Closed Bug 2013707 Opened 7 months ago Closed 7 months ago

AddressSanitizer: heap-use-after-free [@ GetBoolFlag] with READ of size 4 from nsLabelsNodeList::PopulateSelf

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
149 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox-esr140 --- unaffected
firefox147 --- unaffected
firefox148 --- unaffected
firefox149 + verified

People

(Reporter: jkratzer, Assigned: alice)

References

(Blocks 1 open bug, Regression)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

Testcase
498 bytes, text/html
Details
(secure)
48 bytes, text/x-phabricator-request
Details | Review

Testcase found while fuzzing mozilla-central rev 20b1a1e6c530 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build 20b1a1e6c530 --asan --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

AddressSanitizer: heap-use-after-free [@ GetBoolFlag] with READ of size 4

    =================================================================
    ==669783==ERROR: AddressSanitizer: heap-use-after-free on address 0x77f95320524c at pc 0x7729329ecb89 bp 0x7fff3bded720 sp 0x7fff3bded718
    READ of size 4 at 0x77f95320524c thread T0 (Isolated Web Co)
        #0 0x7729329ecb88 in GetBoolFlag /dom/base/nsINode.h:2149:12
        #1 0x7729329ecb88 in IsElement /dom/base/nsINode.h:594:35
        #2 0x7729329ecb88 in nsLabelsNodeList::PopulateSelf(unsigned int, unsigned int) /dom/base/nsContentList.cpp:1361:35
        #3 0x772932a3d836 in BringSelfUpToDate /dom/base/nsContentList.cpp:987:5
        #4 0x772932a3d836 in Length /dom/base/nsContentList.cpp:473:3
        #5 0x772932a3d836 in nsContentList::Length() /dom/base/nsContentList.h:291:36
        #6 0x77293330302f in mozilla::dom::NodeList_Binding::get_length(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./NodeListBinding.cpp:93:40
        #7 0x772934609226 in bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3178:13
        #8 0x77293d2575bd in CallJSNative /js/src/vm/Interpreter.cpp:490:13
        #9 0x77293d2575bd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:586:12
        #10 0x77293d259244 in InternalCall /js/src/vm/Interpreter.cpp:653:10
        #11 0x77293d259244 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
        #12 0x77293d25ae7a in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:807:10
        #13 0x77293d7d0a3a in CallGetter(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, js::PropertyInfoBase<unsigned int>, JS::MutableHandle<JS::Value>) /js/src/vm/NativeObject.cpp:2139:12
        #14 0x77293d7a4414 in GetExistingProperty<(js::AllowGC)1> /js/src/vm/NativeObject.cpp:2167:12
        #15 0x77293d7a4414 in NativeGetPropertyInline<(js::AllowGC)1> /js/src/vm/NativeObject.cpp:2310:14
        #16 0x77293d7a4414 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /js/src/vm/NativeObject.cpp:2340:10
        #17 0x77293d36d9ba in GetProperty /js/src/vm/ObjectOperations-inl.h:113:10
        #18 0x77293d36d9ba in JS_ForwardGetPropertyTo(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/vm/PropertyAndElement.cpp:598:10
        #19 0x7729346214ea in mozilla::dom::GetPropertyOnPrototype(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, bool*, JS::MutableHandle<JS::Value>) /dom/bindings/BindingUtils.cpp:2272:10
        #20 0x77293329aa4b in mozilla::dom::NodeList_Binding::DOMProxyHandler::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) const /builds/worker/workspace/obj-build/dom/bindings/./NodeListBinding.cpp:446:8
        #21 0x77293d216662 in getInternal /js/src/proxy/Proxy.cpp:524:19
        #22 0x77293d216662 in js::Proxy::get(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /js/src/proxy/Proxy.cpp:532:10
        #23 0x77293d288b07 in GetProperty /js/src/vm/ObjectOperations-inl.h:110:12
        #24 0x77293d288b07 in GetProperty /js/src/vm/ObjectOperations-inl.h:120:10
        #25 0x77293d288b07 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:4630:10
        #26 0x77293d26cef6 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:2927:12
        #27 0x77293d2563d6 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:384:10
        #28 0x77293d2563d6 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:460:13
        #29 0x77293d257737 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #30 0x77293d259244 in InternalCall /js/src/vm/Interpreter.cpp:653:10
        #31 0x77293d259244 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
        #32 0x77293d3c705a in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /js/src/vm/SelfHosting.cpp:1220:10
        #33 0x77293d300011 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /js/src/vm/AsyncFunction.cpp:157:8
        #34 0x77293ba70d8c in AsyncFunctionPromiseReactionJob /js/src/builtin/Promise.cpp:2512:12
        #35 0x77293ba70d8c in PromiseReactionJob(JSContext*, JS::Handle<JSObject*>) /js/src/builtin/Promise.cpp:2574:12
        #36 0x77293ba6ff36 in JS::RunJSMicroTask(JSContext*, JS::Handle<JSObject*>) /js/src/builtin/Promise.cpp:7711:12
        #37 0x77292e1f513e in RunAndConsumeJSMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:237:14
        #38 0x77292e1f513e in mozilla::RunMicroTask(JSContext*, JS::MutableHandle<mozilla::MustConsumeMicroTask>) /xpcom/base/CycleCollectedJSContext.cpp:876:26
