds/worker/checkouts/gecko/gfx/harfbuzz/src/hb-blob.cc:264:8
    #7 0x7fffdedd7130 in destroy /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-machinery.hh:311:40
    #8 0x7fffdedd7130 in do_destroy /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-machinery.hh:210:7
    #9 0x7fffdedd7130 in fini /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-machinery.hh:196:19
    #10 0x7fffdedd7130 in hb_ot_face_t::fini() /builds/worker/checkouts/gecko/gfx/harfbuzz/src/graph/../hb-ot-face-table-list.hh:122:1
    ...

previously allocated by thread T36 here:
    #0 0x5555556af82f in __interceptor_malloc _asan_rtl_:3
    #1 0x7fffdc626448 in Malloc /builds/worker/workspace/obj-build/dist/include/nsTArray.h:245:46
    #2 0x7fffdc626448 in nsTArrayFallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::EnsureCapacityImpl<nsTArrayFallibleAllocator>(unsigned long, unsigned long) /builds/worker/workspace/obj-build/dist/include/nsTArray.h:3241:43
    #3 0x7fffdc625f4c in EnsureCapacity<nsTArrayFallibleAllocator> /builds/worker/workspace/obj-build/dist/include/nsTArray.h:477:12
    #4 0x7fffdc625f4c in ExtendCapacity<nsTArrayFallibleAllocator> /builds/worker/workspace/obj-build/dist/include/nsTArray.h:3216:16
    #5 0x7fffdc625f4c in InsertSlotsAt<nsTArrayFallibleAllocator> /builds/worker/workspace/obj-build/dist/include/nsTArray.h:3482:17
    #6 0x7fffdc625f4c in unsigned char* nsTArray_Impl<unsigned char, nsTArrayInfallibleAllocator>::InsertElementsAtInternal<nsTArrayFallibleAllocator>(unsigned long, unsigned long) /builds/worker/workspace/obj-build/dist/include/nsTArray.h:2290:49
    #7 0x7fffdf10bd2f in SetLength<nsTArrayFallibleAllocator> /builds/worker/workspace/obj-build/dist/include/nsTArray.h:2219:11
    #8 0x7fffdf10bd2f in SetLength /builds/worker/workspace/obj-build/dist/include/nsTArray.h:2229:12
    #9 0x7fffdf10bd2f in gfxFT2FontEntryBase::CopyFaceTable(mozilla::gfx::SharedFTFace*, unsigned int, nsTArray<unsigned char>&) /builds/worker/checkouts/gecko/gfx/thebes/gfxFT2FontBase.cpp:85:16
    #10 0x7fffdf1c76a1 in gfxFontEntry::GetFontTable(unsigned int) /builds/worker/checkouts/gecko/gfx/thebes/gfxFontEntry.cpp:575:20
    ...

Thread T37 created by T0 (Web Content) here:
    #0 0x555555695071 in ___interceptor_pthread_create _asan_rtl_:3
    #1 0x7ffff73dc419 in _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:429:10
    #2 0x7ffff73ca65e in PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:496:10
    #3 0x7fffdc7044a1 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:615:20
    #4 0x7fffe5988f13 in mozilla::dom::WorkerThread::Create(mozilla::dom::WorkerThreadFriendKey const&) /builds/worker/checkouts/gecko/dom/workers/WorkerThread.cpp:98:7
    #5 0x7fffe58f93a7 in mozilla::dom::workerinternals::RuntimeService::ScheduleWorker(mozilla::dom::WorkerPrivate&) /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:1411:37
    #6 0x7fffe58f80a7 in mozilla::dom::workerinternals::RuntimeService::RegisterWorker(mozilla::dom::WorkerPrivate&) /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:1294:19
    #7 0x7fffe5952204 in mozilla::dom::WorkerPrivate::Constructor(JSContext*, nsTSubstring<char16_t> const&, bool, mozilla::dom::WorkerKind, mozilla::dom::RequestCredentials, mozilla::dom::WorkerType, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::WorkerLoadInfo*, mozilla::ErrorResult&, nsTString<char16_t>, std::function<void (bool)>&&, std::function<void ()>&&, mozilla::ipc::Endpoint<mozilla::dom::PRemoteWorkerNonLifeCycleOpControllerChild>&&) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3136:24
    #8 0x7fffe5911657 in mozilla::dom::Worker::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::TrustedScriptURLOrUSVString const&, mozilla::dom::WorkerOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/workers/Worker.cpp:80:41
    #9 0x7fffe164bb86 in mozilla::dom::Worker_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./WorkerBinding.cpp:1084:52
    #10 0x7fffe84c91d5 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    ...

Thread T36 created by T0 (Web Content) here:
    #0 0x555555695071 in ___interceptor_pthread_create _asan_rtl_:3
    #1 0x7ffff73dc419 in _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:429:10
    #2 0x7ffff73ca65e in PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:496:10
    #3 0x7fffdc7044a1 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:615:20
    #4 0x7fffe5988f13 in mozilla::dom::WorkerThread::Create(mozilla::dom::WorkerThreadFriendKey const&) /builds/worker/checkouts/gecko/dom/workers/WorkerThread.cpp:98:7
    #5 0x7fffe58f93a7 in mozilla::dom::workerinternals::RuntimeService::ScheduleWorker(mozilla::dom::WorkerPrivate&) /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:1411:37
    #6 0x7fffe58f80a7 in mozilla::dom::workerinternals::RuntimeService::RegisterWorker(mozilla::dom::WorkerPrivate&) /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:1294:19
    #7 0x7fffe5952204 in mozilla::dom::WorkerPrivate::Constructor(JSContext*, nsTSubstring<char16_t> const&, bool, mozilla::dom::WorkerKind, mozilla::dom::RequestCredentials, mozilla::dom::WorkerType, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::WorkerLoadInfo*, mozilla::ErrorResult&, nsTString<char16_t>, std::function<void (bool)>&&, std::function<void ()>&&, mozilla::ipc::Endpoint<mozilla::dom::PRemoteWorkerNonLifeCycleOpControllerChild>&&) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3136:24
    #8 0x7fffe5911657 in mozilla::dom::Worker::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::TrustedScriptURLOrUSVString const&, mozilla::dom::WorkerOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/workers/Worker.cpp:80:41
    #9 0x7fffe164bb86 in mozilla::dom::Worker_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./WorkerBinding.cpp:1084:52
    #10 0x7fffe84c91d5 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    ...

Tyson Smith [:tsmith]

Reporter

Comment 8

•

1 year ago

These are the signatures that are related to the entries in crash stats used by site-scout to produce these results.

Crash Signature: [@ RtlpFreeHeapInternal | RtlFreeHeap | free | DWriteFontFace::`scalar deleting destructor' ] [@ rx::ProgramD3D::getState ] [@ rx::VertexArray11::syncStateForDraw ]

Tyson Smith [:tsmith]

Reporter

Comment 9

•

1 year ago

Bumping this to a sec-high since I am able to reliably trigger a UAF.

status-firefox143: --- → affected

status-firefox144: --- → affected

Keywords: sec-moderate → csectype-uaf, sec-high

Tyson Smith [:tsmith]

Reporter

Updated

•

1 year ago

Crash Signature: [@ RtlpFreeHeapInternal | RtlFreeHeap | free | DWriteFontFace::`scalar deleting destructor' ] [@ rx::ProgramD3D::getState ] [@ rx::VertexArray11::syncStateForDraw ] → [@ RtlpFreeHeapInternal | RtlFreeHeap | free | DWriteFontFace::`scalar deleting destructor' ] [@ rx::ProgramD3D::getState ] [@ rx::VertexArray11::syncStateForDraw ] [@ gfxDWriteFontEntry::CreateFontFace ]

Ryan VanderMeulen [:RyanVM]

Updated

•

1 year ago

status-firefox142: affected → wontfix

status-firefox-esr128: --- → wontfix

status-firefox-esr140: --- → affected

Flags: needinfo?(jfkthame)

Daniel Holbert [:dholbert]

Comment 10

•

1 year ago

•

Edited

(In reply to Tyson Smith [:tsmith] (PTO) from comment #7)

I am able to reproduce the race and a UAF by visiting the URL in: https://crash-stats.mozilla.org/report/index/dc117f2b-4df1-476f-8a5d-9e02f0250822
It happens within a few seconds and only took a few (3) reloads.

If you're still able to trigger that, perhaps you could capture it for a pernosco trace?

I just tried locally (using a regular locally-built debug build on Linux) and was unable to trigger a crash in that build with repeated loads of the URL from that crash report. (Though perhaps I'd need it to be an ASAN build; not sure. I'll try that next. [EDIT: I tested with a local ASAN build and was unable to repro any crashes with that, too -- aside from an unrelated intentional abort in MediaManager.cpp, which looks like it might be us giving up on some task that's taking too long.])

Also, FWIW, the URL from that crash report typically redirects to a different domain in most cases.

