800390 - layout/base/crashtests/265986-1.html fails on AddressSanitizer sometimes

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Christian Holler (:decoder)]

I noticed the following crash from layout/base/crashtests/265986-1.html under AddressSanitizer today:

==30701== ERROR: AddressSanitizer heap-use-after-free on address 0x2b692105b1c0 at pc 0x42b671 bp 0x7fff918633e0 sp 0x7fff918633b8
WRITE of size 1 at 0x2b692105b1c0 thread T0
    #0 0x42b670 (/home/decoder/LangFuzz/mozilla-central-browser/objdir-ff-asan64opt/dist/bin/firefox-bin+0x42b670)
    #1 0x2b68e1ad11ba (/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.1+0x611ba)
0x2b692105b1c0 is located 192 bytes inside of 240-byte region [0x2b692105b100,0x2b692105b1f0)
freed by thread T0 here:
    #0 0x42e880 (/home/decoder/LangFuzz/mozilla-central-browser/objdir-ff-asan64opt/dist/bin/firefox-bin+0x42e880)
    #1 0x2b6908d9eb1d (/usr/lib/jvm/java-6-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so+0xdb1d)
previously allocated by thread T0 here:
    #0 0x42ebba (/home/decoder/LangFuzz/mozilla-central-browser/objdir-ff-asan64opt/dist/bin/firefox-bin+0x42ebba)
    #1 0x2b68e1a8a0c9 (/lib/x86_64-linux-gnu/libglib-2.0.so.0.3200.1+0x1a0c9)


Attempting to symbolize this only adds little information, likely because I'm missing some debug symbols in some of the libs involved:

==30701== ERROR: AddressSanitizer heap-use-after-free on address 0x2b692105b1c0 at pc 0x42b671 bp 0x7fff918633e0 sp 0x7fff918633b8
WRITE of size 1 at 0x2b692105b1c0 thread T0
    #0 0x42b670 in memset ??:0
    #1 0x2b68e1ad11ba in g_slice_alloc0 /usr/include/x86_64-linux-gnu/bits/string3.h:85
0x2b692105b1c0 is located 192 bytes inside of 240-byte region [0x2b692105b100,0x2b692105b1f0)
freed by thread T0 here:
    #0 0x42e880 in free ??:0
    #1 0x2b6908d9eb1d in ?? ??:0
previously allocated by thread T0 here:
    #0 0x42ebba in posix_memalign ??:0
    #1 0x2b68e1a8a0c9 in allocator_memalign /build/buildd/glib2.0-2.32.1/./glib/gslice.c:1381


From the trace it seems that memory is allocated using glib, but is freed through the IcedTeaPlugin from OpenJDK by Firefox. If that is the case, then this bug is likely Linux-specific I guess.

Not sure what component this would fit best.

Comment 1

[Daniel Veditz [:dveditz]]

Don't know if this is a problem with IcedTea or with our own plugin code... If it's IcedTea we can change the severity to sec-vector and let them know about it (and also change the product to Plugins).

Comment 2

[John Schoenick [:johns]]

I can reproduce a double-free using trace malloc on linux with icedtea, but not the oracle JRE. I suspect this is an icedtea issue, but can't be sure without better symbols.

Comment 3

[Benjamin Smedberg]

choller, are you going to file this with IcedTea? I have no particular desire to track IcedTea bugs in b.m.o

Comment 4

[Christian Holler (:decoder)]

CCing some people related to IcedTea per IRC discussion.

Comment 5

[Andrew Haley]

Let's keep the bug here.

Comment 6

[Adam Domurad]

Christian, could you please post the Linux distribution and version of IcedTeaPlugin that you are using ?

I have not yet been able to reproduce it, does it occur every time in Firefox w/ASAN for you?

As well, it would be very helpful if you could either install debug info for icedtea-web, or build icedtea-web with the instructions here: http://icedtea.classpath.org/wiki/IcedTea-Web#Building_IcedTea-Web 
This will build it with debug info; the correctly symbolized output would help a lot. (The output with firefox+debuginfo would help, too)

Thanks!

Comment 7

[Christian Holler (:decoder)]

On my local test machine I was using Ubuntu 12.04 LTS which comes with:

icedtea-6-plugin 1.2-2ubuntu1
openjdk-6-jre 6b24-1.11.1-4ubuntu2

I can try building with these instructions :)

Comment 8

[Christian Holler (:decoder)]

When trying to build I'm hitting this problem using openjdk/jre 6:

checking if java.util.jar.Pack200 is available... no

Any idea how to work around that? I also do have a GDB trace for the issue (without debug symbols, but it shows a bit more information than just the ASan trace):


==9944== ERROR: AddressSanitizer attempting free on address which was not malloc()-ed: 
[snip]

