Closed Bug 1980730 Opened 1 year ago Closed 1 year ago

crash in [@ JS::GetNonCCWObjectGlobal]

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Platform:
Desktop
All
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
143 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox-esr128 --- unaffected
firefox-esr140 143+ verified
firefox141 --- wontfix
firefox142 --- wontfix
firefox143 + verified
firefox144 + verified

People

(Reporter: tsmith, Assigned: allstars.chh)

References

(Blocks 2 open bugs, Regression,
URL
)

Details

(5 keywords, Whiteboard: [adv-main143+r][adv-esr140.3+r])

Crash Data

Attachments

(2 files, 2 obsolete files)

(secure)
48 bytes, text/x-phabricator-request
freddy
: sec-approval+
Details | Review
(secure)
48 bytes, text/x-phabricator-request
phab-bot
: approval-mozilla-esr140+
Details | Review

Found with m-c 20250731-d34398f38898 (--enable-address-sanitizer)

This was found by visiting a live website with an ASan build.

STR:

  • Launch browser and visit site

This issue was triggered by visiting https://reactional-musicbox-test.web.app/.

==519253==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7cb62a8706f1 bp 0x7cb567f4ffb0 sp 0x7cb567f4ffb0 T38)
==519253==The signal is caused by a READ memory access.
==519253==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
    #0 0x7cb62a8706f1 in isProxy /builds/worker/workspace/obj-build/dist/include/js/shadow/Shape.h:57:18
    #1 0x7cb62a8706f1 in IsProxy /builds/worker/workspace/obj-build/dist/include/js/Proxy.h:399:67
    #2 0x7cb62a8706f1 in IsWrapper /builds/worker/workspace/obj-build/dist/include/js/Wrapper.h:396:10
    #3 0x7cb62a8706f1 in IsCrossCompartmentWrapper /builds/worker/workspace/obj-build/dist/include/js/Wrapper.h:400:10
    #4 0x7cb62a8706f1 in JS::GetNonCCWObjectGlobal(JSObject*) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:1192:3
    #5 0x7cb61fa2a815 in xpc::NativeGlobal(JSObject*) /builds/worker/checkouts/gecko/js/xpconnect/wrappers/WrapperFactory.cpp:788:9
    #6 0x7cb61e1f8c55 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:226:20
    #7 0x7cb61e1d21f7 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:885:17
    #8 0x7cb61fa00322 in LeaveMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:250:7
    #9 0x7cb61fa00322 in ~nsAutoMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:427:13
    #10 0x7cb61fa00322 in JS::loader::ModuleLoaderBase::EvaluateModule(JS::loader::ModuleLoadRequest*) /builds/worker/checkouts/gecko/js/loader/ModuleLoaderBase.cpp:1618:1
    #11 0x7cb627ad03a2 in EvaluateModule /builds/worker/workspace/obj-build/dist/include/js/loader/ModuleLoadRequest.h:114:47
    #12 0x7cb627ad03a2 in mozilla::dom::loader::WorkletModuleLoader::OnModuleLoadComplete(JS::loader::ModuleLoadRequest*) /builds/worker/checkouts/gecko/dom/worklet/loader/WorkletModuleLoader.cpp:278:29
    #13 0x7cb61f9f0a62 in JS::loader::ModuleLoadRequest::LoadFinished() /builds/worker/checkouts/gecko/js/loader/ModuleLoadRequest.cpp:175:12
    #14 0x7cb61f9fd565 in JS::loader::OnLoadRequestedModulesResolvedImpl(JS::loader::ModuleLoadRequest*) /builds/worker/checkouts/gecko/js/loader/ModuleLoaderBase.cpp:1168:15
    #15 0x7cb61fa0a616 in operator() /builds/worker/checkouts/gecko/js/loader/ModuleLoaderBase.cpp:1282:18
