Bugzilla

Comment 2

•

6 years ago

Although a UAF, calling it sec-moderate for now because we don't think web content could directly manipulate widgets like this. If that's incorrect then this should be sec-high.

Group: core-security → gfx-core-security

status-firefox62: --- → affected

Keywords: csectype-uaf, sec-moderate

Mark Banner (:standard8)

Comment 3

•

6 years ago

Bug 1467671 could also be related - also in mozilla::widget::WinCompositorWidget (though CreateTransparentSurface rather than ClearTransparentWindow).

David Bolter [:davidb] (NeedInfo me for attention)

Updated

•

6 years ago

Comment 4

•

6 years ago

Note that this is happening on Windows ASAN, which is relatively new to CI and was recently promoted to Tier 1. It would be nice if we could find someone to help investigate this (and bug 1469486).

(Away)

Comment 5

•

6 years ago

Looks like the UAF is on a cairo surface... dbolter, who owns this code nowadays?

Flags: needinfo?(dbolter)

Comment 6

•

6 years ago

Bas any thoughts on who could look at this?

Flags: needinfo?(dbolter) → needinfo?(bas)

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 7

•

6 years ago

Similar https://treeherder.mozilla.org/logviewer.html#?job_id=183810605&repo=autoland

15:40:20     INFO -  635 INFO TEST-START | browser/components/extensions/test/browser/test-oop-extensions/browser_ext_tabs_hide.js
15:40:21     INFO -  GECKO(5660) | Waiting for browser load
15:40:21     INFO -  GECKO(5660) | Saw state f0001 and status 0
15:40:21     INFO -  GECKO(5660) | Saw state c0010 and status 0
15:40:21     INFO -  GECKO(5660) | Browser loaded http://example.com/?one
15:40:21     INFO -  GECKO(5660) | Waiting for browser load
15:40:21     INFO -  GECKO(5660) | Saw state f0001 and status 0
15:40:21     INFO -  GECKO(5660) | Saw state c0010 and status 0
15:40:21     INFO -  GECKO(5660) | Browser loaded http://example.com/?two
15:40:21     INFO -  GECKO(5660) | =================================================================
15:40:21    ERROR -  GECKO(5660) | ==5660==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x123054b00090 at pc 0x7fff6188cfe6 bp 0x00c00c7fd560 sp 0x00c00c7fd5a8
15:40:21     INFO -  GECKO(5660) | WRITE of size 8 at 0x123054b00090 thread T47
15:40:22     INFO -  GECKO(5660) |     #0 0x7fff6188cfe5 in _cairo_gstate_init z:\build\build\src\gfx\cairo\cairo\src\cairo-gstate.c:121
15:40:22     INFO -  GECKO(5660) |     #1 0x7fff6193ee2c in _moz_cairo_create z:\build\build\src\gfx\cairo\cairo\src\cairo.c:399
15:40:22     INFO -  GECKO(5660) |     #2 0x7fff58af4e8e in mozilla::gfx::DrawTargetCairo::InitAlreadyReferenced(struct _cairo_surface *,struct mozilla::gfx::IntSizeTyped<struct mozilla::gfx::UnknownUnits> const &,enum mozilla::gfx::SurfaceFormat *) z:\build\build\src\gfx\2d\DrawTargetCairo.cpp:1919
15:40:22     INFO -  GECKO(5660) |     #3 0x7fff58a1f735 in mozilla::gfx::Factory::CreateDrawTargetForCairoSurface(struct _cairo_surface *,struct mozilla::gfx::IntSizeTyped<struct mozilla::gfx::UnknownUnits> const &,enum mozilla::gfx::SurfaceFormat *) z:\build\build\src\gfx\2d\Factory.cpp:1034
15:40:22     INFO -  GECKO(5660) |     #4 0x7fff5f53ec4c in mozilla::widget::WinCompositorWidget::StartRemoteDrawing(void) z:\build\build\src\widget\windows\WinCompositorWidget.cpp:114
