BugId AVR:Unallocated f62.9c0 @ firefox.exe!xul.dll!nsStyleBorder::~nsStyleBorder summary

BugId:	AVR:Unallocated f62.9c0
Location:	firefox.exe!xul.dll!nsStyleBorder::~nsStyleBorder
Description:	Access violation while reading unallocated memory at 0x14141414.
Version:	firefox.exe: 54.0.0.6308 (x86) xul.dll: 54.0.0.6308 (x86)
Source:	c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsstylestruct.cpp @ 387
Security impact:	Potentially exploitable security issue, if the attacker can control the address or the memory at the address.
Command line:	['C:\\Program Files\\Firefox Developer Edition\\firefox.exe', '--no-remote', '-profile', 'C:\\Users\\FuzzBot\\AppData\\Local\\Temp\\Firefox-profile', 'http://W1032:28876/']

BugId version 2016.12.14.1640. You may not use this version of BugId for commercial purposes. Please contact the author if you wish to use BugId commercially. Contact and licensing information can be found at the bottom of this report.

Stack

xul.dll!nsStyleBorder::~nsStyleBorder + 0x5 (id: f62) [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsstylestruct.cpp @ 387]
xul.dll!nsStyleBorder::Destroy + 0xB (id: 9c0) [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsstylestruct.cpp @ 435]
xul.dll!nsConditionalResetStyleData::Destroy + 0x39E [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\obj-firefox\layout\style\nsstylestructlist.h @ 124]
xul.dll!nsCachedStyleData::Destroy + 0x22 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsrulenode.h @ 335]
xul.dll!nsRuleNode::~nsRuleNode + 0x32 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsrulenode.cpp @ 1735]
xul.dll!nsStyleSet::GCRuleTrees + 0x33 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsstyleset.cpp @ 2289]
xul.dll!mozilla::PresShell::Destroy + 0x37B [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\base\presshell.cpp @ 1416]
xul.dll!nsDocumentViewer::DestroyPresShell + 0x45 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\base\nsdocumentviewer.cpp @ 4581]
xul.dll!nsDocumentViewer::Destroy + 0x56 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\base\nsdocumentviewer.cpp @ 1716]
xul.dll!nsDocumentViewer::Show + 0x42 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\base\nsdocumentviewer.cpp @ 2049]
xul.dll!nsPresContext::EnsureVisible + 0x80 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\base\nsprescontext.cpp @ 2164]
xul.dll!mozilla::PresShell::UnsuppressAndInvalidate + 0x17 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\base\presshell.cpp @ 3909]
xul.dll!nsGlobalWindow::EnsureReflowFlushAndPaint + 0x45 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\dom\base\nsglobalwindow.cpp @ 7172]
xul.dll!nsGlobalWindow::AlertOrConfirm + 0x56 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\dom\base\nsglobalwindow.cpp @ 7322]
xul.dll!nsGlobalWindow::AlertOuter + 0x30 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\dom\base\nsglobalwindow.cpp @ 7389]
xul.dll!nsGlobalWindow::Alert + 0x52 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\dom\base\nsglobalwindow.cpp @ 7397]
xul.dll!mozilla::dom::WindowBinding::alert + 0xC4 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\obj-firefox\dom\bindings\windowbinding.cpp @ 2616]
xul.dll!mozilla::dom::WindowBinding::genericMethod + 0xE8 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\obj-firefox\dom\bindings\windowbinding.cpp @ 15658]
xul.dll!js::CallJSNative + 0x5A [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\js\src\jscntxtinlines.h @ 282]
xul.dll!js::InternalCallOrConstruct + 0xFE [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\js\src\vm\interpreter.cpp @ 448]

There were more stack frames than shown above, but these were not considered relevant.

⇓ click on the title of a section to open or close it.