    #16 0x7cb61fa0a616 in std::_Function_handler<bool (JSContext*, JS::Handle<JS::Value>), JS::loader::ModuleLoaderBase::StartFetchingModuleDependencies(JS::loader::ModuleLoadRequest*)::$_0>::_M_invoke(std::_Any_data const&, JSContext*&&, JS::Handle<JS::Value>&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/std_function.h:282:9
    #17 0x7cb62a3df830 in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/std_function.h:687:14
    #18 0x7cb62a3df830 in js::GraphLoadingStateRecordObject::resolved(JSContext*, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/builtin/ModuleObject.cpp:1662:10
    #19 0x7cb62a3a27e4 in InnerModuleLoading(JSContext*, JS::Handle<js::GraphLoadingStateRecordObject*>, JS::Handle<js::ModuleObject*>) /builds/worker/checkouts/gecko/js/src/vm/Modules.cpp:1489:17
    #20 0x7cb62a39b86e in js::LoadRequestedModules(JSContext*, JS::Handle<js::ModuleObject*>, JS::Handle<JS::Value>, std::function<bool (JSContext*, JS::Handle<JS::Value>)>&&, std::function<bool (JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>)>&&) /builds/worker/checkouts/gecko/js/src/vm/Modules.cpp:1633:10
    #21 0x7cb61f9fb562 in JS::loader::ModuleLoaderBase::StartFetchingModuleDependencies(JS::loader::ModuleLoadRequest*) /builds/worker/checkouts/gecko/js/loader/ModuleLoaderBase.cpp:1276:14
    #22 0x7cb61f9f93ca in JS::loader::ModuleLoaderBase::OnFetchSucceeded(JS::loader::ModuleLoadRequest*) /builds/worker/checkouts/gecko/js/loader/ModuleLoaderBase.cpp:810:5
    #23 0x7cb61f9f9eda in JS::loader::ModuleLoaderBase::OnFetchComplete(JS::loader::ModuleLoadRequest*, nsresult) /builds/worker/checkouts/gecko/js/loader/ModuleLoaderBase.cpp:795:5
    #24 0x7cb627ac3a65 in OnFetchComplete /builds/worker/workspace/obj-build/dist/include/js/loader/ModuleLoadRequest.h:109:21
    #25 0x7cb627ac3a65 in mozilla::dom::FetchCompleteRunnable::RunOnWorkletThread() /builds/worker/checkouts/gecko/dom/worklet/WorkletFetchHandler.cpp:222:12
    #26 0x7cb625a2b753 in operator() /builds/worker/checkouts/gecko/dom/media/webaudio/AudioNodeTrack.cpp:225:15
    #27 0x7cb625a2b753 in mozilla::MediaTrack::ControlMessageWithNoShutdown<mozilla::AudioNodeTrack::SendRunnable(already_AddRefed<nsIRunnable>)::$_0>::Run() /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.h:1346:5
    #28 0x7cb624f91189 in mozilla::MediaTrackGraphImpl::RunMessagesInQueue() /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.cpp:1338:20
    #29 0x7cb624f95b9e in mozilla::MediaTrackGraphImpl::OneIterationImpl(long, long, mozilla::MixerCallbackReceiver*) /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.cpp:1672:3
    #30 0x7cb624d046c5 in mozilla::GraphRunner::Run() /builds/worker/checkouts/gecko/dom/media/GraphRunner.cpp:144:32
    #31 0x7cb61e3fddbc in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1153:16
    #32 0x7cb61e408318 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
    #33 0x7cb61f8a6649 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:299:20
    #34 0x7cb61f7b1af4 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10
    #35 0x7cb61f7b1af4 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
    #36 0x7cb61f7b1af4 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
    #37 0x7cb61e3f6bfe in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:366:10
    #38 0x7cb63a2eb8ab in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:191:3
    #39 0x5ab67eeb7b46 in asan_thread_start(void*) _asan_rtl_:28
    #40 0x7cb63a09caa3 in start_thread ./nptl/pthread_create.c:447:8
    #41 0x7cb63a129c3b in clone3 ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0