        #39 0x77292e1f0a1a in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /xpcom/base/CycleCollectedJSContext.cpp:1009:7
        #40 0x772934632b20 in LeaveMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:427:7
        #41 0x772934632b20 in mozilla::dom::CallSetup::~CallSetup() /dom/bindings/CallbackObject.cpp:490:11
        #42 0x772932994521 in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject>>(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:72:3
        #43 0x77293299418c in mozilla::dom::CallbackTimeoutHandler::Call(char const*) /dom/base/TimeoutHandler.cpp:169:29
        #44 0x7729323a9e54 in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*) /dom/base/nsGlobalWindowInner.cpp:6432:38
        #45 0x77293298f247 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /dom/base/TimeoutManager.cpp:956:39
        #46 0x77293298e033 in mozilla::dom::TimeoutExecutor::MaybeExecute() /dom/base/TimeoutExecutor.cpp:179:11
        #47 0x77293299116a in Notify /dom/base/TimeoutExecutor.cpp:246:5
        #48 0x77293299116a in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /dom/base/TimeoutExecutor.cpp:0:0
        #49 0x77292e4188af in operator() /xpcom/threads/nsTimerImpl.cpp:746:44
        #50 0x77292e4188af in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, std::function<void (nsITimer *)> > &, (lambda at /xpcom/threads/nsTimerImpl.cpp:746:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:747:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:750:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:751:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:305:16
        #51 0x77292e4188af in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, std::function<void (nsITimer *)> > &, (lambda at /xpcom/threads/nsTimerImpl.cpp:745:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:746:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:747:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:750:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:751:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:314:14
        #52 0x77292e4188af in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, std::function<void (nsITimer *)> > &, (lambda at /xpcom/threads/nsTimerImpl.cpp:745:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:746:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:747:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:750:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:751:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:905:12
        #53 0x77292e4188af in match<(lambda at /xpcom/threads/nsTimerImpl.cpp:745:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:746:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:747:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:750:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:751:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:860:12
        #54 0x77292e4188af in nsTimerImpl::Fire(unsigned long) /xpcom/threads/nsTimerImpl.cpp:744:22
        #55 0x77292e41767d in nsTimerEvent::Run() /xpcom/threads/TimerThread.cpp:560:11
        #56 0x77292e44cb24 in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /xpcom/threads/ThrottledEventQueue.cpp:253:18
        #57 0x77292e44618f in mozilla::ThrottledEventQueue::Inner::Executor::Run() /xpcom/threads/ThrottledEventQueue.cpp:80:15
        #58 0x77292e3f4bba in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:705:16
        #59 0x77292e3e3ffb in mozilla::TaskController::RunTask(mozilla::Task*) /xpcom/threads/TaskController.cpp:196:19
        #60 0x77292e3eb2fd in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1325:20
        #61 0x77292e3e8dd8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1148:15
        #62 0x77292e3e93f6 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:641:36
        #63 0x77292e40a184 in operator() /xpcom/threads/TaskController.cpp:336:37
        #64 0x77292e40a184 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /xpcom/threads/nsThreadUtils.h:549:5
        #65 0x77292e42b2fa in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1168:16
        #66 0x77292e434549 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #67 0x77292fb67a93 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #68 0x77292fa469f4 in RunInternal /ipc/chromium/src/base/message_loop.cc:373:10
        #69 0x77292fa469f4 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #70 0x77292fa469f4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #71 0x772939487ef6 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:152:27
        #72 0x77293966ca5b in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:555:33
        #73 0x77293b72523d in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:656:20
        #74 0x77292fa469f4 in RunInternal /ipc/chromium/src/base/message_loop.cc:373:10
        #75 0x77292fa469f4 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #76 0x77292fa469f4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #77 0x77293b7241f6 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:594:34
        #78 0x58edb9c1680a in main /browser/app/nsBrowserApp.cpp:465:22
        #79 0x7b295402a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #80 0x7b295402a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #81 0x58edb9b307c8 in _start ??:0:0
    