Registers

eax=07e8f000 ebx=081bf798 ecx=14141414 edx=44af3e00 esi=14141414 edi=07e8f000
eip=5d120b3c esp=004fd1e0 ebp=004fd1f4 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210202
fpcw=027F: rn 53 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=FFFF
fopcode=9B91 fpip=0200:00000000 fpdp=ffff:9b917b80
st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000
st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000
st4= 1.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000
st6= 1.000000000000000000000e+0000 st7= 6.720000000000000000000e+0002
mm0=0000000000000000 mm1=0000000000000000
mm2=0000000000000000 mm3=0000000000000000
mm4=8000000000000000 mm5=8000000000000000
mm6=8000000000000000 mm7=a800000000000000
xmm0=-1.35708e+023 -1.35708e+023 -1.35708e+023 -1.35708e+023
xmm1=0 0 4.15625 0
xmm2=0 1.5064e-042 0 6.02558e-044
xmm3=0 0 4.15625 0
xmm4=0 0 0 0
xmm5=0 0 0 0
xmm6=0 0 0 0
xmm7=0 0 4.15625 0
dr0=00000000 dr1=00000000 dr2=00000000
dr3=00000000 dr6=00000000 dr7=00000000
xul!nsStyleBorder::~nsStyleBorder+0x5:
5d120b3c 833e00 cmp dword ptr [esi],0 ds:0023:14141414=????????

⇓ click on the title of a section to open or close it.

Disassembly of stack frame 1 at xul.dll!nsStyleBorder::~nsStyleBorder + 0x5

5d120b05 755d jne xul!nsStyleBorder::~nsStyleBorder+0x2d (5d120b64)
5d120b07 ab stos dword ptr es:[edi]
5d120b08 5f pop edi
5d120b09 755d jne xul!nsStyleBorder::~nsStyleBorder+0x31 (5d120b68)
5d120b0b 45 inc ebp
5d120b0c 61 popad
5d120b0d 755d jne xul!nsStyleBorder::~nsStyleBorder+0x35 (5d120b6c)
5d120b0f 6e outs dx,byte ptr [esi]
5d120b10 61 popad
5d120b11 755d jne xul!nsStyleBorder::~nsStyleBorder+0x39 (5d120b70)
5d120b13 216175 and dword ptr [ecx+75h],esp
5d120b16 5d pop ebp
5d120b17 7360 jae xul!nsStyleBorder::~nsStyleBorder+0x42 (5d120b79)
5d120b19 755d jne xul!nsStyleBorder::~nsStyleBorder+0x41 (5d120b78)
5d120b1b b960755d95 mov ecx,955D7560h
5d120b20 60 pushad
5d120b21 755d jne xul!nsStyleBorder::~nsStyleBorder+0x49 (5d120b80)
5d120b23 db ???
5d120b24 60 pushad
5d120b25 755d jne xul!nsStyleBorder::~nsStyleBorder+0x4d (5d120b84)
5d120b27 92 xchg eax,edx
5d120b28 61 popad
5d120b29 755d jne xul!nsStyleBorder::~nsStyleBorder+0x51 (5d120b88)
5d120b2b ea61755dbf6175 jmp 7561:BF5D7561
5d120b32 5d pop ebp
5d120b33 0c62 or al,62h
5d120b35 755d jne xul!nsStyleBorder::~nsStyleBorder+0x5d (5d120b94)
xul!nsStyleBorder::~nsStyleBorder [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsstylestruct.cpp @ 385]:
5d120b37 53 push ebx
5d120b38 56 push esi
5d120b39 8bf1 mov esi,ecx
5d120b3b 57 push edi
xul!nsStyleBorder::~nsStyleBorder+0x5 [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsstylestruct.cpp @ 387]:
5d120b3c 833e00 cmp dword ptr [esi],0 // current instruction
5d120b3f 7545 jne xul!nsStyleBorder::~nsStyleBorder+0x4f (5d120b86)
5d120b41 8d4e64 lea ecx,[esi+64h]
5d120b44 e879720a00 call xul!nsStyleSides::Reset (5d1c7dc2)
5d120b49 8d4e50 lea ecx,[esi+50h]
5d120b4c e871720a00 call xul!nsStyleSides::Reset (5d1c7dc2)
5d120b51 8d4e3c lea ecx,[esi+3Ch]
5d120b54 e869720a00 call xul!nsStyleSides::Reset (5d1c7dc2)
5d120b59 8d4e2c lea ecx,[esi+2Ch]
5d120b5c e8b5faffff call xul!nsStyleImage::~nsStyleImage (5d120616)
5d120b61 33ff xor edi,edi
5d120b63 8d5e0c lea ebx,[esi+0Ch]
5d120b66 807c370428 cmp byte ptr [edi+esi+4],28h
5d120b6b 0f84c1566300 je xul!nsStyleBorder::~nsStyleBorder+0x6356fb (5d756232)
5d120b71 c644370400 mov byte ptr [edi+esi+4],0
5d120b76 832300 and dword ptr [ebx],0