Program received signal SIGABRT, Aborted.
0x00007ffff6e22445 in __GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff6e22445 in __GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff6e25bab in __GI_abort () at abort.c:91
#2  0x0000000000438a96 in __sanitizer::Abort() ()
#3  0x0000000000435a61 in __asan::AsanDie() ()
#4  0x000000000043707f in __sanitizer::Die() ()
#5  0x0000000000434f98 in __asan::ScopedInErrorReport::~ScopedInErrorReport() ()
#6  0x0000000000434f46 in __asan::ScopedInErrorReport::~ScopedInErrorReport() ()
#7  0x00000000004347ce in __asan::ReportFreeNotMalloced(unsigned long, __sanitizer::StackTrace*) ()
#8  0x000000000043b6e8 in __asan::Deallocate(unsigned char*, __sanitizer::StackTrace*) ()
#9  0x0000000000433754 in free ()
#10 0x00007fffb4cdbb1e in ITNP_Destroy(_NPP*, _NPSavedData**) () from /usr/lib/jvm/java-6-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so
#11 0x00007fffef2de14f in nsNPAPIPluginInstance::Stop (this=<optimized out>) at /builds/slave/try-lnx64/build/dom/plugins/base/nsNPAPIPluginInstance.cpp:304
#12 0x00007fffef32190c in nsPluginHost::StopPluginInstance (this=0x7fffcc7f5080, aInstance=0x7fffb58e4a80) at /builds/slave/try-lnx64/build/dom/plugins/base/nsPluginHost.cpp:3315
[snip]

Comment 9

[Adam Domurad]

Thanks for the stack-trace! Debug information would still be ideal but it does pinpoint the problematic part of the code, its a little hard to go off of though. Since I can't recreate it in Fedora I'm currently trying an Ubuntu VM.

I am unsure why Pack200 is not available .. I have only ever hit that error when a java5 runtime was being picked up for some reason. Do you happen to have gcj installed ? (Although it should not really matter). You can try with java7 openjdk, as well.

Comment 10

[Adam Domurad]

OK, I believe I have found the root of this problem. It does not seem to be a problem in icedtea-web-1.2.1+, icedtea-web-1.3.1+. I was able to reproduce it with icedtea-web-1.2 original release. This may be an Ubuntu packaging issue, as the disassembled output has a g_free call that exists in icedtea-web-1.2 but was replaced by the (in this case proper) g_mutex_free call.

For further bug reports it would be worthy to see if the issue comes up with the latest official release (at least within the series, eg 1.2.x, 1.3.x).

Christian, could you try http://icedtea.wildebeest.org/download/source/icedtea-web-1.2.2.tar.gz 
And build with the following:
./autogen.sh (might not be needed)
./configure --with-jdk-home=/usr/lib/jvm/java-6-openjdk-amd64/
make install

Thanks.

Comment 11

[Adam Domurad]

Any status update on confirming this ?

Comment 12

[Christian Holler (:decoder)]

(In reply to Adam Domurad from comment #11)
> Any status update on confirming this ?

Sorry, I got distracted by other stuff. I tried building the package and I'm still hitting the same error:

checking if java.util.jar.Pack200 is available... no
configure: error: java.util.jar.Pack200 not found.

I also tried using ./configure --with-jdk-home=/usr/lib/jvm/java-7-openjdk-amd64/ but hit the same message.

Comment 13

[Andrew Haley]

java.util.jar.Pack200 should be in $JAVA_HOME/jvm/java/jre/lib/rt.jar.

zebedee:~ $ jar tf /usr/lib/jvm/java/jre/lib/rt.jar | grep java.util.jar.Pack200
java/util/jar/Pack200$Packer.class
java/util/jar/Pack200$Unpacker.class
java/util/jar/Pack200.class

If it's not being found, there is something very wrong in your config.  It's
nothing to do with IcedTea.  In cany case we can't do wnything without your
config.log.

Comment 14

[Adam Domurad]

Is there a javac in your /usr/lib/jvm/java-7-openjdk-amd64/bin/ ? you've installed the jdk along with the jre, correct ?

Comment 15

[Christian Holler (:decoder)]

So for openjdk-6, the JDK is definitely installed, and Pack200 is there:

$ jar tf /usr/lib/jvm/java-6-openjdk-amd64/jre/lib/rt.jar | grep Pack200
java/util/jar/Pack200$Packer.class
java/util/jar/Pack200$Unpacker.class
java/util/jar/Pack200.class


But for openjdk-7, the JDK was in fact not installed (no clue why, as I was pretty sure I installed it). After installing it and using 7 for the configure line, it works now. Will report back when I have it working in Firefox for testing.

Comment 16

[Christian Holler (:decoder)]

I can confirm that with 1.2.2 the problem is gone on my machine :) Thanks. We need to investigate now what version is on the build slaves and if they can be upgraded.

Comment 17

[Adam Domurad]

Thanks for confirming! I will do some investigating to see if they really accidentally packaged 1.2 on Ubuntu, or if they patched it someway but messed up. It is worthy however to contact Ubuntu either way with this I think, as it affects one of their packages.

Comment 18

[Adam Domurad]

The appropriate person at Ubuntu LTS 12.04 has been notified, and it was clarified to me that 1.2-2 does _not_ mean 1.2.2. As such the package on Ubuntu LTS 12.04 is fairly out of date. The package will eventually be updated in the new year, if need be a custom built package should be used. I think this can be considered resolved.

Thanks, Adam

Comment 19

[Al Billings [:abillings - ex-MoCo]]

Resolving fixed as this appears to be addressed now.