==519253==Register values:
rax = 0x0969696961f601bb  rbx = 0x00007cb567f4ffc0  rcx = 0x00000655fcd0839c  rdx = 0x0000000000000000
rdi = 0x4b4b4b4b0fb00dd8  rsi = 0x000032afe6841ce0  rbp = 0x00007cb567f4ffb0  rsp = 0x00007cb567f4ffb0
 r8 = 0x00007fffffffff01   r9 = 0x0000000000000f01  r10 = 0x00000f96aceb3d01  r11 = 0x0000000000000000
r12 = 0x00007cb567486600  r13 = 0x00000f96ace90cc0  r14 = 0x00007cb567486600  r15 = 0x00007cb56728a880
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/user/workspace/browsers/m-c-20250801103155-asan-opt/libxul.so+0x128706f1) (BuildId: 2bb9f04f6e71efb741fc07b2b40f6ffc6e1b929d)
Thread T38 created by T0 (Isolated Web Co) here:
    #0 0x5ab67eea1121 in ___interceptor_pthread_create _asan_rtl_:3
    #1 0x7cb63a2dc419 in _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:429:10
    #2 0x7cb63a2ca65e in PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:496:10
    #3 0x7cb61e3f9601 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:615:20
    #4 0x7cb61e406c10 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadManager.cpp:619:22
    #5 0x7cb61e411659 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:176:57
    #6 0x7cb624d03784 in NS_NewNamedThread<12UL> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:87:10
    #7 0x7cb624d03784 in mozilla::GraphRunner::Create(mozilla::MediaTrackGraphImpl*) /builds/worker/checkouts/gecko/dom/media/GraphRunner.cpp:43:7
    #8 0x7cb624fa8ada in mozilla::MediaTrackGraphImpl::Init(mozilla::MediaTrackGraph::GraphDriverType, mozilla::MediaTrackGraph::GraphRunType, unsigned int) /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.cpp:3479:24
    #9 0x7cb624f9f21f in mozilla::MediaTrackGraphImpl::GetInstance(mozilla::MediaTrackGraph::GraphDriverType, unsigned long, int, void const*, nsISerialEventTarget*) /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.cpp:3591:10
    #10 0x7cb6259f59fa in mozilla::dom::AudioDestinationNode::AudioDestinationNode(mozilla::dom::AudioContext*, bool, unsigned int, unsigned int) /builds/worker/checkouts/gecko/dom/media/webaudio/AudioDestinationNode.cpp:304:28
    #11 0x7cb6259e7b71 in mozilla::dom::AudioContext::AudioContext(nsPIDOMWindowInner*, bool, unsigned int, unsigned int, float) /builds/worker/checkouts/gecko/dom/media/webaudio/AudioContext.cpp:186:11
    #12 0x7cb6259ea1d5 in mozilla::dom::AudioContext::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::AudioContextOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/media/webaudio/AudioContext.cpp:289:11
    #13 0x7cb6220c3c9f in mozilla::dom::AudioContext_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./AudioContextBinding.cpp:785:58
    #14 0x7cb62a0b0745 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    #15 0x7cb62a0b0745 in CallJSNativeConstructor /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:519:8
    #16 0x7cb62a0b0745 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:725:14
    #17 0x7cb62a0cb905 in ConstructFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:772:10
    #18 0x7cb62a0cb905 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3272:16
    #19 0x7cb62a0acb99 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:395:10
    #20 0x7cb62a0acb99 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:471:13
    #21 0x7cb62a0adf2d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:629:13
    #22 0x7cb62a0afc31 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #23 0x7cb62a0afc31 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:696:8
    #24 0x7cb62a304a68 in js::fun_call(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/vm/JSFunction.cpp:1109:10
    #25 0x7cb62a0addb7 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    #26 0x7cb62a0addb7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:597:12
    #27 0x7cb62a0cb98d in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #28 0x7cb62a0cb98d in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:669:10
    #29 0x7cb62a0cb98d in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3287:16
    #30 0x7cb62a0acb99 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:395:10
    #31 0x7cb62a0acb99 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:471:13
    #32 0x7cb62a0adf2d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:629:13
    #33 0x7cb62a0afc31 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #34 0x7cb62a0afc31 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:696:8
    #35 0x7cb62a40a3d4 in js::PromiseObject::create(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, bool) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:3058:15
    #36 0x7cb62a40905d in PromiseConstructor(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:2960:7
    #37 0x7cb62a0b0745 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    #38 0x7cb62a0b0745 in CallJSNativeConstructor /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:519:8
    #39 0x7cb62a0b0745 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:725:14
    #40 0x7cb62a0cb905 in ConstructFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:772:10
    #41 0x7cb62a0cb905 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3272:16
    #42 0x7cb62a0acb99 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:395:10
    #43 0x7cb62a0acb99 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:471:13
    #44 0x7cb62a0adf2d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:629:13
    #45 0x7cb62a0afc31 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #46 0x7cb62a0afc31 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:696:8
    #47 0x7cb62a305760 in js::fun_apply(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/vm/JSFunction.cpp:1161:10
    #48 0x7cb62a0addb7 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    #49 0x7cb62a0addb7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:597:12
    #50 0x7cb62a0cb98d in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #51 0x7cb62a0cb98d in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:669:10
    #52 0x7cb62a0cb98d in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3287:16
    #53 0x7cb62a0acb99 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:395:10
    #54 0x7cb62a0acb99 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:471:13
    #55 0x7cb62a0adf2d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:629:13
    #56 0x7cb62a0afc31 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #57 0x7cb62a0afc31 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:696:8
    #58 0x7cb62a304a68 in js::fun_call(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/vm/JSFunction.cpp:1109:10
    #59 0x7cb62a0addb7 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    #60 0x7cb62a0addb7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:597:12
    #61 0x7cb62a0cb98d in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #62 0x7cb62a0cb98d in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:669:10
