506376 - Linux talos crash in nsViewManager::CreateView

Status: RESOLVED INCOMPLETE

(Core :: Layout, defect)

Description

[Johnathan Nightingale [:johnath]]

http://tinderbox.mozilla.org/showlog.cgi?log=Firefox/1248468375.1248472057.31148.gz&fulltext=1

Strictly speaking, it's in operator new, under nsViewManager::CreateView. Looks at first glance like a hopefully-safe OOM, but marking sec-sensitive because it's a crash, and I haven't assessed at all whether it's actually exploitable.

Partial stack:

Thread 0 (crashed)
 0  0xffffe410
    eip = 0xffffe410   esp = 0xbfbf1bb0   ebp = 0xbfbf1bcc   ebx = 0x0000192e
    esi = 0x0000192e   edi = 0xb66eeff4   eax = 0x00000000   ecx = 0x0000192e
    edx = 0x00000006   efl = 0x00200206
 1  libc-2.6.1.so + 0x2c200
    eip = 0xb65d5201   esp = 0xbfbf1bd4   ebp = 0xbfbf1cf8
 2  libstdc++.so.6.0.9 + 0xbb6df
    eip = 0xb67b96e0   esp = 0xbfbf1d00   ebp = 0xbfbf1d38
 3  libstdc++.so.6.0.9 + 0xb8f64
    eip = 0xb67b6f65   esp = 0xbfbf1d40   ebp = 0xbfbf1d58
 4  libstdc++.so.6.0.9 + 0xb8fa1
    eip = 0xb67b6fa2   esp = 0xbfbf1d60   ebp = 0xbfbf1d68
 5  libstdc++.so.6.0.9 + 0xb90c9
    eip = 0xb67b70ca   esp = 0xbfbf1d70   ebp = 0xbfbf1d88
 6  libstdc++.so.6.0.9 + 0xb96fd
    eip = 0xb67b76fe   esp = 0xbfbf1d90   ebp = 0xbfbf1db8
 7  libxul.so!nsView::operator new(unsigned int) [nsView.h:d53e256b5cb6 : 60 + 0xa]
    eip = 0xb76da16d   esp = 0xbfbf1dc0   ebp = 0xbfbf1dd8
 8  libxul.so!nsViewManager::CreateView(nsRect const&, nsIView const*, nsViewVisibility) [nsViewManager.cpp:d53e256b5cb6 : 282 + 0x6]
    eip = 0xb76d71d2   esp = 0xbfbf1de0   ebp = 0xbfbf1e08
 9  libxul.so!DocumentViewerImpl::MakeWindow(nsSize const&, nsIView*) [nsDocumentViewer.cpp:d53e256b5cb6 : 2255 + 0xe]
    eip = 0xb7445826   esp = 0xbfbf1e10   ebp = 0xbfbf1e78
10  libxul.so!DocumentViewerImpl::InitInternal(nsIWidget*, nsISupports*, nsIntRect const&, int, int, int) [nsDocumentViewer.cpp:d53e256b5cb6 : 892 + 0x8]
    eip = 0xb7449c45   esp = 0xbfbf1e80   ebp = 0xbfbf1ef8
11  libxul.so!DocumentViewerImpl::Init(nsIWidget*, nsIntRect const&) [nsDocumentViewer.cpp:d53e256b5cb6 : 696 + 0x15]
    eip = 0xb744a028   esp = 0xbfbf1f00   ebp = 0xbfbf1f28
12  libxul.so!nsDocShell::SetupNewViewer(nsIContentViewer*) [nsDocShell.cpp:d53e256b5cb6 : 7255 + 0xd]
    eip = 0xb7919fcc   esp = 0xbfbf1f30   ebp = 0xbfbf2118

Comment 1

[Jesse Ruderman]

Looks like |operator new| went off and called 0xffffe410.  Prior memory corruption?

roc, please take a quick look at this stack trace and decide whether the bug is INCO.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Looks like unrelated memory corruption to me :-(

Have we got Talos running under Valgrind?

Comment 3

[Jesse Ruderman]

Let's get our other tests running under Valgrind first ;)