15:40:22     INFO -  GECKO(5660) |     #5 0x7fff5f48fb05 in mozilla::widget::CompositorWidget::StartRemoteDrawingInRegion(class mozilla::gfx::IntRegionTyped<struct mozilla::LayoutDevicePixel> &,enum mozilla::layers::BufferMode *) z:\build\build\src\widget\CompositorWidget.h:159
15:40:22     INFO -  GECKO(5660) |     #6 0x7fff59254845 in mozilla::layers::BasicCompositor::BeginFrame(class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> *) z:\build\build\src\gfx\layers\basic\BasicCompositor.cpp:928
15:40:22     INFO -  GECKO(5660) |     #7 0x7fff593a7511 in mozilla::layers::LayerManagerComposite::Render(class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &,class mozilla::gfx::IntRegionTyped<struct mozilla::gfx::UnknownUnits> const &) z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:918
15:40:22     INFO -  GECKO(5660) |     #8 0x7fff593a5001 in mozilla::layers::LayerManagerComposite::UpdateAndRender(void) z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:534
15:40:22     INFO -  GECKO(5660) |     #9 0x7fff593a373c in mozilla::layers::LayerManagerComposite::EndTransaction(class mozilla::TimeStamp const &,enum mozilla::layers::LayerManager::EndTransactionFlags) z:\build\build\src\gfx\layers\composite\LayerManagerComposite.cpp:464
15:40:22     INFO -  GECKO(5660) |     #10 0x7fff5945383f in mozilla::layers::CompositorBridgeParent::CompositeToTarget(class mozilla::gfx::DrawTarget *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const *) z:\build\build\src\gfx\layers\ipc\CompositorBridgeParent.cpp:1068
15:40:22     INFO -  GECKO(5660) |     #11 0x7fff5946f569 in mozilla::layers::CompositorVsyncScheduler::Composite(class mozilla::TimeStamp) z:\build\build\src\gfx\layers\ipc\CompositorVsyncScheduler.cpp:243
15:40:22     INFO -  GECKO(5660) |     #12 0x7fff5949cae1 in mozilla::detail::RunnableMethodImpl<class mozilla::layers::CompositorVsyncScheduler *,void ( mozilla::layers::CompositorVsyncScheduler::*)(class mozilla::TimeStamp),1,1,class mozilla::TimeStamp>::Run(void) z:\build\build\src\obj-firefox\dist\include\nsThreadUtils.h:1216
15:40:22     INFO -  GECKO(5660) |     #13 0x7fff576098b3 in ?DeferOrRunPendingTask@MessageLoop@@IEAA_N$$QEAUPendingTask@1@@Z z:\build\build\src\ipc\chromium\src\base\message_loop.cc:459
15:40:22     INFO -  GECKO(5660) |     #14 0x7fff5760b09e in MessageLoop::DoWork(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:534
15:40:22     INFO -  GECKO(5660) |     #15 0x7fff575db682 in base::MessagePumpForUI::DoRunLoop(void) z:\build\build\src\ipc\chromium\src\base\message_pump_win.cc:210
15:40:22     INFO -  GECKO(5660) |     #16 0x7fff575ddad9 in base::MessagePumpWin::Run(class base::MessagePump::Delegate *) z:\build\build\src\ipc\chromium\src\base\message_pump_win.h:80
15:40:22     INFO -  GECKO(5660) |     #17 0x7fff5760865e in MessageLoop::RunHandler(void) z:\build\build\src\ipc\chromium\src\base\message_loop.cc:318
15:40:22     INFO -  GECKO(5660) |     #18 0x7fff57618e55 in base::Thread::ThreadMain(void) z:\build\build\src\ipc\chromium\src\base\thread.cc:181
15:40:22     INFO -  GECKO(5660) |     #19 0x7fff575df4ef in `anonymous namespace'::ThreadFunc z:\build\build\src\ipc\chromium\src\base\platform_thread_win.cc:28
15:40:22     INFO -  GECKO(5660) |     #20 0x7fff6afed0b8  (Z:\task_1529421273\build\application\firefox\clang_rt.asan_dynamic-x86_64.dll+0x18003d0b8)
