932449 - Heap-use-after-free in mozilla::RestyleManager::GetHoverGeneration()

Status: RESOLVED FIXED

(Core :: DOM: Events, defect, P1)

Description

[Atte Kettunen]

Attachment: repro.html

Tested in:

OS: Ubuntu 12.04

Firefox: debug ASAN-build from https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-linux64-asan-debug/1383057658/

Repro-file has two parts. 

run.html opens repro.html in an iframe and reloads it with 400ms interval via onload-event. To reproduce the issue open run.html with Firefox and move mouse cursor into the area of the iframe on the page.

ASAN-report:

==15391==ERROR: AddressSanitizer: heap-use-after-free on address 0x6170001e8f1c at pc 0x7f031be759fe bp 0x7ffffaed2b20 sp 0x7ffffaed2b18
READ of size 4 at 0x6170001e8f1c thread T0
    #0 0x7f031be759fd in mozilla::RestyleManager::GetHoverGeneration() const /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/RestyleManager.h:75:0
    #1 0x7f031be7594e in PresShell::DispatchSynthMouseMove(mozilla::WidgetGUIEvent*, bool) /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsPresShell.cpp:3416:0
    #2 0x7f031be7f1b1 in PresShell::ProcessSynthMouseMoveEvent(bool) /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsPresShell.cpp:5256:0
    #3 0x7f031bea0d6d in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsRefreshDriver.cpp:1074:0
    #4 0x7f031bea6d5d in mozilla::RefreshDriverTimer::Tick() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsRefreshDriver.cpp:160:0
    #5 0x7f031eb1ccb6 in nsTimerImpl::Fire() /builds/slave/m-cen-l64-asan-d-0000000000000/build/xpcom/threads/nsTimerImpl.cpp:546:0
    #6 0x7f031eb1d45e in nsTimerEvent::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/xpcom/threads/nsTimerImpl.cpp:630:0
    #7 0x7f031eb141ce in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/xpcom/threads/nsThread.cpp:622:0
    #8 0x7f031ea6501f in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-cen-l64-asan-d-0000000000000/build/xpcom/glue/nsThreadUtils.cpp:251:0
    #9 0x7f031dc72e77 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/ipc/glue/MessagePump.cpp:85:0
    #10 0x7f031ebff270 in MessageLoop::RunInternal() /builds/slave/m-cen-l64-asan-d-0000000000000/build/ipc/chromium/src/base/message_loop.cc:220:0
    #11 0x7f031ebff074 in MessageLoop::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/ipc/chromium/src/base/message_loop.cc:187:0
    #12 0x7f031da8dfd0 in nsBaseAppShell::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/widget/xpwidgets/nsBaseAppShell.cpp:161:0
    #13 0x7f031d5f7ad5 in nsAppStartup::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/toolkit/components/startup/nsAppStartup.cpp:268:0
    #14 0x7f031b438c3b in XREMain::XRE_mainRun() /builds/slave/m-cen-l64-asan-d-0000000000000/build/toolkit/xre/nsAppRunner.cpp:3976:0
    #15 0x7f031b439fa8 in XREMain::XRE_main(int, char**, nsXREAppData const*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/toolkit/xre/nsAppRunner.cpp:4044:0
    #16 0x7f031b43a925 in XRE_main /builds/slave/m-cen-l64-asan-d-0000000000000/build/toolkit/xre/nsAppRunner.cpp:4246:0
    #17 0x45a0f5 in do_main(int, char**, nsIFile*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/browser/app/nsBrowserApp.cpp:275:0
    #18 0x459667 in main /builds/slave/m-cen-l64-asan-d-0000000000000/build/browser/app/nsBrowserApp.cpp:635:0
    #19 0x7f032bb8676c in __libc_start_main /build/buildd/eglibc-2.15/csu/libc-start.c:226:0
    #20 0x45937c in _start ??:0
0x6170001e8f1c is located 28 bytes inside of 760-byte region [0x6170001e8f00,0x6170001e91f8)
freed by thread T0 here:
    #0 0x446285 in __interceptor_free _asan_rtl_:0
    #1 0x7f031be5fc05 in operator delete(void*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/obj-firefox/layout/base/../../dist/include/mozilla/mozalloc.h:225:0
    #2 0x7f031be5fc05 in mozilla::RestyleManager::Release() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/RestyleManager.h:38:0
    #3 0x7f031be5682d in nsRefPtr<mozilla::RestyleManager>::operator=(mozilla::RestyleManager*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/obj-firefox/layout/base/../../dist/include/nsAutoPtr.h:943:0
    #4 0x7f031be526aa in nsPresContext::SetShell(nsIPresShell*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsPresContext.cpp:1109:0
    #5 0x7f031be66efd in PresShell::Destroy() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsPresShell.cpp:1058:0
    #6 0x7f031be0cc56 in nsDocumentViewer::DestroyPresShell() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsDocumentViewer.cpp:4334:0
    #7 0x7f031be0f3ba in nsDocumentViewer::Hide() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsDocumentViewer.cpp:2023:0
    #8 0x7f031eefbc78 in nsDocShell::SetVisibility(bool) /builds/slave/m-cen-l64-asan-d-0000000000000/build/docshell/base/nsDocShell.cpp:5523:0
    #9 0x7f031eefbcd3 in non-virtual thunk to nsDocShell::SetVisibility(bool) /builds/slave/m-cen-l64-asan-d-0000000000000/build/docshell/base/nsDocShell.cpp:5527:0
    #10 0x7f031c489097 in nsFrameLoader::Hide() /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/base/src/nsFrameLoader.cpp:997:0
    #11 0x7f031c031d78 in nsHideViewer::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/generic/nsSubDocumentFrame.cpp:780:0
    #12 0x7f031c3c4b6d in nsContentUtils::RemoveScriptBlocker() /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/base/src/nsContentUtils.cpp:4786:0
    #13 0x7f031c406f1d in nsDocument::EndUpdate(unsigned int) /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/base/src/nsDocument.cpp:4471:0
    #14 0x7f031c80cdc6 in nsHTMLDocument::EndUpdate(unsigned int) /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/html/document/src/nsHTMLDocument.cpp:2427:0
    #15 0x7f031bf9ed7f in mozAutoDocUpdate::~mozAutoDocUpdate() /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/base/src/mozAutoDocUpdate.h:38:0
    #16 0x7f031c4c36e7 in nsINode::doRemoveChildAt(unsigned int, bool, nsIContent*, nsAttrAndChildArray&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/base/src/nsINode.cpp:1522:0
    #17 0x7f031c3626f7 in mozilla::dom::FragmentOrElement::RemoveChildAt(unsigned int, bool) /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/base/src/FragmentOrElement.cpp:963:0
    #18 0x7f031c4bdc1b in nsINode::RemoveChild(nsINode&, mozilla::ErrorResult&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/base/src/nsINode.cpp:458:0
    #19 0x7f031e5b17b2 in mozilla::dom::NodeBinding::removeChild(JSContext*, JS::Handle<JSObject*>, nsINode*, JSJitMethodCallArgs const&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/obj-firefox/dom/bindings/./NodeBinding.cpp:628:0
    #20 0x7f031e5af0ed in mozilla::dom::NodeBinding::genericMethod(JSContext*, unsigned int, JS::Value*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/obj-firefox/dom/bindings/./NodeBinding.cpp:1231:0
    #21 0x7f0320495683 in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/jscntxtinlines.h:220:0
    #22 0x7f0320494d95 in js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/vm/Interpreter.cpp:455:16
    #23 0x7f03204889cd in Interpret(JSContext*, js::RunState&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/vm/Interpreter.cpp:2499:0
    #24 0x7f032047766b in js::RunScript(JSContext*, js::RunState&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/vm/Interpreter.cpp:419:0
    #25 0x7f0320494ee7 in js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/vm/Interpreter.cpp:481:0
    #26 0x7f0320495a4c in js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/vm/Interpreter.cpp:512:0
    #27 0x7f0320324228 in js::DirectProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/jsproxy.cpp:454:0
    #28 0x7f03203ed791 in js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/jswrapper.cpp:454:0
    #29 0x7f0320337801 in js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/jsproxy.cpp:2643:0
    #30 0x7f032033b7f0 in proxy_Call(JSContext*, unsigned int, JS::Value*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/js/src/jsproxy.cpp:3037:0
previously allocated by thread T0 here:
    #0 0x4463c5 in malloc _asan_rtl_:0
    #1 0x7f03258ee7d7 in moz_xmalloc /builds/slave/m-cen-l64-asan-d-0000000000000/build/memory/mozalloc/mozalloc.cpp:54:0
    #2 0x7f031be56062 in operator new(unsigned long) /builds/slave/m-cen-l64-asan-d-0000000000000/build/obj-firefox/layout/base/../../dist/include/mozilla/mozalloc.h:201:0
    #3 0x7f031be56062 in nsPresContext::Init(nsDeviceContext*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsPresContext.cpp:931:0
    #4 0x7f031be0ead3 in nsDocumentViewer::Show() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsDocumentViewer.cpp:1946:0
    #5 0x7f031eefbc78 in nsDocShell::SetVisibility(bool) /builds/slave/m-cen-l64-asan-d-0000000000000/build/docshell/base/nsDocShell.cpp:5523:0
    #6 0x7f031eefbcd3 in non-virtual thunk to nsDocShell::SetVisibility(bool) /builds/slave/m-cen-l64-asan-d-0000000000000/build/docshell/base/nsDocShell.cpp:5527:0
    #7 0x7f031c48855d in nsFrameLoader::Show(int, int, int, int, nsSubDocumentFrame*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/base/src/nsFrameLoader.cpp:846:0
    #8 0x7f031c02c295 in nsSubDocumentFrame::ShowViewer() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/generic/nsSubDocumentFrame.cpp:188:27
    #9 0x7f031c031e98 in AsyncFrameInit::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/generic/nsSubDocumentFrame.cpp:82:0
    #10 0x7f031c3c4b6d in nsContentUtils::RemoveScriptBlocker() /builds/slave/m-cen-l64-asan-d-0000000000000/build/content/base/src/nsContentUtils.cpp:4786:0
    #11 0x7f031bd8eb0d in nsAutoScriptBlocker::~nsAutoScriptBlocker() /builds/slave/m-cen-l64-asan-d-0000000000000/build/obj-firefox/toolkit/components/places/../../../dist/include/nsContentUtils.h:2200:0
    #12 0x7f031be775cd in PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsPresShell.cpp:3831:0
    #13 0x7f031bea152a in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsRefreshDriver.cpp:1139:0
    #14 0x7f031bea6d5d in mozilla::RefreshDriverTimer::Tick() /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsRefreshDriver.cpp:160:0
    #15 0x7f031eb1ccb6 in nsTimerImpl::Fire() /builds/slave/m-cen-l64-asan-d-0000000000000/build/xpcom/threads/nsTimerImpl.cpp:546:0
    #16 0x7f031eb1d45e in nsTimerEvent::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/xpcom/threads/nsTimerImpl.cpp:630:0
    #17 0x7f031eb141ce in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/xpcom/threads/nsThread.cpp:622:0
    #18 0x7f031ea6501f in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-cen-l64-asan-d-0000000000000/build/xpcom/glue/nsThreadUtils.cpp:251:0
    #19 0x7f031dc72e77 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/ipc/glue/MessagePump.cpp:85:0
    #20 0x7f031ebff270 in MessageLoop::RunInternal() /builds/slave/m-cen-l64-asan-d-0000000000000/build/ipc/chromium/src/base/message_loop.cc:220:0
    #21 0x7f031ebff074 in MessageLoop::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/ipc/chromium/src/base/message_loop.cc:187:0
    #22 0x7f031da8dfd0 in nsBaseAppShell::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/widget/xpwidgets/nsBaseAppShell.cpp:161:0
    #23 0x7f031d5f7ad5 in nsAppStartup::Run() /builds/slave/m-cen-l64-asan-d-0000000000000/build/toolkit/components/startup/nsAppStartup.cpp:268:0
    #24 0x7f031b438c3b in XREMain::XRE_mainRun() /builds/slave/m-cen-l64-asan-d-0000000000000/build/toolkit/xre/nsAppRunner.cpp:3976:0
    #25 0x7f031b439fa8 in XREMain::XRE_main(int, char**, nsXREAppData const*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/toolkit/xre/nsAppRunner.cpp:4044:0
    #26 0x7f031b43a925 in XRE_main /builds/slave/m-cen-l64-asan-d-0000000000000/build/toolkit/xre/nsAppRunner.cpp:4246:0
    #27 0x45a0f5 in do_main(int, char**, nsIFile*) /builds/slave/m-cen-l64-asan-d-0000000000000/build/browser/app/nsBrowserApp.cpp:275:0
    #28 0x459667 in main /builds/slave/m-cen-l64-asan-d-0000000000000/build/browser/app/nsBrowserApp.cpp:635:0
    #29 0x7f032bb8676c in __libc_start_main /build/buildd/eglibc-2.15/csu/libc-start.c:226:0
Shadow bytes around the buggy address:
  0x0c2e80035190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e800351a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e800351b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e800351c0: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa fa
  0x0c2e800351d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2e800351e0: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e800351f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e80035200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e80035210: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e80035220: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e80035230: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==15391==ABORTING


In addition to ASAN-output the debug-build also throws few assertions but I'm not sure if those are directly related.

###!!! ASSERTION: non-root reflow roots must not have scrollable overflow: 'target == rootFrame || desiredSize.ScrollableOverflow().IsEqualEdges(boundsRelativeToTarget)', file /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/base/nsPresShell.cpp, line 7937

###!!! ASSERTION: Shouldn't have unconstrained stuff here thanks to ComputeAutoSize: 'NS_INTRINSICSIZE != aReflowState.ComputedHeight()', file /builds/slave/m-cen-l64-asan-d-0000000000000/build/layout/generic/nsLeafFrame.cpp, line 75

Comment 1

[Atte Kettunen]

Attachment: run.html

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

hmm, is this a dup of bug 930381

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

haven't managed to reproduce this though.

Comment 4

[Atte Kettunen]

For me it reproduced pretty easily, just by opening the run.html into Firefox and moving mouse cursor from outside of the iframe into the area of the iframe.

Comment 5

[Mats Palmgren (inactive)]

I can reproduce the heap-use-after-free in GetHoverGeneration easily.
The fix in bug 930381 seems to fix that.  (I now get a crash during GC
instead which I suspect is an unrelated problem.)

Comment 6

[Mats Palmgren (inactive)]

Actually, I can still reproduce this crash with the patch in bug 930381 applied.
So I think that patch is insufficient and I've attached an additional patch there.

Comment 7

[Al Billings [:abillings - ex-MoCo]]

Is this effectively a dupe of 930381 (leaving aside whether we give Atte a bounty)?

Comment 8

[Mats Palmgren (inactive)]

Yeah, it's the same underlying issue.  That said, it might deserve a bounty since
it demonstrated that the fix in 930381 was incomplete, saving us from shipping
a use-after-free issue.  I feel like it should at least be shared with 930381
since they independently discovered the same issue.  Just my 2 cents :-)

Comment 9

[Al Billings [:abillings - ex-MoCo]]

(In reply to Mats Palmgren (:mats) from comment #6)
> Actually, I can still reproduce this crash with the patch in bug 930381
> applied.
> So I think that patch is insufficient and I've attached an additional patch
> there.

There is no additional patch. Did you forget to attach it?

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Sorry, you put the patch in the other bug.

Comment 11

[Daniel Veditz [:dveditz]]

Mats: Presumably this is fixed in all the branches bug 930381 is?

Comment 12

[Mats Palmgren (inactive)]

Yes, both patches landed together (in same cset) on all the relevant branches.

Comment 14

[Matt Wobensmith [:mwobensmith][:matt:]]

Confirmed crash on FF27, 2013-10-23.
Verified fixed on FF26/27/28, 2013-12-03.

Asserts are still there. I assume we're not concerned with those.