Closed Bug 1114691 Opened 10 years ago Closed 9 years ago

Intermittent test_peerConnection_offerRequiresReceiveVideoAudio.html | application terminated with exit code 1 after AddressSanitizer: double-free

Categories

(Core :: Graphics: Layers, defect)

Product:
Core
Component:
Graphics: Layers
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: RyanVM, Unassigned)

References

Details

(Keywords: intermittent-failure, sec-high) 

10:29:57 INFO - 95 INFO TEST-START | dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideoAudio.html
10:29:57 INFO - -*-*- UserCustomizations (child): document created: http://mochi.test:8888/tests/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVideoAudio.html
10:29:57 INFO - -*-*- UserCustomizations (child): _injectInWindow
10:29:57 INFO - -*-*- UserCustomizations (child): principal status: 0
10:29:57 INFO - TEST DEVICES: Using media devices:
10:29:57 INFO - audio: Sine source at 440 Hz
10:29:57 INFO - video: Dummy video device
10:29:57 INFO - 6052352[61200003bec0]: [main|PeerConnectionImpl] PeerConnectionImpl.cpp:352: PeerConnectionImpl: PeerConnectionImpl constructor for
10:29:57 INFO - (ice/WARNING) ICE(PC:1419186597426463 (id=101 url=http://mochi.test:8888/tests/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVid): No STUN servers specified
10:29:57 INFO - (ice/NOTICE) ICE(PC:1419186597426463 (id=101 url=http://mochi.test:8888/tests/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVid): No TURN servers specified
10:29:57 INFO - 6052352[61200003bec0]: [main|PeerConnectionImpl] PeerConnectionImpl.cpp:352: PeerConnectionImpl: PeerConnectionImpl constructor for
10:29:57 INFO - (ice/WARNING) ICE(PC:1419186597624333 (id=101 url=http://mochi.test:8888/tests/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVid): No STUN servers specified
10:29:57 INFO - (ice/NOTICE) ICE(PC:1419186597624333 (id=101 url=http://mochi.test:8888/tests/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVid): No TURN servers specified
10:29:58 INFO - 6052352[61200003bec0]: [main|sdp_config] sdp_config.c:110: SDP: Initialized config pointer: 0x60b000016a90 (magic=0xABCDABCD)
10:29:58 INFO - 6052352[61200003bec0]: [1419186597426463 (id=101 url=http://mochi.test:8888/tests/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVid]: stable -> have-local-offer
10:29:58 INFO - 6052352[61200003bec0]: [main|sdp_config] sdp_config.c:110: SDP: Initialized config pointer: 0x60b0000ee680 (magic=0xABCDABCD)
10:29:58 INFO - 6052352[61200003bec0]: [1419186597624333 (id=101 url=http://mochi.test:8888/tests/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVid]: stable -> have-remote-offer
10:29:58 INFO - =================================================================
10:29:58 INFO - ==2286==ERROR: AddressSanitizer: attempting double-free on 0x603000388900 in thread T0:
10:29:58 INFO - 6052352[61200003bec0]: [main|sdp_config] sdp_config.c:110: SDP: Initialized config pointer: 0x60b0000b9ba0 (magic=0xABCDABCD)
10:29:58 INFO - 6052352[61200003bec0]: [1419186597624333 (id=101 url=http://mochi.test:8888/tests/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVid]: have-remote-offer -> stable
10:29:58 INFO - 6052352[61200003bec0]: [main|WebrtcVideoSessionConduit] VideoConduit.cpp:472: Init Initialization Done
10:29:58 INFO - -1197975808[6120000d8340]: [|WebrtcAudioSessionConduit] AudioConduit.cpp:850: SendRTCPPacket RTCP Packet Send Failed
10:29:58 INFO - 6052352[61200003bec0]: [main|sdp_config] sdp_config.c:110: SDP: Initialized config pointer: 0x60b00007b2a0 (magic=0xABCDABCD)