15:40:22     INFO -  GECKO(5660) |     #21 0x7fff8a5c2773  (C:\Windows\System32\KERNEL32.DLL+0x180012773)
15:40:22     INFO -  GECKO(5660) |     #22 0x7fff7b535441 in patched_BaseThreadInitThunk z:\build\build\src\mozglue\build\WindowsDllBlocklist.cpp:622
15:40:22     INFO -  GECKO(5660) |     #23 0x7fff8ceb0d60  (C:\Windows\SYSTEM32\ntdll.dll+0x180070d60)
15:40:22     INFO -  GECKO(5660) | Address 0x123054b00090 is a wild pointer.
15:40:22     INFO -  GECKO(5660) | SUMMARY: AddressSanitizer: heap-buffer-overflow z:\build\build\src\gfx\cairo\cairo\src\cairo-gstate.c:121 in _cairo_gstate_init
15:40:22     INFO -  GECKO(5660) | Shadow bytes around the buggy address:
15:40:22     INFO -  GECKO(5660) |   0x04405efdffc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) |   0x04405efdffd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) |   0x04405efdffe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) |   0x04405efdfff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) |   0x04405efe0000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) | =>0x04405efe0010: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) |   0x04405efe0020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) |   0x04405efe0030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) |   0x04405efe0040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) |   0x04405efe0050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) |   0x04405efe0060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
15:40:22     INFO -  GECKO(5660) | Shadow byte legend (one shadow byte represents 8 application bytes):
15:40:22     INFO -  GECKO(5660) |   Addressable:           00
15:40:22     INFO -  GECKO(5660) |   Partially addressable: 01 02 03 04 05 06 07
15:40:22     INFO -  GECKO(5660) |   Heap left redzone:       fa
15:40:22     INFO -  GECKO(5660) |   Freed heap region:       fd
15:40:22     INFO -  GECKO(5660) |   Stack left redzone:      f1
15:40:22     INFO -  GECKO(5660) |   Stack mid redzone:       f2
15:40:22     INFO -  GECKO(5660) |   Stack right redzone:     f3
15:40:22     INFO -  GECKO(5660) |   Stack after return:      f5
15:40:22     INFO -  GECKO(5660) |   Stack use after scope:   f8
15:40:22     INFO -  GECKO(5660) |   Global redzone:          f9
15:40:22     INFO -  GECKO(5660) |   Global init order:       f6
15:40:22     INFO -  GECKO(5660) |   Poisoned by user:        f7
15:40:22     INFO -  GECKO(5660) |   Container overflow:      fc
15:40:22     INFO -  GECKO(5660) |   Array cookie:            ac
15:40:22     INFO -  GECKO(5660) |   Intra object redzone:    bb
15:40:22     INFO -  GECKO(5660) |   ASan internal:           fe
15:40:22     INFO -  GECKO(5660) |   Left alloca redzone:     ca
15:40:22     INFO -  GECKO(5660) |   Right alloca redzone:    cb
15:40:22     INFO -  GECKO(5660) |   Shadow gap:              cc
15:40:22     INFO -  GECKO(5660) | Thread T47 created by T0 here:
15:40:22     INFO -  GECKO(5660) |     #0 0x7fff6afee200  (Z:\task_1529421273\build\application\firefox\clang_rt.asan_dynamic-x86_64.dll+0x18003e200)
15:40:22     INFO -  GECKO(5660) |     #1 0x7fff575df48f in PlatformThread::Create(unsigned __int64,class PlatformThread::Delegate *,void * *) z:\build\build\src\ipc\chromium\src\base\platform_thread_win.cc:86
