1983101 - Crash [@ Id]

Reporter

Description

•

1 year ago

Testcase found while fuzzing mozilla-central rev 968f84606bec (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 968f84606bec --asan --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

[@ Id]

    =================================================================
    ==895340==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x70eae662fc21 bp 0x7ffc5efd94d0 sp 0x7ffc5efd9260 T0)
    ==895340==The signal is caused by a READ memory access.
    ==895340==Hint: address points to the zero page.
        #0 0x70eae662fc21 in Id /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/ProtocolUtils.h:214:31
        #1 0x70eae662fc21 in mozilla::dom::PWebIdentityChild::SendSetLoginStatus(mozilla::dom::LoginStatus const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (nsresult&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebIdentityChild.cpp:310:70
        #2 0x70eae661467e in mozilla::dom::PWebIdentityChild::SendSetLoginStatus(mozilla::dom::LoginStatus const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebIdentityChild.cpp:363:5
        #3 0x70eae661071a in mozilla::dom::WebIdentityHandler::SetLoginStatus(mozilla::dom::LoginStatus const&, RefPtr<mozilla::dom::Promise> const&) /dom/credentialmanagement/identity/WebIdentityHandler.cpp:147:11
        #4 0x70eae66104d2 in mozilla::dom::NavigatorLogin::SetStatus(mozilla::dom::LoginStatus, mozilla::ErrorResult&) /dom/credentialmanagement/identity/NavigatorLogin.cpp:84:20
        #5 0x70eae4416c21 in setStatus /builds/worker/workspace/obj-build/dom/bindings/./LoginStatusBinding.cpp:83:60
        #6 0x70eae4416c21 in mozilla::dom::NavigatorLogin_Binding::setStatus_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./LoginStatusBinding.cpp:99:13
        #7 0x70eae594bda2 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3308:13
        #8 0x70eaec7ce187 in CallJSNative /js/src/vm/Interpreter.cpp:501:13
        #9 0x70eaec7ce187 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:597:12
        #10 0x70eaec7ecbe8 in InternalCall /js/src/vm/Interpreter.cpp:664:10
        #11 0x70eaec7ecbe8 in CallFromStack /js/src/vm/Interpreter.cpp:669:10
        #12 0x70eaec7ecbe8 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3287:16
        #13 0x70eaec7ccf69 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:395:10
        #14 0x70eaec7ccf69 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:471:13
        #15 0x70eaec7ce2fd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:629:13
        #16 0x70eaec7d0001 in InternalCall /js/src/vm/Interpreter.cpp:664:10
        #17 0x70eaec7d0001 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:696:8
        #18 0x70eaecc90aca in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /js/src/vm/SelfHosting.cpp:1211:10
        #19 0x70eaec8bf459 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /js/src/vm/AsyncFunction.cpp:156:8
        #20 0x70eaecb7c749 in AsyncFunctionPromiseReactionJob /js/src/builtin/Promise.cpp:2286:10
        #21 0x70eaecb7c749 in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /js/src/builtin/Promise.cpp:2344:12
        #22 0x70eaec7ce187 in CallJSNative /js/src/vm/Interpreter.cpp:501:13
        #23 0x70eaec7ce187 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:597:12
        #24 0x70eaec7d0001 in InternalCall /js/src/vm/Interpreter.cpp:664:10
        #25 0x70eaec7d0001 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:696:8
        #26 0x70eaec914e4a in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #27 0x70eadf9a4815 in mozilla::PromiseJobRunnable::Call() /xpcom/base/CycleCollectedJSContext.cpp:214:10
        #28 0x70eadf9a3c77 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /xpcom/base/CycleCollectedJSContext.cpp:237:7
        #29 0x70eadf97cf97 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /xpcom/base/CycleCollectedJSContext.cpp:885:17
        #30 0x70eae596bae5 in LeaveMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:250:7
        #31 0x70eae596bae5 in mozilla::dom::CallbackObjectBase::CallSetup::~CallSetup() /dom/bindings/CallbackObject.cpp:395:11
        #32 0x70eae3db7894 in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject>>(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:72:3
        #33 0x70eae3db74fc in mozilla::dom::CallbackTimeoutHandler::Call(char const*) /dom/base/TimeoutHandler.cpp:158:29
