677847 - Crash [@ nsContentUtils::IsEventAttributeName ] at address 0x55555555 with malloc scribble

Status: VERIFIED FIXED

(Core :: General, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: stack

1. enable scribble on mac

2. http://vnexpress.net/RSS/GL/trang-chu.rss

   or

   http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/topsongs/limit=25/xml

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x55555555
0x054461ec in nsContentUtils::IsEventAttributeName (aName=0x25b84380, aType=1) at /work/mozilla/builds/nightly/mozilla/content/base/src/nsContentUtils.cpp:2919
2919	  if (name[0] != 'o' || name[1] != 'n')

0x55 is deleted memory in scribble

bug 675437 supposedly fixed the crash.

Windows crashes with address 0xffffffffdddddddd (also deleted memory). I don't see this on Linux.

Comment 1

[Bob Clary [:bc] (inactive)]

sorry, my linux workers are backed up building atm and haven't gotten to trying to reproduce these urls. I'll check them in a moment.

Comment 2

[Bob Clary [:bc] (inactive)]

Attachment: linux valgrind log

==2569== Invalid read of size 4
==2569==    at 0x8E02B92: nsIAtom::GetUTF16String() (nsIAtom.h:53)

==2569== Invalid read of size 2
==2569==    at 0x91E6343: nsContentUtils::IsEventAttributeName(nsIAtom*, int) (nsContentUtils.cpp:2919)

==2569== Invalid read of size 4
==2569==    at 0xA6DD6A0: js::MarkRangeConservatively(JSTracer*, unsigned int const*, unsigned int const*) (jsgc.cpp:817)

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

I think I see what the problem is - haven't even tried to reproduce this yet though.
Attribute has been removed from mAttrsAndChildren, and then we call
AfterSetAttr. Nothing guarantees that nsIAtom is still alive.
The normal rules say that caller must keep the object alive,
so in this case nsTreeSanitizer, but perhaps in this case UnsetAttr
could do it. Investigating.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

I'm going to fix this the usual way: caller needs to keep atom alive.
I checked other callers of UnsetAttr and they are safe.
http://mxr.mozilla.org/mozilla-central/source/content/xbl/src/nsXBLBinding.cpp#812
looks very much like this.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Attachment: patch

Bob, could you try this patch?

Comment 6

[Bob Clary [:bc] (inactive)]

Looks ok on mac with either of the urls.

Comment 7

[Johnny Stenback (:jst)]

Comment on attachment 552044 [details] [diff] [review]
patch

r=jst

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/52c4a8829da3

Comment 9

[Tracy Walker [:tracy]]

given urls don't crash on 9, 10 or 11

Comment 10

[thietbiyteuebe]

I think I see what the problem is - haven't even tried to reproduce this yet though.
Attribute has been removed from mAttrsAndChildren, and then we call
AfterSetAttr. Nothing guarantees that nsIAtom is still alive.
The normal rules say that caller must keep the object alive,
so in this case nsTreeSanitizer, but perhaps in this case UnsetAttr
could do it. Investigating.
http://uebe.vn/gia-may-do-huyet-ap-co-tren-thi-truong-hien-nay/
http://uebe.vn/cac-may-tinh-ngay-rung-trung-tu-dong-cua-cyclotest/
http://uebe.vn/cach-dung-que-thu-thai/

Comment 11

[Alex Vogt]

Status: RESOLVED → VERIFIED
Keywords: verified-aurora, verified-beta
-> Yes.
Wimpernverlängerung Stuttgart: http://mimi-lashes.de/

Comment 12

[TRAN QUOC BAO]

Failed at mozilla: https://bds123.vn/cho-thue-phong-tro-nha-tro.html
How to fix the error.

Comment 13

[thanhducdao95]

Failed at mozilla: https://hocsinhgioi.net/
How to fix the error.