15:40:22     INFO -  GECKO(5660) |     #2 0x7fff5761870c in base::Thread::StartWithOptions(struct base::Thread::Options const &) z:\build\build\src\ipc\chromium\src\base\thread.cc:99
15:40:22     INFO -  GECKO(5660) |     #3 0x7fff5946dd8c in mozilla::layers::CompositorThreadHolder::CompositorThreadHolder(void) z:\build\build\src\gfx\layers\ipc\CompositorThread.cpp:53
15:40:22     INFO -  GECKO(5660) |     #4 0x7fff5946e0c0 in mozilla::layers::CompositorThreadHolder::Start(void) z:\build\build\src\gfx\layers\ipc\CompositorThread.cpp:124
15:40:22     INFO -  GECKO(5660) |     #5 0x7fff5954ed2b in gfxPlatform::Init(void) z:\build\build\src\gfx\thebes\gfxPlatform.cpp:777
15:40:22     INFO -  GECKO(5660) |     #6 0x7fff5954bcd3 in gfxPlatform::GetPlatform(void) z:\build\build\src\gfx\thebes\gfxPlatform.cpp:534
15:40:22     INFO -  GECKO(5660) |     #7 0x7fff5fc1c49f in nsRefreshDriver::ChooseTimer(void)const  z:\build\build\src\layout\base\nsRefreshDriver.cpp:1110
15:40:22     INFO -  GECKO(5660) |     #8 0x7fff5fc1ff5b in nsRefreshDriver::EnsureTimerStarted(enum nsRefreshDriver::EnsureTimerStartedFlags) z:\build\build\src\layout\base\nsRefreshDriver.cpp:1360
15:40:22     INFO -  GECKO(5660) |     #9 0x7fff5fc896a6 in nsRefreshDriver::AddStyleFlushObserver(class nsIPresShell *) z:\build\build\src\layout\base\nsRefreshDriver.h:188
15:40:22     INFO -  GECKO(5660) |     #10 0x7fff5fe601e4 in nsPresContext::CompatibilityModeChanged(void) z:\build\build\src\layout\base\nsPresContext.cpp:1182
15:40:22     INFO -  GECKO(5660) |     #11 0x7fff5fc833ad in mozilla::PresShell::Init(class nsIDocument *,class nsPresContext *,class nsViewManager *,class mozilla::UniquePtr<class mozilla::ServoStyleSet,class mozilla::DefaultDelete<class mozilla::ServoStyleSet> >) z:\build\build\src\layout\base\PresShell.cpp:951
15:40:22     INFO -  GECKO(5660) |     #12 0x7fff59f67201 in nsIDocument::CreateShell(class nsPresContext *,class nsViewManager *,class mozilla::UniquePtr<class mozilla::ServoStyleSet,class mozilla::DefaultDelete<class mozilla::ServoStyleSet> >) z:\build\build\src\dom\base\nsDocument.cpp:3782
15:40:22     INFO -  GECKO(5660) |     #13 0x7fff5fda60bf in nsDocumentViewer::InitPresentationStuff(bool) z:\build\build\src\layout\base\nsDocumentViewer.cpp:794
15:40:22     INFO -  GECKO(5660) |     #14 0x7fff5fda53eb in nsDocumentViewer::InitInternal(class nsIWidget *,class nsISupports *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &,bool,bool,bool) z:\build\build\src\layout\base\nsDocumentViewer.cpp:1044
15:40:22     INFO -  GECKO(5660) |     #15 0x7fff5fda4570 in nsDocumentViewer::Init(class nsIWidget *,struct mozilla::gfx::IntRectTyped<struct mozilla::gfx::UnknownUnits> const &) z:\build\build\src\layout\base\nsDocumentViewer.cpp:769
15:40:22     INFO -  GECKO(5660) |     #16 0x7fff62eb3467 in nsDocShell::SetupNewViewer(class nsIContentViewer *) z:\build\build\src\docshell\base\nsDocShell.cpp:8972
15:40:22     INFO -  GECKO(5660) |     #17 0x7fff62eb1e62 in nsDocShell::Embed(class nsIContentViewer *,char const *,class nsISupports *) z:\build\build\src\docshell\base\nsDocShell.cpp:6782
15:40:22     INFO -  GECKO(5660) |     #18 0x7fff62ec31aa in nsDocShell::CreateAboutBlankContentViewer(class nsIPrincipal *,class nsIURI *,bool,bool) z:\build\build\src\docshell\base\nsDocShell.cpp:7661
15:40:22     INFO -  GECKO(5660) |     #19 0x7fff62ec487a in nsDocShell::CreateAboutBlankContentViewer(class nsIPrincipal *) z:\build\build\src\docshell\base\nsDocShell.cpp:7686
15:40:22     INFO -  GECKO(5660) |     #20 0x7fff62f53310 in nsWebShellWindow::Initialize(class nsIXULWindow *,class nsIXULWindow *,class nsIURI *,int,int,bool,class nsITabParent *,class mozIDOMWindowProxy *,struct nsWidgetInitData &) z:\build\build\src\xpfe\appshell\nsWebShellWindow.cpp:233
15:40:22     INFO -  GECKO(5660) |     #21 0x7fff62f4d1f8 in nsAppShellService::JustCreateTopWindow(class nsIXULWindow *,class nsIURI *,unsigned int,int,int,bool,class nsITabParent *,class mozIDOMWindowProxy *,class nsWebShellWindow * *) z:\build\build\src\xpfe\appshell\nsAppShellService.cpp:736
15:40:22     INFO -  GECKO(5660) |     #22 0x7fff62f4f38c in nsAppShellService::CreateTopLevelWindow(class nsIXULWindow *,class nsIURI *,unsigned int,int,int,class nsITabParent *,class mozIDOMWindowProxy *,class nsIXULWindow * *) z:\build\build\src\xpfe\appshell\nsAppShellService.cpp:200
15:40:22     INFO -  GECKO(5660) |     #23 0x7fff638288cf in nsAppStartup::CreateChromeWindow2(class nsIWebBrowserChrome *,unsigned int,class nsITabParent *,class mozIDOMWindowProxy *,unsigned __int64,bool *,class nsIWebBrowserChrome * *) z:\build\build\src\toolkit\components\startup\nsAppStartup.cpp:680
15:40:22     INFO -  GECKO(5660) |     #24 0x7fff63a14934 in nsWindowWatcher::CreateChromeWindow(class nsTSubstring<char> const &,class nsIWebBrowserChrome *,unsigned int,class nsITabParent *,class mozIDOMWindowProxy *,unsigned __int64,class nsIWebBrowserChrome * *) z:\build\build\src\toolkit\components\windowwatcher\nsWindowWatcher.cpp:467
15:40:22     INFO -  GECKO(5660) |     #25 0x7fff63a0f6c8 in nsWindowWatcher::OpenWindowInternal(class mozIDOMWindowProxy *,char const *,char const *,char const *,bool,bool,bool,class nsIArray *,bool,bool,class nsIDocShellLoadInfo *,class mozIDOMWindowProxy * *) z:\build\build\src\toolkit\components\windowwatcher\nsWindowWatcher.cpp:938
15:40:22     INFO -  GECKO(5660) |     #26 0x7fff63a0ade4 in nsWindowWatcher::OpenWindow(class mozIDOMWindowProxy *,char const *,char const *,char const *,class nsISupports *,class mozIDOMWindowProxy * *) z:\build\build\src\toolkit\components\windowwatcher\nsWindowWatcher.cpp:327
15:40:22     INFO -  GECKO(5660) |     #27 0x7fff6628e431 in XPTC__InvokebyIndex (Z:\task_1529421273\build\application\firefox\xul.dll+0x18fe8e431)
15:40:22     INFO -  GECKO(5660) |     #28 0x7fff58230382 in XPCWrappedNative::CallMethod(class XPCCallContext &,enum XPCWrappedNative::CallMode) z:\build\build\src\js\xpconnect\src\XPCWrappedNative.cpp:1186
15:40:22     INFO -  GECKO(5660) |     #29 0x7fff58237649 in XPC_WN_CallMethod(struct JSContext *,unsigned int,union JS::Value *) z:\build\build\src\js\xpconnect\src\XPCWrappedNativeJSOps.cpp:899
15:40:22     INFO -  GECKO(5660) |     #30 0x7fff65633332 in js::InternalCallOrConstruct(struct JSContext *,class JS::CallArgs const &,enum js::MaybeConstruct) z:\build\build\src\js\src\vm\Interpreter.cpp:471
15:40:22     INFO -  GECKO(5660) |     #31 0x7fff65634a15 in InternalCall z:\build\build\src\js\src\vm\Interpreter.cpp:520
15:40:22     INFO -  GECKO(5660) |     #32 0x7fff65617fe7 in Interpret z:\build\build\src\js\src\vm\Interpreter.cpp:3122
15:40:22     INFO -  GECKO(5660) |     #33 0x7fff655fc1d0 in js::RunScript(struct JSContext *,class js::RunState &) z:\build\build\src\js\src\vm\Interpreter.cpp:421
15:40:22     INFO -  GECKO(5660) |     #34 0x7fff65633934 in js::InternalCallOrConstruct(struct JSContext *,class JS::CallArgs const &,enum js::MaybeConstruct) z:\build\build\src\js\src\vm\Interpreter.cpp:493
15:40:22     INFO -  GECKO(5660) |     #35 0x7fff65634a15 in InternalCall z:\build\build\src\js\src\vm\Interpreter.cpp:520
15:40:22     INFO -  GECKO(5660) |     #36 0x7fff65634c46 in js::Call(struct JSContext *,class JS::Handle<union JS::Value>,class JS::Handle<union JS::Value>,class js::AnyInvokeArgs const &,class JS::MutableHandle<union JS::Value>) z:\build\build\src\js\src\vm\Interpreter.cpp:539
15:40:22     INFO -  GECKO(5660) |     #37 0x7fff63cd1ccb in JS_CallFunctionValue(struct JSContext *,class JS::Handle<class JSObject *>,class JS::Handle<union JS::Value>,class JS::HandleValueArray const &,class JS::MutableHandle<union JS::Value>) z:\build\build\src\js\src\jsapi.cpp:2851
15:40:22     INFO -  GECKO(5660) |     #38 0x7fff582159af in nsXPCWrappedJSClass::CallMethod(class nsXPCWrappedJS *,unsigned short,struct nsXPTMethodInfo const *,struct nsXPTCMiniVariant *) z:\build\build\src\js\xpconnect\src\XPCWrappedJSClass.cpp:1123
15:40:22     INFO -  GECKO(5660) |     #39 0x7fff58213643 in nsXPCWrappedJS::CallMethod(unsigned short,struct nsXPTMethodInfo const *,struct nsXPTCMiniVariant *) z:\build\build\src\js\xpconnect\src\XPCWrappedJS.cpp:611
15:40:22     INFO -  GECKO(5660) |     #40 0x7fff566e2e62 in PrepareAndDispatch z:\build\build\src\xpcom\reflect\xptcall\md\win32\xptcstubs_x86_64.cpp:173
15:40:22     INFO -  GECKO(5660) |     #41 0x7fff6628e488 in SharedStub (Z:\task_1529421273\build\application\firefox\xul.dll+0x18fe8e488)
15:40:22     INFO -  GECKO(5660) |     #42 0x7fff566477b7 in NS_CreateServicesFromCategory(char const *,class nsISupports *,char const *,UNKNOWN const *) z:\build\build\src\xpcom\components\nsCategoryManager.cpp:810
15:40:22     INFO -  GECKO(5660) |     #43 0x7fff63aefe39 in nsXREDirProvider::DoStartup(void) z:\build\build\src\toolkit\xre\nsXREDirProvider.cpp:999
15:40:22     INFO -  GECKO(5660) |     #44 0x7fff63ab8bac in XREMain::XRE_mainRun(void) z:\build\build\src\toolkit\xre\nsAppRunner.cpp:4574
15:40:22     INFO -  GECKO(5660) |     #45 0x7fff63abedb4 in XREMain::XRE_main(int,char * * const,struct mozilla::BootstrapConfig const &) z:\build\build\src\toolkit\xre\nsAppRunner.cpp:4891
15:40:22     INFO -  GECKO(5660) |     #46 0x7fff63ac12c0 in XRE_main(int,char * * const,struct mozilla::BootstrapConfig const &) z:\build\build\src\toolkit\xre\nsAppRunner.cpp:4983
15:40:22     INFO -  GECKO(5660) |     #47 0x7ff6b1681e3d  (Z:\task_1529421273\build\application\firefox\firefox.exe+0x140001e3d)
15:40:22     INFO -  GECKO(5660) |     #48 0x7ff6b1681529  (Z:\task_1529421273\build\application\firefox\firefox.exe+0x140001529)
15:40:22     INFO -  GECKO(5660) |     #49 0x7ff6b177ac87  (Z:\task_1529421273\build\application\firefox\firefox.exe+0x1400fac87)
15:40:22     INFO -  GECKO(5660) |     #50 0x7fff8a5c2773  (C:\Windows\System32\KERNEL32.DLL+0x180012773)
15:40:22     INFO -  GECKO(5660) |     #51 0x7fff8ceb0d60  (C:\Windows\SYSTEM32\ntdll.dll+0x180070d60)
15:40:22     INFO -  GECKO(5660) | ==5660==ABORTING

