1968051 - Crash [@ exposeToActiveJS]

Status: NEW

(Core :: DOM: Bindings (WebIDL), defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev d614db7d6013 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build d614db7d6013 --asan --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

[@ exposeToActiveJS]

    =================================================================
    ==1332957==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000030 (pc 0x71f534d035f9 bp 0x7fff696ebe90 sp 0x7fff696ebe60 T0)
    ==1332957==The signal is caused by a READ memory access.
    ==1332957==Hint: address points to the zero page.
        #0 0x71f534d035f9 in exposeToActiveJS /builds/worker/workspace/obj-build/dist/include/js/RootingAPI.h:337:69
        #1 0x71f534d035f9 in get /builds/worker/workspace/obj-build/dist/include/js/RootingAPI.h:340:5
        #2 0x71f534d035f9 in operator JSObject *const & /builds/worker/workspace/obj-build/dist/include/js/RootingAPI.h:334:3
        #3 0x71f534d035f9 in PromiseObj /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Promise.h:343:41
        #4 0x71f534d035f9 in mozilla::dom::ToJSValue(JSContext*, mozilla::dom::Promise&, JS::MutableHandle<JS::Value>) /dom/bindings/ToJSValue.cpp:51:31
        #5 0x71f533419ce9 in ToJSValue<mozilla::dom::Promise *> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/ToJSValue.h:351:10
        #6 0x71f533419ce9 in get_ready /builds/worker/workspace/obj-build/dom/bindings/./AnimationBinding.cpp:676:8
        #7 0x71f533419ce9 in mozilla::dom::Animation_Binding::get_ready_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/./AnimationBinding.cpp:685:13
        #8 0x71f534cca138 in bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3184:13
        #9 0x71f53b8b8277 in CallJSNative /js/src/vm/Interpreter.cpp:494:13
        #10 0x71f53b8b8277 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:590:12
        #11 0x71f53b8ba0f1 in InternalCall /js/src/vm/Interpreter.cpp:657:10
        #12 0x71f53b8ba0f1 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:689:8
        #13 0x71f53b8bbe1a in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:811:10
        #14 0x71f53bc2379a in CallGetter(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, js::PropertyInfoBase<unsigned int>, JS::MutableHandle<JS::Value>) /js/src/vm/NativeObject.cpp:2092:12
        #15 0x71f53bbf959d in GetExistingProperty<(js::AllowGC)1> /js/src/vm/NativeObject.cpp:2120:12
        #16 0x71f53bbf959d in NativeGetPropertyInline<(js::AllowGC)1> /js/src/vm/NativeObject.cpp:2273:14
        #17 0x71f53bbf959d in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /js/src/vm/NativeObject.cpp:2303:10
        #18 0x71f53b8efb61 in GetProperty /js/src/vm/ObjectOperations-inl.h:113:10
        #19 0x71f53b8efb61 in GetProperty /js/src/vm/ObjectOperations-inl.h:120:10
        #20 0x71f53b8efb61 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /js/src/vm/Interpreter.cpp:4630:10
        #21 0x71f53b8ce5db in GetPropertyOperation /js/src/vm/Interpreter.cpp:280:10
        #22 0x71f53b8ce5db in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:2941:12
        #23 0x71f53b8b7048 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:395:10
        #24 0x71f53b8b7048 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:464:13
        #25 0x71f53b8b83ed in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:622:13
        #26 0x71f53b8ba0f1 in InternalCall /js/src/vm/Interpreter.cpp:657:10
        #27 0x71f53b8ba0f1 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:689:8
        #28 0x71f53b9e6e4a in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #29 0x71f534823c65 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
        #30 0x71f535b7cd79 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #31 0x71f535b7c44d in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1362:43
        #32 0x71f535b7e4d0 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1674:12
        #33 0x71f535b7d429 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1579:35
        #34 0x71f535b65619 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:466:5
        #35 0x71f535b65619 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:365:17
        #36 0x71f535b63128 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:606:16
        #37 0x71f535b69efd in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1268:11
        #38 0x71f535b717c0 in mozilla::EventDispatcher::DispatchDOMEvent(mozilla::dom::EventTarget*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp
        #39 0x71f533315567 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/base/nsINode.cpp:1540:17
        #40 0x71f532ac914d in nsContentUtils::DispatchEvent(mozilla::dom::Document*, mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch, mozilla::SystemGroupOnly) /dom/base/nsContentUtils.cpp:5301:29
        #41 0x71f532ac8e51 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, mozilla::dom::EventTarget*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*, mozilla::SystemGroupOnly) /dom/base/nsContentUtils.cpp:5266:10
        #42 0x71f532ec060f in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8479:3
        #43 0x71f532fe7d4f in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #44 0x71f532fe7d4f in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #45 0x71f532fe7d4f in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #46 0x71f532fe7d4f in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #47 0x71f532fe7d4f in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #48 0x71f532fe7d4f in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #49 0x71f532fe7d4f in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #50 0x71f52f032e6a in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:703:16
        #51 0x71f52f020d88 in mozilla::TaskController::RunTask(mozilla::Task*) /xpcom/threads/TaskController.cpp:196:19
        #52 0x71f52f027e6d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1252:20
        #53 0x71f52f0259a8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1075:15
        #54 0x71f52f025fc6 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:639:36
        #55 0x71f52f043c21 in operator() /xpcom/threads/TaskController.cpp:333:37
        #56 0x71f52f043c21 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #57 0x71f52f06321b in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1159:16
        #58 0x71f52f06db98 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #59 0x71f5306d685e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #60 0x71f5305bb084 in RunInternal /ipc/chromium/src/base/message_loop.cc:369:10
        #61 0x71f5305bb084 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #62 0x71f5305bb084 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #63 0x71f5396a7a86 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #64 0x71f53987b0bb in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:471:33
        #65 0x71f53b5fafcd in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:652:20
        #66 0x71f5305bb084 in RunInternal /ipc/chromium/src/base/message_loop.cc:369:10
        #67 0x71f5305bb084 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #68 0x71f5305bb084 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #69 0x71f53b5f959e in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:590:34
        #70 0x5f8447561841 in main /browser/app/nsBrowserApp.cpp:397:22
        #71 0x71f5527a41c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #72 0x71f5527a428a in __libc_start_main csu/../csu/libc-start.c:360:3
        #73 0x5f84474815e8 in _start (/home/jkratzer/builds/m-c-20250521212425-fuzzing-asan-opt/firefox+0xc75e8) (BuildId: cc13f3d831eb1443d2ffadc97f9ad7fec4a1c895)
    
    ==1332957==Register values:
    rax = 0x0000000000000000  rbx = 0x000071f5506de448  rcx = 0x0000000000000001  rdx = 0x000071f5506de448  
    rdi = 0x000051e000004880  rsi = 0x0000000000000000  rbp = 0x00007fff696ebe90  rsp = 0x00007fff696ebe60  
     r8 = 0x00005f844805c400   r9 = 0x00000000000001f0  r10 = 0x00000000aa0e0201  r11 = 0x000071f52ba524c0  
    r12 = 0x0000000000000006  r13 = 0x000071f5506de4a0  r14 = 0x000051e000004880  r15 = 0x0000000000000030  
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/js/RootingAPI.h:337:69 in exposeToActiveJS
    ==1332957==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250522213939-68577999ef6b.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 71204917f64a971fbd6cf3b0b35b3193a5446f0e (20240524041402)
End: d614db7d601328ce3f49c040c2879731f8ac8682 (20250521212425)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 3

[Mayank Bansal]

Bisection:
https://hg-edge.mozilla.org/mozilla-central/pushloghtml?fromchange=e3279760cd977aac30bd9e8032d3ee71f55d2a67&tochange=2c773b97167252cedcba0be0c7af9d4cab192ef5
Suspect: bug 1185106

Though before bug 1185106 the testcase just threw an error in the console.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1185106

Comment 5

[Andreas Farre [:farre]]

Edgar, do you have an idea about this?