    #63 0x7cb62a0cb98d in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3287:16
    #64 0x7cb62a0acb99 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:395:10
    #65 0x7cb62a0acb99 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:471:13
    #66 0x7cb62a0adf2d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:629:13
    #67 0x7cb62a0afc31 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #68 0x7cb62a0afc31 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:696:8
    #69 0x7cb62a40a3d4 in js::PromiseObject::create(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, bool) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:3058:15
    #70 0x7cb62a40905d in PromiseConstructor(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:2960:7
    #71 0x7cb62a0b0745 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    #72 0x7cb62a0b0745 in CallJSNativeConstructor /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:519:8
    #73 0x7cb62a0b0745 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:725:14
    #74 0x7cb62a0cb905 in ConstructFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:772:10
    #75 0x7cb62a0cb905 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3272:16
    #76 0x7cb62a0acb99 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:395:10
    #77 0x7cb62a0acb99 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:471:13
    #78 0x7cb62a0adf2d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:629:13
    #79 0x7cb62a0afc31 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #80 0x7cb62a0afc31 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:696:8
    #81 0x7cb62a305760 in js::fun_apply(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/vm/JSFunction.cpp:1161:10
    #82 0x7cb62a0addb7 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:501:13
    #83 0x7cb62a0addb7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:597:12
    #84 0x7cb62a0cb98d in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #85 0x7cb62a0cb98d in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:669:10
    #86 0x7cb62a0cb98d in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3287:16
    #87 0x7cb62a0acb99 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:395:10
    #88 0x7cb62a0acb99 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:471:13
    #89 0x7cb62a0adf2d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:629:13
    #90 0x7cb62aff1299 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1705:10
    #91 0x7cb5888028c3  ([anon:js-executable-memory]+0x28c3)
    #92 0x7cb588808365  ([anon:js-executable-memory]+0x8365)
    #93 0x7cb58880a762  ([anon:js-executable-memory]+0xa762)
    #94 0x7cb5888004e5  ([anon:js-executable-memory]+0x4e5)
    #95 0x7cb62b7f2462 in EnterJit /builds/worker/checkouts/gecko/js/src/jit/Jit.cpp:114:5
    #96 0x7cb62b7f2462 in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/jit/Jit.cpp:260:10
    #97 0x7cb62a0ce4c4 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3326:40
    #98 0x7cb62a0acb99 in MaybeEnterInterpreterTrampoline /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:395:10
    #99 0x7cb62a0acb99 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:471:13
    #100 0x7cb62a0adf2d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:629:13
    #101 0x7cb62a0afc31 in InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:664:10
    #102 0x7cb62a0afc31 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:696:8
    #103 0x7cb62a1e817a in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
    #104 0x7cb6236098b2 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
    #105 0x7cb6246a5607 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
    #106 0x7cb6246a3fae in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:200:12
    #107 0x7cb62465f0b0 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1392:22
    #108 0x7cb6246610b0 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1698:12
    #109 0x7cb624660009 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1603:35
    #110 0x7cb6246483f9 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:466:5
    #111 0x7cb6246483f9 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:365:17
    #112 0x7cb624645f08 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:606:16
    #113 0x7cb62464cdc2 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1261:11
    #114 0x7cb624653fc0 in mozilla::EventDispatcher::DispatchDOMEvent(mozilla::dom::EventTarget*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:0:0
    #115 0x7cb6245f0bd9 in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/events/DOMEventTargetHelper.cpp:152:17
    #116 0x7cb62466d6c2 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /builds/worker/checkouts/gecko/dom/events/EventTarget.cpp:214:13
    #117 0x7cb62767276d in mozilla::dom::PostMessageRunnable::DispatchMessage() const /builds/worker/checkouts/gecko/dom/messagechannel/MessagePort.cpp:135:12
    #118 0x7cb627671f5c in mozilla::dom::PostMessageRunnable::Run() /builds/worker/checkouts/gecko/dom/messagechannel/MessagePort.cpp:71:5
    #119 0x7cb61e3cf73a in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
    #120 0x7cb61e3bd048 in mozilla::TaskController::RunTask(mozilla::Task*) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:196:19
    #121 0x7cb61e3c410d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1310:20
    #122 0x7cb61e3c1c48 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1133:15
    #123 0x7cb61e3c2266 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
    #124 0x7cb61e3de891 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
    #125 0x7cb61e3de891 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
    #126 0x7cb61e3fda1b in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
    #127 0x7cb61e408318 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
    #128 0x7cb61f8a56e9 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
    #129 0x7cb61f7b1af4 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10
    #130 0x7cb61f7b1af4 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
    #131 0x7cb61f7b1af4 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
    #132 0x7cb627f7afd6 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
    #133 0x7cb62815bb7b in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:471:33
    #134 0x7cb629e5270d in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:647:20
    #135 0x7cb61f7b1af4 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10
    #136 0x7cb61f7b1af4 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
    #137 0x7cb61f7b1af4 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
    #138 0x7cb629e50c76 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:585:34
    #139 0x5ab67eefe252 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