    0x77f95320524c is located 28 bytes inside of 136-byte region [0x77f953205230,0x77f9532052b8)
    freed by thread T0 (Isolated Web Co) here:
        #0 0x58edb9bd18c6 in __interceptor_free _asan_rtl_:3
        #1 0x77293275a5a5 in Free /dom/base/nsNodeInfoManager.h:115:27
        #2 0x77293275a5a5 in nsIContent::Destroy() /dom/base/FragmentOrElement.cpp:132:1
        #3 0x77292e282677 in SnowWhiteKiller::Visit(nsPurpleBuffer&, nsPurpleBufferEntry*) /xpcom/base/nsCycleCollector.cpp:2671:9
        #4 0x77292e25b8be in void nsPurpleBuffer::VisitEntries<SnowWhiteKiller>(SnowWhiteKiller&) /xpcom/base/nsCycleCollector.cpp:988:23
        #5 0x77292e25cb04 in nsCycleCollector::FreeSnowWhiteWithBudget(JS::SliceBudget&) /xpcom/base/nsCycleCollector.cpp:2841:14
        #6 0x77292fe11a0c in AsyncFreeSnowWhite::Run() /js/xpconnect/src/XPCJSRuntime.cpp:161:9
        #7 0x77292e4471ee in IdleRunnableWrapper::Run() /xpcom/threads/nsThreadUtils.cpp:307:22
        #8 0x77292e3f4bba in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:705:16
        #9 0x77292e3e3ffb in mozilla::TaskController::RunTask(mozilla::Task*) /xpcom/threads/TaskController.cpp:196:19
        #10 0x77292e3eb2fd in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1325:20
        #11 0x77292e3e909b in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1190:15
        #12 0x77292e3e93f6 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:641:36
        #13 0x77292e40a161 in operator() /xpcom/threads/TaskController.cpp:333:37
        #14 0x77292e40a161 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:549:5
        #15 0x77292e42b2fa in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1168:16
        #16 0x77292e434549 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #17 0x77292fb67a9e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #18 0x77292fa469f4 in RunInternal /ipc/chromium/src/base/message_loop.cc:373:10
        #19 0x77292fa469f4 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #20 0x77292fa469f4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #21 0x772939487ef6 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:152:27
        #22 0x77293966ca5b in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:555:33
        #23 0x77293b72523d in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:656:20
        #24 0x77292fa469f4 in RunInternal /ipc/chromium/src/base/message_loop.cc:373:10
        #25 0x77292fa469f4 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #26 0x77292fa469f4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #27 0x77293b7241f6 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:594:34
        #28 0x58edb9c1680a in main /browser/app/nsBrowserApp.cpp:465:22
        #29 0x7b295402a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #30 0x7b295402a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #31 0x58edb9b307c8 in _start ??:0:0
    
    previously allocated by thread T0 (Isolated Web Co) here:
        #0 0x58edb9bd1b64 in __interceptor_malloc _asan_rtl_:3
        #1 0x772932ad6884 in Allocate /builds/worker/workspace/obj-build/dist/include/mozilla/dom/DOMArena.h:50:17
        #2 0x772932ad6884 in nsNodeInfoManager::Allocate(unsigned long) /dom/base/nsNodeInfoManager.cpp:290:20
        #3 0x772935a3244c in NS_NewHTMLMeterElement(already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser) /dom/html/HTMLMeterElement.cpp:11:1
        #4 0x7729359ac90c in CreateHTMLElement(unsigned int, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser) /dom/html/HTMLElementFactory.cpp:64:41
        #5 0x772932292ec1 in nsContentUtils::NewXULOrHTMLElement(mozilla::dom::Element**, mozilla::dom::NodeInfo*, mozilla::dom::FromParser, nsAtom*, mozilla::dom::CustomElementDefinition*) /dom/base/nsContentUtils.cpp:11302:18
        #6 0x7729359ac80c in NS_NewHTMLElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser, nsAtom*, mozilla::dom::CustomElementDefinition*) /dom/html/HTMLElementFactory.cpp:49:10
        #7 0x772932b20c29 in NS_NewElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser, nsAtom*, mozilla::dom::CustomElementDefinition*) /dom/base/nsNameSpaceManager.cpp:190:12
        #8 0x772932b20962 in NS_NewElement(mozilla::dom::Element**, already_AddRefed<mozilla::dom::NodeInfo>&&, mozilla::dom::FromParser, nsTSubstring<char16_t> const*) /dom/base/nsNameSpaceManager.cpp:180:10
        #9 0x7729326686e9 in mozilla::dom::Document::CreateElementNS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::ElementCreationOptionsOrString const&, mozilla::ErrorResult&) /dom/base/Document.cpp:9120:8
        #10 0x7729342b9f9a in mozilla::dom::Document_Binding::createElementNS(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./DocumentBinding.cpp:2499:74
        #11 0x7729346122dd in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3309:13
        #12 0x77293d2575bd in CallJSNative /js/src/vm/Interpreter.cpp:490:13
        #13 0x77293d2575bd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:586:12
        #14 0x77293d2756cc in InternalCall /js/src/vm/Interpreter.cpp:653:10
        #15 0x77293d2756cc in CallFromStack /js/src/vm/Interpreter.cpp:658:10
        #16 0x77293d2756cc in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3272:16
        #17 0x77293d2563d6 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:384:10
        #18 0x77293d2563d6 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:460:13
        #19 0x77293d257737 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:618:13
        #20 0x77293d259244 in InternalCall /js/src/vm/Interpreter.cpp:653:10
        #21 0x77293d259244 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:685:8
        #22 0x77293d5a6b58 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #23 0x772934403e96 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
        #24 0x77293553e727 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #25 0x77293553de0d in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1276:43
        #26 0x77293553fe9a in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1588:12
        #27 0x77293553edc9 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1493:35
        #28 0x772935527f2a in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:465:5
        #29 0x772935527f2a in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:364:17
        #30 0x7729355259ba in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:605:16
        #31 0x77293552c9fe in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1260:11
        #32 0x772935533100 in mozilla::EventDispatcher::DispatchDOMEvent(mozilla::dom::EventTarget*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp:0:0
        #33 0x772932ae5197 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/base/nsINode.cpp:1562:17
        #34 0x772932250acd in nsContentUtils::DispatchEvent(mozilla::dom::Document*, mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch, mozilla::SystemGroupOnly) /dom/base/nsContentUtils.cpp:5485:29
        #35 0x7729322507d1 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*, mozilla::SystemGroupOnly) /dom/base/nsContentUtils.cpp:5450:10
        #36 0x772932663b76 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8627:3
    