10:29:58 INFO - 6052352[61200003bec0]: [1419186597426463 (id=101 url=http://mochi.test:8888/tests/dom/media/tests/mochitest/test_peerConnection_offerRequiresReceiveVid]: have-local-offer -> stable
10:29:58 INFO - -1170188544[6120000add40]: [|WebrtcVideoSessionConduit] VideoConduit.cpp:1210: SendRTCPPacket RTCP Packet Send Failed
10:29:58 INFO - 6052352[61200003bec0]: [main|WebrtcVideoSessionConduit] VideoConduit.cpp:472: Init Initialization Done
10:29:58 INFO - 6052352[61200003bec0]: [main|WebrtcVideoSessionConduit] VideoConduit.cpp:816: ConfigureRecvMediaCodecs Successfully Set the codec VP8
10:29:58 INFO - 6052352[61200003bec0]: [main|PeerConnectionImpl] PeerConnectionImpl.cpp:194: Returning success for OnAddStream()
10:29:58 INFO - #0 0x471b71 in __interceptor_free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
10:29:58 INFO - #1 0x7fc589808a2a (/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0+0x33a2a)
10:29:58 INFO - #2 0x7fc5898190d5 (/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0+0x440d5)
10:29:58 INFO - #3 0x7fc589819236 (/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0+0x44236)
10:29:58 INFO - #4 0x7fc58981b8e2 (/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0+0x468e2)
10:29:58 INFO - -1164531968[612000191440]: [|WebrtcVideoSessionConduit] VideoConduit.cpp:1210: SendRTCPPacket RTCP Packet Send Failed
10:29:59 INFO - -1170188544[6120000add40]: [|WebrtcVideoSessionConduit] VideoConduit.cpp:1210: SendRTCPPacket RTCP Packet Send Failed
10:29:59 INFO - -1170188544[6120000add40]: [|WebrtcVideoSessionConduit] VideoConduit.cpp:1210: SendRTCPPacket RTCP Packet Send Failed
10:29:59 INFO - -936413440[6120000b3a40]: [|WebrtcAudioSessionConduit] AudioConduit.cpp:703: A/V sync: GetAVStats failed
10:29:59 INFO - -1164531968[612000191440]: [|WebrtcVideoSessionConduit] VideoConduit.cpp:1210: SendRTCPPacket RTCP Packet Send Failed
10:30:00 INFO - #5 0x7fc5810a75bd in nsWindow::NativeShow(bool) /builds/slave/fx-team-l64-asan-0000000000000/build/src/widget/gtk/nsWindow.cpp:3937
10:30:00 INFO - #6 0x7fc5810a697a in nsWindow::Destroy() /builds/slave/fx-team-l64-asan-0000000000000/build/src/widget/gtk/nsWindow.cpp:647
10:30:00 INFO - #7 0x7fc581013378 in DestroyWidgetRunnable::Run() /builds/slave/fx-team-l64-asan-0000000000000/build/src/view/nsView.cpp:111
10:30:00 INFO - #8 0x7fc57c47cc94 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/fx-team-l64-asan-0000000000000/build/src/xpcom/threads/nsThread.cpp:855
10:30:00 INFO - #9 0x7fc57c4dc7ba in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/fx-team-l64-asan-0000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:265
10:30:00 INFO - #10 0x7fc57cd03349 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/glue/MessagePump.cpp:99
10:30:00 INFO - #11 0x7fc57ccaff9c in RunInternal /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/base/message_loop.cc:233
10:30:00 INFO - #12 0x7fc57ccaff9c in RunHandler /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/base/message_loop.cc:226
10:30:00 INFO - #13 0x7fc57ccaff9c in MessageLoop::Run() /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/base/message_loop.cc:200
10:30:00 INFO - #14 0x7fc581050037 in nsBaseAppShell::Run() /builds/slave/fx-team-l64-asan-0000000000000/build/src/widget/nsBaseAppShell.cpp:164
10:30:00 INFO - #15 0x7fc582a8c6c8 in nsAppStartup::Run() /builds/slave/fx-team-l64-asan-0000000000000/build/src/toolkit/components/startup/nsAppStartup.cpp:281