Daniel Holbert [:dholbert]

Updated

•

1 year ago

Flags: needinfo?(twsmith)

Ryan VanderMeulen [:RyanVM]

Updated

•

1 year ago

status-firefox143: affected → wontfix

status-firefox-esr115: --- → affected

Tyson Smith [:tsmith]

Reporter

Updated

•

1 year ago

Crash Signature: [@ RtlpFreeHeapInternal | RtlFreeHeap | free | DWriteFontFace::`scalar deleting destructor' ] [@ rx::ProgramD3D::getState ] [@ rx::VertexArray11::syncStateForDraw ] [@ gfxDWriteFontEntry::CreateFontFace ] → [@ RtlpFreeHeapInternal | RtlFreeHeap | free | DWriteFontFace::`scalar deleting destructor' ] [@ RtlFreeHeap | free_base | __crt_state_management::wrapped_invoke<T> ] [@ rx::ProgramD3D::getState ] [@ rx::VertexArray11::syncStateForDraw ] [@ gfxDWriteF…

Tyson Smith [:tsmith]

Reporter

Comment 11

•

1 year ago

I am unable to reproduce/record the issue with rr using a TSan or ASan (-O0 or -01) build after many attempts. I am able to reproduce the issue with ASan and TSan without rr in ~4 attempts. I am using the URL from https://crash-stats.mozilla.org/report/index/dc117f2b-4df1-476f-8a5d-9e02f0250822.

To reproduce using site-scout:

pip install site-scout -U
site-scout <firefox> -u <url> --result-limit 1 --visits 10 --explore

Flags: needinfo?(twsmith)

Daniel Holbert [:dholbert]

Comment 12

•

1 year ago

I confirmed I can reproduce what looks like a variant of the crash -- I caught a harfbuzz object-validity assertion failing in a debug build, with a variant of Tyson's site-scout command above (pointing it at my own local asan-debug-opt build).

Here's the assertion that fails:
https://searchfox.org/firefox-main/rev/9ffc661a59959bcfdd1ac91119739ac76b778ee7/gfx/harfbuzz/src/hb-object.hh#275-276,280

static inline Type *hb_object_reference (Type *obj)
{
...
  assert (hb_object_is_valid (obj));

Note that the site-scout --explore option didn't work for me (that gives me some WebDriver error message and the requested page won't load), so at Tyson's suggestion I instead used --time-limit 60 -- and with that, the WebDriver error went away, and the page loaded, and I was able to trigger the aforementioned harfbuzz assertion (on site-scout's first attempt).

Like Tyson, though, I so far am unable to catch it under rr (running site-scout with the --rr param).

Daniel Holbert [:dholbert]

Comment 13

•

1 year ago

•

Edited

Attached file dholbert's ASAN log with harfbuzz assertion-failure — Details

Here's the site-scout-produced ASAN backtrace for the assertion-failure/abort that I got in comment 12. (Not obviously a UAF, but given that some harfbuzz object is failing "hb_object_is_valid", it seems maybe like it's an early indication of whatever memory issue ASAN picks up on a bit later.)

Daniel Holbert [:dholbert]

Comment 14

•

1 year ago

Triaging as S2 given the sec-high rating from this sometimes reproducing as a UAF (comment 9).

Severity: -- → S2

Flags: needinfo?(jwatt)

Tyson Smith [:tsmith]

Reporter

Updated

•

1 year ago

Updated

•

1 year ago

Duplicate of this bug: 1988636

Ryan VanderMeulen [:RyanVM]

Updated

•

1 year ago

status-firefox144: affected → wontfix

status-firefox145: --- → affected

Daniel Holbert [:dholbert]

Updated

•

11 months ago

Comment 16

•

11 months ago

The proposed switch to a Rust (skrifa-based) font backend should resolve this and similar issues, as we will no longer need the old gfxFontEntry table caching mechanism for performance.

Depends on: 1987940

Flags: needinfo?(jfkthame)

Tyson Smith [:tsmith]

Reporter

Updated

•

8 months ago

Comment 17

•

7 months ago

Bug 2015952 has a diagnosis and tentative patch, and Jonathan was working on a different approach.

Status: NEW → RESOLVED

Closed: 7 months ago

Duplicate of bug: 2015952

Resolution: --- → DUPLICATE

Ryan VanderMeulen [:RyanVM]

Updated

•

7 months ago

status-firefox145: affected → wontfix

status-firefox-esr115: affected → wontfix

status-firefox-esr140: affected → wontfix

Daniel Veditz [:dveditz]

Updated

•

1 month ago

Group: layout-core-security

tsan_log.txt 1 year ago Tyson Smith [:tsmith] 94.61 KB, text/plain		Details
tsan_log_2.txt 1 year ago Tyson Smith [:tsmith] 58.07 KB, text/plain		Details
asan_log.txt 1 year ago Tyson Smith [:tsmith] 33.66 KB, text/plain		Details
dholbert's ASAN log with harfbuzz assertion-failure 1 year ago Daniel Holbert [:dholbert] 14.36 KB, text/plain		Details