855174 - WebVTT use-after-free crash [@mozilla::dom::FragmentOrElement::Release]

Status: RESOLVED WORKSFORME

(Core :: Audio/Video, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: callstack

To reproduce reload the testcase a multiple times (10-30 times) and then let the video play.

alloc: parser/html/nsHtml5TreeOperation.cpp:341

      nsCOMPtr<nsINodeInfo> nodeInfo = aBuilder->GetNodeInfoManager()->
        GetNodeInfo(name, nullptr, ns, nsIDOMNode::ELEMENT_NODE);

[...]

MOZALLOC_EXPORT_NEW MOZALLOC_INLINE
void* operator new(size_t size) MOZALLOC_THROW_BAD_ALLOC
{
    return moz_xmalloc(size);
}


free: content/html/content/src/HTMLTrackElement.cpp:82

HTMLTrackElement::~HTMLTrackElement()
{
}

[...]

void
nsNodeInfo::LastRelease()
{
  nsRefPtr<nsNodeInfoManager> kungFuDeathGrip = mOwnerManager;
  delete this;
}


re-use: content/base/src/FragmentOrElement.cpp:1716

NS_IMPL_CYCLE_COLLECTING_RELEASE_WITH_DESTROY(FragmentOrElement,
                                              nsNodeUtils::LastRelease(this))


[...]

  uint16_t NodeType() const
  {
    return mInner.mNodeType;
  }


Tested with https://github.com/RickEyre/mozilla-central/commit/2e700035398ca49a90338c1f676892af1ebee0c6

Comment 1

[Christoph Diehl [:posidron]]

Attachment: testcase

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

Ralph can you take this one?

Is this only affecting trunk (FF 22)?

Comment 3

[Ralph Giles (:rillian)]

Sure.

This bug is against the integration branch at https://github.com/RickEyre/mozilla-central.git. The code in question hasn't landed yet. See bug 833385.

Comment 4

[Daniel Veditz [:dveditz]]

I'll mark Fx23 "affected" assuming you'll land bug 833385 in this cycle.

Comment 6

[Andrew McCreight [:mccr8]]

It looks like the relevant code has landed in 24.  Ralph, was this fixed when it landed?  Or is it still disabled on trunk?

Comment 7

[Ralph Giles (:rillian)]

Still behind a pref on trunk.

Comment 8

[bhavana bajaj [:bajaj]]

Given the pref is disabled by default on nightly, not tracking at this time.We should verify if the bug exists on version this will be enabled and renominate it if unfixed by then.

Also removing the tracking here for Fx23 given it is unaffected.

Comment 9

[David Bolter [:davidb] (NeedInfo me for attention)]

Ralph please update 25 status if you turn this on (bug 887978).

Comment 10

[Ralph Giles (:rillian)]

Thanks.

Comment 11

[Christoph Diehl [:posidron]]

This is not reproducible anymore.
Tested with https://hg.mozilla.org/integration/mozilla-inbound/rev/e56e8fbacb7c