10:30:00 INFO - #16 0x7fc582b79ece in XREMain::XRE_mainRun() /builds/slave/fx-team-l64-asan-0000000000000/build/src/toolkit/xre/nsAppRunner.cpp:4150
10:30:00 INFO - #17 0x7fc582b7ae3d in XREMain::XRE_main(int, char**, nsXREAppData const*) /builds/slave/fx-team-l64-asan-0000000000000/build/src/toolkit/xre/nsAppRunner.cpp:4226
10:30:00 INFO - #18 0x7fc582b7bd5d in XRE_main /builds/slave/fx-team-l64-asan-0000000000000/build/src/toolkit/xre/nsAppRunner.cpp:4446
10:30:00 INFO - #19 0x48a2fa in do_main /builds/slave/fx-team-l64-asan-0000000000000/build/src/browser/app/nsBrowserApp.cpp:292
10:30:00 INFO - #20 0x48a2fa in main /builds/slave/fx-team-l64-asan-0000000000000/build/src/browser/app/nsBrowserApp.cpp:661
10:30:00 INFO - #21 0x7fc59556d76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
10:30:00 INFO - #22 0x48975c in _start (/builds/slave/test/build/application/firefox/firefox+0x48975c)
10:30:00 INFO - 0x603000388900 is located 0 bytes inside of 32-byte region [0x603000388900,0x603000388920)
10:30:00 INFO - freed by thread T29 (Compositor) here:
10:30:00 INFO - #0 0x471b71 in __interceptor_free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
10:30:00 INFO - #1 0x7fc589808a2a (/usr/lib/x86_64-linux-gnu/libgdk-x11-2.0.so.0+0x33a2a)
10:30:00 INFO - previously allocated by thread T0 here:
10:30:00 INFO - #0 0x471d71 in malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
10:30:00 INFO - #1 0x7fc58b8c5a38 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4da38)
10:30:00 INFO - Thread T29 (Compositor) created by T0 here:
10:30:00 INFO - #0 0x45e5e5 in __interceptor_pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:175
10:30:00 INFO - #1 0x7fc57cc872ae in CreateThread /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/base/platform_thread_posix.cc:144
10:30:00 INFO - #2 0x7fc57cc872ae in PlatformThread::Create(unsigned long, PlatformThread::Delegate*, unsigned long*) /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/base/platform_thread_posix.cc:155
10:30:00 INFO - #3 0x7fc57ccc3258 in base::Thread::StartWithOptions(base::Thread::Options const&) /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/base/thread.cc:92
10:30:00 INFO - #4 0x7fc57de7dad0 in mozilla::layers::CompositorThreadHolder::CreateCompositorThread() /builds/slave/fx-team-l64-asan-0000000000000/build/src/gfx/layers/ipc/CompositorParent.cpp:168
10:30:00 INFO - #5 0x7fc57de7f290 in operator new /builds/slave/fx-team-l64-asan-0000000000000/build/src/gfx/layers/ipc/CompositorParent.cpp:120
10:30:00 INFO - #6 0x7fc57de7f290 in mozilla::layers::CompositorParent::StartUp() /builds/slave/fx-team-l64-asan-0000000000000/build/src/gfx/layers/ipc/CompositorParent.cpp:329
10:30:00 INFO - #7 0x7fc57df459fe in gfxPlatform::InitLayersIPC() /builds/slave/fx-team-l64-asan-0000000000000/build/src/gfx/thebes/gfxPlatform.cpp:649
10:30:00 INFO - #8 0x7fc57df43f52 in gfxPlatform::Init() /builds/slave/fx-team-l64-asan-0000000000000/build/src/gfx/thebes/gfxPlatform.cpp:485
10:30:00 INFO - #9 0x7fc57df42e94 in gfxPlatform::GetPlatform() /builds/slave/fx-team-l64-asan-0000000000000/build/src/gfx/thebes/gfxPlatform.cpp:401
10:30:00 INFO - #10 0x7fc5818baae1 in PresShell::CreateReferenceRenderingContext() /builds/slave/fx-team-l64-asan-0000000000000/build/src/layout/base/nsPresShell.cpp:3151
10:30:00 INFO - #11 0x7fc5818b11be in PresShell::DoReflow(nsIFrame*, bool) /builds/slave/fx-team-l64-asan-0000000000000/build/src/layout/base/nsPresShell.cpp:9230