A Pernosco session is available here: https://pernos.co/debug/Fwchmdsvm-r-wDa7UAOloQ/index.html

I tried loading this site in a debug build. It crashes the tab, but I didn't get any kind of stack which is weird.

I got this crash in a release build: bp-cce4ec89-33aa-4899-8309-47f7a0250802

I guess the information was there in the initial report, but this is crashing on the address 0x4b4b4b4b0fb00dd8 so it looks like JS_SWEPT_TENURED_PATTERN.

Keywords: csectype-uaf, sec-high

Of note, this is some kind of worklet thread runtime, with mozilla::dom::loader::WorkletModuleLoader::OnModuleLoadComplete() on the stack.

Assignee: nobody → allstars.chh
Severity: -- → S2
Priority: -- → P1

https://hg-edge.mozilla.org/mozilla-central/rev/669ee6060f3c

This should have gone through sec-approval since this is a sec-high which affects older branches as well. Please request it retroactively.

Group: javascript-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 1 year ago
status-firefox141: --- → wontfix
status-firefox142: --- → wontfix
status-firefox143: affected → fixed
status-firefox-esr140: --- → affected
Flags: needinfo?(allstars.chh)
Resolution: --- → FIXED
Target Milestone: --- → 143 Branch

ESR115/ESR128 don't appear to crash on this page, but ESR140 does.

status-firefox-esr115: --- → unaffected
status-firefox-esr128: --- → unaffected
tracking-firefox143: --- → +
tracking-firefox-esr140: --- → 143+

Comment on attachment 9506638 [details]
(secure)

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: Difficult.
    This patch adds the dispatched MicroTasks into a list, which will be traced by JSTracers in GC.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: All branches should have this problem, once a minor GC is triggered then the crash may be triggered.
  • If not all supported branches, which bug introduced the flaw?: Bug 1572644
  • Do you have backports for the affected branches?: Yes
  • If not, how different, hard to create, and risky will they be?: N/A
  • How likely is this patch to cause regressions; how much testing does it need?: This patch shouldn't cause any regression, as it keeps track of the dispatched tasks in GC.
  • Is the patch ready to land after security approval is given?: Yes
  • Is Android affected?: Yes
Flags: needinfo?(allstars.chh)
Attachment #9506638 - Flags: sec-approval?

Please nominate this for ESR140 & ESR115 uplift when you get a chance.