Assignee

Comment 8

•

6 years ago

Normally this would be Jeff, but I can probably look at this as well.

Flags: needinfo?(bas)

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Assignee

Comment 9

•

6 years ago

This is not actually a cairo issue though, this is a widget bug, there is a race condition here where the compositor thread and the main thread race over mTransparentSurface on the widget. This can probably be address with some type of lock to access of mTransparentSurface. There may be other solutions though. This seems like the most obvious one and I can implement it, or someone from widget may want to weigh in. (I'm not sure if it's a bug in widget here that we allow window clearing while a remote composition is going on)

Note that the failure in comment 7 seems to be completely unrelated.

Flags: needinfo?(dbolter)

Comment 10

•

6 years ago

Filed bug 1469775 for the issue mentioned in comment 7.

Assignee

Comment 11

•

6 years ago

Attached patch Protect access to mTransparentSurface with a lock — Details — Splinter Review

This code was mostly written by David, so it's hard to decide who should review this. Ryan, I'm sort of randomly asking you to sanity check what I did.

Assignee: nobody → bas

Attachment #8986474 - Flags: feedback?

Ryan Hunt [:rhunt] (on leave until early May)

Assignee

Updated

•

6 years ago

Attachment #8986474 - Flags: feedback? → feedback?(rhunt)

Comment 12

•

6 years ago

Comment on attachment 8986474 [details] [diff] [review]
Protect access to mTransparentSurface with a lock

Nice catch.

Attachment #8986474 - Flags: feedback?(rhunt) → feedback+

David Bolter [:davidb] (NeedInfo me for attention)

Comment 13

•

6 years ago

Thanks Bas (removing my NI)

Flags: needinfo?(dbolter)

Ryan Hunt [:rhunt] (on leave until early May)

Updated

•

6 years ago

Attachment #8986474 - Flags: review+

Updated

•

6 years ago

Comment 15

•

6 years ago

BTW, bug 1414865 looks clearly like the same issue. Hooray for ASAN making these easier to spot now!
https://treeherder.mozilla.org/logviewer.html#?job_id=181973760&repo=mozilla-esr60&lineNumber=11361

status-firefox60: --- → wontfix

status-firefox61: --- → wontfix

status-firefox-esr52: --- → wontfix

status-firefox-esr60: --- → affected

tracking-firefox62: --- → +

tracking-firefox-esr60: --- → 62+

Bogdan Tara[:bogdan_tara | bogdant]

Assignee

Comment 16

•

6 years ago

(In reply to Ryan VanderMeulen [:RyanVM] from comment #15)
> BTW, bug 1414865 looks clearly like the same issue. Hooray for ASAN making
> these easier to spot now!
> https://treeherder.mozilla.org/logviewer.html#?job_id=181973760&repo=mozilla-
> esr60&lineNumber=11361

Wish I would have seen that one before! Didn't realize we had a UAF crash there.