⇓ click on the title of a section to open or close it.

Disassembly of stack frame 2 at xul.dll!nsStyleBorder::Destroy + 0xB

5d120b66 807c370428 cmp byte ptr [edi+esi+4],28h
5d120b6b 0f84c1566300 je xul!nsStyleBorder::~nsStyleBorder+0x6356fb (5d756232)
5d120b71 c644370400 mov byte ptr [edi+esi+4],0
5d120b76 832300 and dword ptr [ebx],0
5d120b79 47 inc edi
5d120b7a 83c304 add ebx,4
5d120b7d 83ff07 cmp edi,7
5d120b80 7ee4 jle xul!nsStyleBorder::~nsStyleBorder+0x2f (5d120b66)
5d120b82 5f pop edi
5d120b83 5e pop esi
5d120b84 5b pop ebx
5d120b85 c3 ret
5d120b86 33ff xor edi,edi
5d120b88 8b06 mov eax,dword ptr [esi]
5d120b8a 8b0c07 mov ecx,dword ptr [edi+eax]
5d120b8d 85c9 test ecx,ecx
5d120b8f 7406 je xul!nsStyleBorder::~nsStyleBorder+0x60 (5d120b97)
5d120b91 51 push ecx
5d120b92 e8d3c94500 call xul!nsBorderColors::`scalar deleting destructor' (5d57d56a)
5d120b97 83c704 add edi,4
5d120b9a 83ff10 cmp edi,10h
5d120b9d 7ce9 jl xul!nsStyleBorder::~nsStyleBorder+0x51 (5d120b88)
5d120b9f ff36 push dword ptr [esi]
5d120ba1 ff15d874e15e call dword ptr [xul!_imp__free (5ee174d8)]
5d120ba7 59 pop ecx
5d120ba8 eb97 jmp xul!nsStyleBorder::~nsStyleBorder+0xa (5d120b41)
xul!nsStyleBorder::Destroy [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsstylestruct.cpp @ 433]:
5d120baa 55 push ebp
5d120bab 8bec mov ebp,esp
5d120bad 56 push esi
5d120bae 8bf1 mov esi,ecx
5d120bb0 e882ffffff call xul!nsStyleBorder::~nsStyleBorder (5d120b37) // call
xul!nsPresContext::PresShell [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsstylestruct.cpp @ 435] [inlined in xul!nsStyleBorder::Destroy+0xb [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\layout\style\nsstylestruct.cpp @ 435]]:
5d120bb5 8b4508 mov eax,dword ptr [ebp+8] // return address
5d120bb8 8b4810 mov ecx,dword ptr [eax+10h]
5d120bbb f681bf00000004 test byte ptr [ecx+0BFh],4
5d120bc2 750e jne xul!nsStyleBorder::Destroy+0x28 (5d120bd2)
5d120bc4 56 push esi
5d120bc5 681c000020 push 2000001Ch
5d120bca 83c118 add ecx,18h
5d120bcd e852860f00 call xul!nsPresArena::Free (5d219224)
5d120bd2 5e pop esi
5d120bd3 5d pop ebp
5d120bd4 c20400 ret 4
xul!mozilla::JSEventHandler::HandleEvent [c:\builds\moz2_slave\m-aurora-w32-ntly-000000000000\build\src\dom\events\jseventhandler.cpp @ 115]:
5d120bd7 55 push ebp
5d120bd8 8bec mov ebp,esp
5d120bda 83e4f8 and esp,0FFFFFFF8h
5d120bdd 81ec48010000 sub esp,148h

⇓ click on the title of a section to open or close it.

Binary information

firefox.exe

Image path: firefox.exe
Image name: firefox.exe
Timestamp: Sun Apr 09 10:41:43 2017 (58E9F3C7)
CheckSum: 0008A609
ImageSize: 0008D000
File version: 54.0.0.6308
Product version: 54.0.0.0
File flags: 2 (Mask 3F) Pre-release
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: Mozilla Corporation
ProductName: FirefoxDeveloperEdition
InternalName: FirefoxDeveloperEdition
OriginalFilename: firefox.exe
ProductVersion: 54.0a2
FileVersion: 54.0a2
FileDescription: FirefoxDeveloperEdition
LegalCopyright: ⌐Firefox and Mozilla Developers; available under the MPL 2 license.
LegalTrademarks: Firefox is a Trademark of The Mozilla Foundation.
Comments: Firefox is a Trademark of The Mozilla Foundation.

xul.dll

Loaded symbol image file: C:\Program Files\Firefox Developer Edition\xul.dll
Image path: C:\Program Files\Firefox Developer Edition\xul.dll
Image name: xul.dll
Timestamp: Sun Apr 09 10:59:23 2017 (58E9F7EB)
CheckSum: 031A0E35
ImageSize: 031D7000
File version: 54.0.0.6308
Product version: 54.0.0.6308
File flags: 2 (Mask 3F) Pre-release
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: Mozilla Foundation
ProductName: FirefoxDeveloperEdition
InternalName: FirefoxDeveloperEdition
OriginalFilename: xul.dll
ProductVersion: 54.0a2
FileVersion: 54.0a2
FileDescription: 54.0a2
LegalCopyright: License: MPL 2
LegalTrademarks: Mozilla
Comments: Mozilla

⇓ click on the title of a section to open or close it.

Application and cdb output log

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred cache*C:\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Deferred srv*http://symbols.mozilla.org/firefox
Symbol search path is: cache*C:\Symbols;cache*\\server\Symbols;srv*http://msdl.microsoft.com/download/symbols;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com;srv*http://symbols.mozilla.org/firefox
Executable search path is:
(The above output was generated in 1.9 seconds)
(10e0.62c): Break instruction exception - code 80000003 (first chance)
(The above output was generated in 0.0 seconds)
[JavaScript Warning: "Could not map contract ID '@mozilla.org/fxaccounts/push;1' to CID {1b7db999-2ecd-4abf-bb95-a726896798ca} because no implementation of the CID is registered." {file: "jar:file:///C:/Program%20Files/Firefox%20Developer%20Edition/omni.ja!/components/components.manifest" line: 181}]

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred cache*C:\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Deferred srv*http://symbols.mozilla.org/firefox
Symbol search path is: cache*C:\Symbols;cache*\\server\Symbols;srv*http://msdl.microsoft.com/download/symbols;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com;srv*http://symbols.mozilla.org/firefox
Executable search path is:
(The above output was generated in 0.6 seconds)
(bc4.210): Break instruction exception - code 80000003 (first chance)
(The above output was generated in 0.0 seconds)
(bc4.210): Unknown exception - code 000006ba (first chance)
(The above output was generated in 0.1 seconds)
[JavaScript Error: "Win error 2 during operation open on file C:\Users\FuzzBot\AppData\Local\Temp\Firefox-profile\directoryLinks.json (The system cannot find the file specified.
)" {file: "resource://app/modules/DirectoryLinksProvider.jsm" line: 397}]
DirectoryLinksProvider_readDirectoryLinksFile/<@resource://app/modules/DirectoryLinksProvider.jsm:397:7
process@resource://gre/modules/Promise.jsm -> resource://gre/modules/Promise-backend.js:925:21
walkerLoop@resource://gre/modules/Promise.jsm -> resource://gre/modules/Promise-backend.js:806:7
Promise*scheduleWalkerLoop@resource://gre/modules/Promise.jsm -> resource://gre/modules/Promise-backend.js:739:11
schedulePromise@resource://gre/modules/Promise.jsm -> resource://gre/modules/Promise-backend.js:770:7
completePromise@resource://gre/modules/Promise.jsm -> resource://gre/modules/Promise-backend.js:707:7
onError@resource://gre/modules/osfile/osfile_native.jsm:66:7

[JavaScript Error: "The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must be declared in the document or in the transfer protocol." {file: "http://w1032:28876/" line: 0}]
[JavaScript Error: "The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must be declared in the document or in the transfer protocol." {file: "http://w1032:28876/" line: 0}]
[JavaScript Warning: "Key event not available on some keyboard layouts: key=ôrö modifiers=ôaccel,altö id=ôkey_toggleReaderModeö" {file: "chrome://browser/content/browser.xul" line: 0}]
[JavaScript Warning: "Key event not available on some keyboard layouts: key=ôiö modifiers=ôaccel,alt,shiftö id=ôkey_browserToolboxö" {file: "chrome://browser/content/browser.xul" line: 0}]
[JavaScript Error: "TelemetryStopwatch: key "FX_PAGE_LOAD_MS" was already initialized" {file: "resource://gre/modules/TelemetryStopwatch.jsm" line: 282}]
start@resource://gre/modules/TelemetryStopwatch.jsm:282:7
start@resource://gre/modules/TelemetryStopwatch.jsm:136:12
onStateChange@chrome://browser/content/browser.js:4985:11
callListeners@chrome://browser/content/tabbrowser.xml:493:24
_callProgressListeners@chrome://browser/content/tabbrowser.xml:514:13
_callProgressListeners@chrome://browser/content/tabbrowser.xml:564:22
onStateChange@chrome://browser/content/tabbrowser.xml:747:15
_callProgressListeners@resource://gre/modules/RemoteWebProgress.jsm:174:11
receiveMessage@resource://gre/modules/RemoteWebProgress.jsm:235:7

[JavaScript Error: "TelemetryStopwatch: requesting elapsed time for nonexisting stopwatch. Histogram: "FX_PAGE_LOAD_MS", key: "null"" {file: "resource://gre/modules/TelemetryStopwatch.jsm" line: 297}]
timeElapsed@resource://gre/modules/TelemetryStopwatch.jsm:297:7
finish@resource://gre/modules/TelemetryStopwatch.jsm:315:17
finish@resource://gre/modules/TelemetryStopwatch.jsm:192:12
onStateChange@chrome://browser/content/browser.js:4990:11
callListeners@chrome://browser/content/tabbrowser.xml:493:24
_callProgressListeners@chrome://browser/content/tabbrowser.xml:514:13
_callProgressListeners@chrome://browser/content/tabbrowser.xml:564:22
onStateChange@chrome://browser/content/tabbrowser.xml:747:15
_callProgressListeners@resource://gre/modules/RemoteWebProgress.jsm:174:11
receiveMessage@resource://gre/modules/RemoteWebProgress.jsm:235:7

[JavaScript Error: "The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must be declared in the document or in the transfer protocol." {file: "http://w1032:28876/" line: 0}]
[JavaScript Error: "The character encoding of the HTML document was not declared. The document will render with garbled text in some browser configurations if the document contains characters from outside the US-ASCII range. The character encoding of the page must be declared in the document or in the transfer protocol." {file: "http://w1032:28876/" line: 0}]
(10e0.62c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
(The above output was generated in 3.7 seconds)

1:044>

⇓ click on the title of a section to open or close it.