        #34 0x70eae37ec4b7 in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*) /dom/base/nsGlobalWindowInner.cpp:6314:38
        #35 0x70eae3db2498 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /dom/base/TimeoutManager.cpp:945:39
        #36 0x70eae3db1263 in mozilla::dom::TimeoutExecutor::MaybeExecute() /dom/base/TimeoutExecutor.cpp:179:11
        #37 0x70eae3db437a in Notify /dom/base/TimeoutExecutor.cpp:246:5
        #38 0x70eae3db437a in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /dom/base/TimeoutExecutor.cpp:0:0
        #39 0x70eadfb9c5f4 in operator() /xpcom/threads/nsTimerImpl.cpp:725:44
        #40 0x70eadfb9c5f4 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:725:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:726:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:729:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:730:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
        #41 0x70eadfb9c5f4 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:724:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:725:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:726:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:729:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:730:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
        #42 0x70eadfb9c5f4 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:724:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:725:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:726:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:729:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:730:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:910:12
        #43 0x70eadfb9c5f4 in match<(lambda at /xpcom/threads/nsTimerImpl.cpp:724:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:725:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:726:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:729:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:730:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:865:12
        #44 0x70eadfb9c5f4 in nsTimerImpl::Fire(unsigned long) /xpcom/threads/nsTimerImpl.cpp:723:22
        #45 0x70eadfb9af9d in nsTimerEvent::Run() /xpcom/threads/TimerThread.cpp:565:11
        #46 0x70eadfbd1504 in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /xpcom/threads/ThrottledEventQueue.cpp:254:22
        #47 0x70eadfbcad7f in mozilla::ThrottledEventQueue::Inner::Executor::Run() /xpcom/threads/ThrottledEventQueue.cpp:81:15
        #48 0x70eadfb7fcba in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:703:16
        #49 0x70eadfb6d5c8 in mozilla::TaskController::RunTask(mozilla::Task*) /xpcom/threads/TaskController.cpp:196:19
        #50 0x70eadfb7468d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1310:20
        #51 0x70eadfb721c8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1133:15
        #52 0x70eadfb727e6 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:639:36
        #53 0x70eadfb90871 in operator() /xpcom/threads/TaskController.cpp:333:37
        #54 0x70eadfb90871 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #55 0x70eadfbaf86b in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1159:16
        #56 0x70eadfbba168 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #57 0x70eae126592e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #58 0x70eae1147ea4 in RunInternal /ipc/chromium/src/base/message_loop.cc:374:10
        #59 0x70eae1147ea4 in RunHandler /ipc/chromium/src/base/message_loop.cc:367:3
        #60 0x70eae1147ea4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:349:3
        #61 0x70eaea568ff6 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #62 0x70eaea751feb in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:471:33
        #63 0x70eaec512b9d in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:657:20
        #64 0x70eae1147ea4 in RunInternal /ipc/chromium/src/base/message_loop.cc:374:10
        #65 0x70eae1147ea4 in RunHandler /ipc/chromium/src/base/message_loop.cc:367:3
        #66 0x70eae1147ea4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:349:3
        #67 0x70eaec51068c in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:595:34
        #68 0x651be3a51e71 in main /browser/app/nsBrowserApp.cpp:397:22
        #69 0x70eb03f1c1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #70 0x70eb03f1c28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #71 0x651be3971c08 in _start ??:0:0
    