Flags: needinfo?(allstars.chh)
Attachment #9507802 - Flags: approval-mozilla-esr140?
Attachment #9507804 - Flags: approval-mozilla-esr140?

firefox-esr140 Uplift Approval Request

  • User impact if declined: tab crashes when visiting https://reactional-musicbox-test.web.app
  • Code covered by automated testing: no
  • Fix verified in Nightly: no
  • Needs manual QE test: yes
  • Steps to reproduce for manual QE testing: visit https://reactional-musicbox-test.web.app, expected result: see a login page
  • Risk associated with taking this patch: low
  • Explanation of risk level: trace the dispatched MicroTasks in GC
  • String changes made/needed: no
  • Is Android affected?: yes
Flags: qe-verify+
Attachment #9507802 - Attachment is obsolete: true
Attachment #9507802 - Flags: approval-mozilla-esr140?
Attachment #9507806 - Flags: approval-mozilla-esr115?

firefox-esr115 Uplift Approval Request

  • User impact if declined: tab crashes when visiting https://reactional-musicbox-test.web.app
  • Code covered by automated testing: no
  • Fix verified in Nightly: no
  • Needs manual QE test: yes
  • Steps to reproduce for manual QE testing: visit https://reactional-musicbox-test.web.app, expected result: see a login page
  • Risk associated with taking this patch: low
  • Explanation of risk level: trace the dispatched MicroTasks in GC
  • String changes made/needed: no
  • Is Android affected?: yes

Just tried Firefox ESR 128 and it seems fine without crashing

Flags: needinfo?(allstars.chh)
Crash Signature: [@ JS::GetNonCCWObjectGlobal] → [@ JS::GetNonCCWObjectGlobal] [@ js::IsWrapper ]

(In reply to Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi] from comment #16)

Just tried Firefox ESR 128 and it seems fine without crashing

ESR128 is also EOL after this current cycle. Users will be migrated to 140.3esr next month.

QA Whiteboard: [uplift] [qa-ver-needed-c144/b143] [sec]
QA Contact: dbodea

I have reproduced this issue in Beta v142.0b9 I can confirm the fix in beta v143.0b1 and Nightly v143.0a1 and v144.0a1. Testing performed in MacOS 14.7.1 aarch64, Windows 10 and Ubuntu 22.

Status: RESOLVED → VERIFIED
Has STR: --- → yes
QA Whiteboard: [uplift] [qa-ver-needed-c144/b143] [sec] → [uplift] [qa-ver-done-c144/b143] [sec]
status-firefox143: fixed → verified
status-firefox144: --- → verified
Flags: qe-verify+
OS: Unspecified → All
Hardware: Unspecified → Desktop

Comment on attachment 9506638 [details]
(secure)

Let's remember to wait for sec-approval to happen before landing things.

Attachment #9506638 - Flags: sec-approval? → sec-approval+
Attachment #9507804 - Flags: approval-mozilla-esr140? → approval-mozilla-esr140+
Attachment #9507806 - Flags: approval-mozilla-esr115? → approval-mozilla-esr115+

Reverted this from esr115 because it was causing build bustages in WorkletThread.cpp.

  • Revert link
  • Push with failures
  • Failure Log
  • Failure line: /builds/worker/checkouts/gecko/dom/worklet/WorkletThread.cpp:164:20: error: 'class mozilla::MicroTaskRunnable' has no member named 'isInList'
Flags: needinfo?(allstars.chh)

The trace for dispatched MicroTasks was introduced in https://bugzilla.mozilla.org/show_bug.cgi?id=1960461
which is 140 release.
So I think uplift to ESR 115 isn't necessary.

And I have just tested with ESR 115 it doesn't have this problem

Flags: needinfo?(allstars.chh)

(In reply to Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi] from comment #9)

Comment on attachment 9506638 [details]
(secure)

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: Difficult.
    This patch adds the dispatched MicroTasks into a list, which will be traced by JSTracers in GC.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: All branches should have this problem, once a minor GC is triggered then the crash may be triggered.
  • If not all supported branches, which bug introduced the flaw?: Bug 1572644

To correct my previous comment, actually, it is bug 1960461 that introduced this bug.

Regressed by: 1960461
No longer regressed by: 1572644
Attachment #9507806 - Attachment is obsolete: true
Whiteboard: [adv-main143+r]
Whiteboard: [adv-main143+r] → [adv-main143+r][adv-esr140.3+r]

I've also verified the fix in ESR v140.3.0esr on Windows 10, MacOS 14.7 M1 and Ubuntu 24 ARM.

status-firefox-esr140: fixed → verified
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: