824641 - heap-use-after-free in nsCSSFrameConstructor::ProcessRestyledFrames

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Mats Palmgren (inactive)]

STR: load layout/base/crashtests/460389-1.html in an ASan build compiled
with -DDEBUG_TRACEMALLOC_PRESARENA

The heap-use-after-free occurs when accessing frame->GetContent() on line
8115 in nsCSSFrameConstructor::ProcessRestyledFrames :

  8115      if (frame && frame->GetContent() != content) {
  8116        // XXXbz this is due to image maps messing with the primary frame of
  8117        // <area>s.  See bug 135040.  Remove this block once that's fixed.
  8118        frame = nullptr;
  8119        if (!(hint & nsChangeHint_ReconstructFrame)) {
  8120          continue;
  8121        }
  8122      }
  8123  
  8124      // skip any frame that has been destroyed due to a ripple effect
  8125      if (frame) {
  8126        if (!propTable->Get(frame, ChangeListProperty()))
  8127          continue;
  8128      }

The block on line 8124 needs to come before any use of 'frame'.

I think it's harmless in normal builds since a destroyed frame is
retained in the pres shell arena, so we'll read a poison value which
is unlikely to be equal to 'content' and set 'frame' to null on line
8118, and falling through here with a null 'frame' should be safe.

Comment 1

[Mats Palmgren (inactive)]

Attachment: fix

Comment 2

[Mats Palmgren (inactive)]

https://tbpl.mozilla.org/?tree=Try&rev=58eeb5c8c0d0

Comment 3

[Mats Palmgren (inactive)]

Looks like a regression from this cset:
http://hg.mozilla.org/mozilla-central/rev/328c67561b8b

Comment 4

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/06621f924ef1

Comment 5

[Graeme McCutcheon [:graememcc]]

https://hg.mozilla.org/mozilla-central/rev/06621f924ef1