    ==895340==Register values:
    rax = 0x00007ffc5efd9330  rbx = 0x000070eb01f84720  rcx = 0x0000f2f2f200f2f2  rdx = 0x000070eb01f84720
    rdi = 0x0000000000000008  rsi = 0x00007ffc5efd9617  rbp = 0x00007ffc5efd94d0  rsp = 0x00007ffc5efd9260
     r8 = 0x0000000000000d40   r9 = 0x0000000000000003  r10 = 0x00007fffffffff01  r11 = 0x56118d81e98f1001
    r12 = 0x00007ffc5efd9617  r13 = 0x000070eb01f84720  r14 = 0x00000fff8bdfb250  r15 = 0x0000000000000000
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV (/home/jkratzer/builds/m-c-20250813214947-fuzzing-asan-opt/libxul.so+0xd20ac21) (BuildId: 80673922589cd0567cbe54e7b4cc978e85002aa4)
    ==895340==ABORTING

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

1 year ago

Attached file Testcase — Details

Jason Kratzer [:jkratzer]

Reporter

Updated

•

1 year ago

Attachment #9507152 - Attachment filename: testcase.zip.undefined → testcase.zip

Mayank Bansal

Comment 2

•

1 year ago

Got a crash from the testcase on Nightly: https://crash-stats.mozilla.org/report/index/b0518c4b-ee1e-4bb9-b683-652c80250814

Crash Signature: [@ Id] → [@ Id] [@ mozilla::ipc::IProtocol::Id ]

Bugmon [:jkratzer for issues]

Comment 3

•

1 year ago

Verified bug as reproducible on mozilla-central 20250814155310-48334adb76bb.
The bug appears to have been introduced in the following build range:

Start: 6f8bec64e86fb9adab0856e3dc1640893d20649c (20250612232238)
End: 38642729ab1493da2392d3a3e9d87bedd99b3c99 (20250613005213)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=6f8bec64e86fb9adab0856e3dc1640893d20649c&tochange=38642729ab1493da2392d3a3e9d87bedd99b3c99

Keywords: regression

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

BugBot [:suhaib / :marco]

Comment 4

•

1 year ago

This bug has been marked as a regression. Setting status flag for Nightly to affected.

status-firefox144: --- → affected

Donal Meehan [:dmeehan]

Comment 5

•

1 year ago

Bug 1969017 looks like the likely regressor.

status-firefox142: --- → affected

status-firefox143: --- → affected

status-firefox-esr115: --- → unaffected

status-firefox-esr128: --- → unaffected

status-firefox-esr140: --- → unaffected

Flags: needinfo?(bvandersloot)

Regressed by: 1969017

Benjamin VanderSloot [:bvandersloot]

Assignee

Comment 6

•

1 year ago

Taking a look at this!

The example creates a frame on the current document, grabs the content window of the frame, adopts the node over to a new document created with new Document(), then invokes a function that causes an IPC and makes the actor fall over. Then in invokes the IPC again and I missed some null checks because I didn't realize the actor breakdown could happen there. I'll fix all similar cases in this function.

Flags: needinfo?(bvandersloot)

Benjamin VanderSloot [:bvandersloot]

Assignee

Comment 7

•

1 year ago

Attached file Bug 1983101 - Fix crash in navigator.login.setStatus - r=#anti-tracking! — Details

Phabricator Automation

Updated

•

1 year ago

Assignee: nobody → bvandersloot

Status: NEW → ASSIGNED

Pulsebot

Comment 8

•

1 year ago

Pushed by bvandersloot@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/e917d1f48e17 https://hg.mozilla.org/integration/autoland/rev/94b9d6ff8926 Fix crash in navigator.login.setStatus - r=emz

Cosmin Sabou [:CosminS]

Comment 9

•

1 year ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/94b9d6ff8926

Status: ASSIGNED → RESOLVED

Closed: 1 year ago

status-firefox144: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → 144 Branch

BugBot [:suhaib / :marco]

Comment 10

•

1 year ago

The patch landed in nightly and beta is affected.
:bvandersloot, is this bug important enough to require an uplift?

If yes, please nominate the patch for beta approval.
- See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
If no, please set status-firefox143 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(bvandersloot)

Benjamin VanderSloot [:bvandersloot]

Assignee

Updated

•

1 year ago

status-firefox142: affected → wontfix

status-firefox143: affected → wontfix

Flags: needinfo?(bvandersloot)

Bugmon [:jkratzer for issues]

Comment 11

•

1 year ago

Verified bug as fixed on rev mozilla-central 20250826095322-b7573b229c2d.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED

status-firefox144: fixed → verified

Keywords: bugmon

Testcase 1 year ago Jason Kratzer [:jkratzer] 4.84 KB, application/octet-stream		Details
Bug 1983101 - Fix crash in navigator.login.setStatus - r=#anti-tracking! 1 year ago Benjamin VanderSloot [:bvandersloot] 48 bytes, text/x-phabricator-request		Details \| Review

Bugzilla

Crash [@ Id]

Categories

(Core :: DOM: Credential Management, defect)

Tracking

()

People

(Reporter: jkratzer, Assigned: bvandersloot)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Updated

Comment 2

Comment 3

Comment 4

Comment 5

Comment 6

Comment 7

Updated

Comment 8

Comment 9

Comment 10

Updated

Comment 11

Attachment

General

Description

File Name

Content Type