Comment 17

•

6 years ago

Backed out changeset 0ef199e4d83d (bug 1467363) for failures on BlockingResourceBase.cpp

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=0ef199e4d83dad031c14f97d9524a30f0b0cf97e

Backout link: https://hg.mozilla.org/integration/mozilla-inbound/rev/6c29e4fc89c79a9a710eaa349f138cc84115ffd8

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=184271517&repo=mozilla-inbound

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 18

•

6 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/98bac674e9bc6346b4d3253771e98846782dbeeb
https://hg.mozilla.org/mozilla-central/rev/98bac674e9bc

Group: gfx-core-security → core-security-release

Status: NEW → RESOLVED

Closed: 6 years ago

status-firefox62: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla62

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Assignee

Comment 19

•

6 years ago

Can we make sure to confirm this fixed the issue?

Comment 20

•

6 years ago

This had hit 3 times in the last 16 days in our CI (_cairo_gstate_init hit twice). Can the fuzzing team help with this verification request?

Flags: needinfo?(choller)

Christian Holler (:decoder)

Assignee

Comment 21

•

6 years ago

(In reply to Sebastian Hengst [:aryx] (needinfo on intermittent or backout) from comment #20)
> This had hit 3 times in the last 16 days in our CI (_cairo_gstate_init hit
> twice). Can the fuzzing team help with this verification request?

We might be able to see if bug 1414865 is fixed.

Comment 22

•

6 years ago

I couldn't find any related fuzzing results in our database.

Flags: needinfo?(choller)

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 23

•

6 years ago

This is not fixed: https://treeherder.mozilla.org/logviewer.html#?job_id=187211349&repo=autoland

Status: RESOLVED → REOPENED

Flags: needinfo?(bas)

Resolution: FIXED → ---

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Assignee

Comment 24

•

6 years ago

(In reply to Sebastian Hengst [:aryx] (needinfo on intermittent or backout) from comment #23)
> This is not fixed:
> https://treeherder.mozilla.org/logviewer.html#?job_id=187211349&repo=autoland

Note this stack is pretty different from the original bug, although almost certainly they'd be closely related.

Flags: needinfo?(bas)

Comment 25

•

6 years ago

That new failure is tracked in bug 1475594.

Status: REOPENED → RESOLVED

Closed: 6 years ago → 6 years ago

Resolution: --- → FIXED

Andrei Vaida [:avaida]

Updated

•

6 years ago

Flags: qe-verify-

Whiteboard: [post-critsmash-triage]

Comment 26

•

6 years ago

Please nominate this for ESR60 approval when you get a chance.

Flags: needinfo?(bas)

Assignee

Comment 27

•

6 years ago

Comment on attachment 8986474 [details] [diff] [review]
Protect access to mTransparentSurface with a lock

Review of attachment 8986474 [details] [diff] [review]:
-----------------------------------------------------------------

Requesting ESR approval as per Ryan's suggestion.

Attachment #8986474 - Flags: approval-mozilla-esr60?

Comment 28

•

6 years ago

Comment on attachment 8986474 [details] [diff] [review]
Protect access to mTransparentSurface with a lock

Approved for ESR 60.2.

Flags: needinfo?(bas)

Attachment #8986474 - Flags: approval-mozilla-esr60? → approval-mozilla-esr60+

Al Billings [:abillings - ex-MoCo]

Comment 29

•

6 years ago

uplift

https://hg.mozilla.org/releases/mozilla-esr60/rev/7477676bef45

status-firefox-esr60: affected → fixed

Updated

•

6 years ago

Whiteboard: [post-critsmash-triage] → [post-critsmash-triage][adv-main62+][adv-esr60.2+]

Updated

•

6 years ago

Blocks: 1414865