    SUMMARY: AddressSanitizer: heap-use-after-free (/home/jkratzer/builds/m-c-20260130092147-fuzzing-asan-opt/libxul.so+0xb1ecb88) (BuildId: 35adb9e1d83ce758797572bdf288c6deeb59cb90)
    Shadow bytes around the buggy address:
      0x77f953204f80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
      0x77f953205000: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
      0x77f953205080: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      0x77f953205100: fd fd fd fa fa fa fa fa fa fa fa fa 00 00 00 00
      0x77f953205180: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
    =>0x77f953205200: fa fa fa fa fa fa fd fd fd[fd]fd fd fd fd fd fd
      0x77f953205280: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
      0x77f953205300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x77f953205380: 00 fa fa fa fa fa fa fa fa fa 00 00 00 00 00 00
      0x77f953205400: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
      0x77f953205480: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
    ==669783==ABORTING
Attached file Testcase —

Possibly a regression from bug 1981349? That recently changed some of the code in nsLabelsNodeList.

Group: core-security → dom-core-security
Keywords: csectype-uaf, regression, regressionwindow-wanted, sec-high
Summary: AddressSanitizer: heap-use-after-free [@ GetBoolFlag] with READ of size 4 → AddressSanitizer: heap-use-after-free [@ GetBoolFlag] with READ of size 4 from nsLabelsNodeList::PopulateSelf

Ah yes, that could well have been caused by my changes.

Keywords: regressionwindow-wanted
Regressed by: 1981349

Set release status flags based on info from the regressing bug 1981349

status-firefox147: --- → unaffected
status-firefox148: --- → unaffected
status-firefox149: --- → affected
status-firefox-esr140: --- → unaffected

Verified bug as reproducible on mozilla-central 20260205042023-4779d1a57487.
The bug appears to have been introduced in the following build range:

Start: d83a8a389a1ed1d53f17b9cb24b76cc58c40e68c (20260115110734)
End: f05b4625a2941c45c364ffdc073f1122100689f4 (20260115134322)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=d83a8a389a1ed1d53f17b9cb24b76cc58c40e68c&tochange=f05b4625a2941c45c364ffdc073f1122100689f4

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

I can look into this, but I'm travelling this week. I can look next week if nobody's taken it by then.

Severity: -- → S2

[Tracking Requested - why for this release]: sec-high regression

tracking-firefox149: --- → ?

I'm looking into this today.

Attached file (secure) —
Assignee: nobody → alice
Status: NEW → ASSIGNED
Pushed by alice@igalia.com: https://github.com/mozilla-firefox/firefox/commit/4d60ecbfb13b https://hg.mozilla.org/integration/autoland/rev/9c3596e4215f Correctly shut down nsLabelsNodeList when any of its root nodes is destroyed. r=dom-core,smaug

https://hg.mozilla.org/mozilla-central/rev/9c3596e4215f

Group: dom-core-security → core-security-release
Status: ASSIGNED → RESOLVED
Closed: 7 months ago
status-firefox149: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 149 Branch

Verified bug as fixed on rev mozilla-central 20260210164342-80200c065fb1.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox149: fixed → verified
Keywords: bugmon
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: