First seen by fuzzers with m-c 20200924-6d45a17995e2

==24997==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fffd3c1bf40 at pc 0x7f5410c7ae53 bp 0x7fffd3c1bde0 sp 0x7fffd3c1bdd8
READ of size 8 at 0x7fffd3c1bf40 thread T0 (Web Content)
    #0 0x7f5410c7ae52 in BeginReading src/xpcom/string/nsTStringRepr.h:101:63
    #1 0x7f5410c7ae52 in nsTSubstring<char16_t>::Append(nsTSubstring<char16_t> const&, std::nothrow_t const&) src/xpcom/string/nsTSubstring.cpp:842:22
    #2 0x7f5410c7a868 in nsTSubstring<char16_t>::Append(nsTSubstring<char16_t> const&) src/xpcom/string/nsTSubstring.cpp:829:7
    #3 0x7f5418851f91 in txBufferingHandler::characters(nsTSubstring<char16_t> const&, bool) src/dom/xslt/xslt/txBufferingHandler.cpp:203:27
    #4 0x7f541886bbd9 in txCopy::execute(txExecutionState&) src/dom/xslt/xslt/txInstructions.cpp:293:32
    #5 0x7f54188bb5eb in txXSLTProcessor::execute(txExecutionState&) src/dom/xslt/xslt/txXSLTProcessor.cpp:37:17
    #6 0x7f541888edd6 in txMozillaXSLTProcessor::TransformToDoc(mozilla::dom::Document**, bool) src/dom/xslt/xslt/txMozillaXSLTProcessor.cpp:562:10
    #7 0x7f541888e732 in txMozillaXSLTProcessor::TransformToDocument(nsINode&, mozilla::ErrorResult&) src/dom/xslt/xslt/txMozillaXSLTProcessor.cpp:533:8
    #8 0x7f5415c43b60 in mozilla::dom::XSLTProcessor_Binding::transformToDocument(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/XSLTProcessorBinding.cpp:202:75
    #9 0x7f5416350a88 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3229:13
    #10 0x7f541cd77a24 in CallJSNative src/js/src/vm/Interpreter.cpp:508:13
    #11 0x7f541cd77a24 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:600:12
    #12 0x7f541cd79dfe in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:665:10
    #13 0x7f541cd6089b in CallFromStack src/js/src/vm/Interpreter.cpp:669:10
    #14 0x7f541cd6089b in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3337:16
    #15 0x7f541cd415a0 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:469:13
    #16 0x7f541cd77c2c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:637:13
    #17 0x7f541cd79dfe in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:665:10
    #18 0x7f541cd7a180 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:682:8
    #19 0x7f541cf0ad92 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2821:10
    #20 0x7f5415f4f7a8 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:57:8
    #21 0x7f5416ac0d18 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:66:12
    #22 0x7f5416ac0734 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1082:43
    #23 0x7f5416ac1f81 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1279:17
    #24 0x7f5416aafaee in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:352:17
    #25 0x7f5416aae55a in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:590:14
    #26 0x7f5416ab26fb in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1084:11
    #27 0x7f5416ab7a89 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) src/dom/events/EventDispatcher.cpp
    #28 0x7f541487325f in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:1300:17
    #29 0x7f54142c2dff in nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch) src/dom/base/nsContentUtils.cpp:4071:28
    #30 0x7f54142c2b43 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*) src/dom/base/nsContentUtils.cpp:4041:10
    #31 0x7f541457f05e in mozilla::dom::Document::DispatchContentLoadedEvents() src/dom/base/Document.cpp:7228:3
    #32 0x7f541464fcff in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1188:12
    #33 0x7f541464fcff in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1194:12
    #34 0x7f541464fcff in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1240:13
    #35 0x7f5410e8b41d in mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:146:20
    #36 0x7f5410edfaf9 in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:244:16
    #37 0x7f5410e9e993 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:514:26
    #38 0x7f5410e9c377 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:373:15
    #39 0x7f5410e9c7cd in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:170:36
    #40 0x7f5410eed691 in operator() src/xpcom/threads/TaskController.cpp:84:37
    #41 0x7f5410eed691 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #42 0x7f5410ec1da3 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1234:14
    #43 0x7f5410ecbe9c in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:513:10
    #44 0x7f54121954ff in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:87:21
    #45 0x7f5412099a71 in RunInternal src/ipc/chromium/src/base/message_loop.cc:334:10
    #46 0x7f5412099a71 in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
    #47 0x7f5412099a71 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
    #48 0x7f5418e06357 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
    #49 0x7f541cb117ef in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #50 0x7f5412099a71 in RunInternal src/ipc/chromium/src/base/message_loop.cc:334:10
    #51 0x7f5412099a71 in RunHandler src/ipc/chromium/src/base/message_loop.cc:327:3
    #52 0x7f5412099a71 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:309:3
    #53 0x7f541cb10d8c in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #54 0x563482bba01d in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #55 0x563482bba457 in main src/browser/app/nsBrowserApp.cpp:304:18

A Pernosco session is available here: https://pernos.co/debug/HfiKrBlN1PB7awe2oJPWQQ/index.html

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201001094020-ba35799faec2.
The bug appears to have been introduced in the following build range:

Start: 491b1fb5bac0c269e6f754bbcfa3bea5bd197d79 (20200923151142)
End: d402a579fb2d73dd898cbe44adb1ec17b9de0697 (20200923153121)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=491b1fb5bac0c269e6f754bbcfa3bea5bd197d79&tochange=d402a579fb2d73dd898cbe44adb1ec17b9de0697

sg, could you please take a look? It appears that your string literal work may have introduced a security regression, oddly enough. Thanks.

I see where the problem is that at https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/dom/xslt/xslt/txInstructions.cpp#290 an empty literal (of type nsLiteralString) is seemingly bound to a lifetime-extending reference, but actually this involves a user-defined conversion, and consequently the lifetime of the literal is not extended. This should have been caught by existing static analysis, since this is essentially what is tested at https://searchfox.org/mozilla-central/rev/222e4f64b769413ac1a1991d2397b13a0acb5d9d/build/clang-plugin/tests/TestTemporaryLifetimeBound.cpp#79

I'll provide a fix. There are two other similar places I found with the same problem.

I think I need to defer analysing the static analysis gap, however.

I could, however, change the implementation of nsTLiteralString to ensure that at least for empty literals such uses are not problematic.

Set release status flags based on info from the regressing bug 1650145

sg, is this fixed now that bug 1668757 is fixed?

Yes, it should be fixed through Bug 1668757

Looks like that is the case. This was last found by the fuzzers on Oct 6th with m-c 19bc84a9ed83. I assume this can be closed.

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20201015094006-a6aaf0c8e183.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

(In reply to Release mgmt bot [:sylvestre / :calixte / :marco for bugbug] from comment #10)

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

I responded.