10:30:00 INFO - #12 0x7fc5818c5b28 in PresShell::ProcessReflowCommands(bool) /builds/slave/fx-team-l64-asan-0000000000000/build/src/layout/base/nsPresShell.cpp:9464
10:30:00 INFO - #13 0x7fc5818c5026 in PresShell::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/slave/fx-team-l64-asan-0000000000000/build/src/layout/base/nsPresShell.cpp:4350
10:30:00 INFO - #14 0x7fc58165a326 in nsRefreshDriver::Tick(long, mozilla::TimeStamp) /builds/slave/fx-team-l64-asan-0000000000000/build/src/layout/base/nsRefreshDriver.cpp:1307
10:30:00 INFO - #15 0x7fc58166205c in TickDriver /builds/slave/fx-team-l64-asan-0000000000000/build/src/layout/base/nsRefreshDriver.cpp:176
10:30:00 INFO - #16 0x7fc58166205c in mozilla::RefreshDriverTimer::Tick() /builds/slave/fx-team-l64-asan-0000000000000/build/src/layout/base/nsRefreshDriver.cpp:167
10:30:00 INFO - #17 0x7fc57c486519 in nsTimerImpl::Fire() /builds/slave/fx-team-l64-asan-0000000000000/build/src/xpcom/threads/nsTimerImpl.cpp:631
10:30:00 INFO - #18 0x7fc57c48705e in nsTimerEvent::Run() /builds/slave/fx-team-l64-asan-0000000000000/build/src/xpcom/threads/nsTimerImpl.cpp:724
10:30:00 INFO - #19 0x7fc57c47cc94 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/fx-team-l64-asan-0000000000000/build/src/xpcom/threads/nsThread.cpp:855
10:30:00 INFO - #20 0x7fc57c4dc7ba in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/fx-team-l64-asan-0000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:265
10:30:00 INFO - #21 0x7fc57cd03349 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/glue/MessagePump.cpp:99
10:30:00 INFO - #22 0x7fc57ccaff9c in RunInternal /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/base/message_loop.cc:233
10:30:00 INFO - #23 0x7fc57ccaff9c in RunHandler /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/base/message_loop.cc:226
10:30:00 INFO - #24 0x7fc57ccaff9c in MessageLoop::Run() /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/base/message_loop.cc:200
10:30:00 INFO - #25 0x7fc581050037 in nsBaseAppShell::Run() /builds/slave/fx-team-l64-asan-0000000000000/build/src/widget/nsBaseAppShell.cpp:164
10:30:00 INFO - #26 0x7fc582a8c6c8 in nsAppStartup::Run() /builds/slave/fx-team-l64-asan-0000000000000/build/src/toolkit/components/startup/nsAppStartup.cpp:281
10:30:00 INFO - #27 0x7fc582b79ece in XREMain::XRE_mainRun() /builds/slave/fx-team-l64-asan-0000000000000/build/src/toolkit/xre/nsAppRunner.cpp:4150
10:30:00 INFO - #28 0x7fc582b7ae3d in XREMain::XRE_main(int, char**, nsXREAppData const*) /builds/slave/fx-team-l64-asan-0000000000000/build/src/toolkit/xre/nsAppRunner.cpp:4226
10:30:00 INFO - #29 0x7fc582b7bd5d in XRE_main /builds/slave/fx-team-l64-asan-0000000000000/build/src/toolkit/xre/nsAppRunner.cpp:4446
10:30:00 INFO - #30 0x48a2fa in do_main /builds/slave/fx-team-l64-asan-0000000000000/build/src/browser/app/nsBrowserApp.cpp:292
10:30:00 INFO - #31 0x48a2fa in main /builds/slave/fx-team-l64-asan-0000000000000/build/src/browser/app/nsBrowserApp.cpp:661
10:30:00 INFO - #32 0x7fc59556d76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
10:30:00 INFO - SUMMARY: AddressSanitizer: double-free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64 __interceptor_free
10:30:00 INFO - ==2286==ABORTING
10:30:00 INFO - -936413440[6120000b3a40]: [|WebrtcAudioSessionConduit] AudioConduit.cpp:703: A/V sync: GetAVStats failed
10:30:00 INFO - -1170188544[6120000add40]: [|WebrtcVideoSessionConduit] VideoConduit.cpp:1210: SendRTCPPacket RTCP Packet Send Failed
10:30:00 INFO - [Child 2324] WARNING: pipe error (16): Connection reset by peer: file /builds/slave/fx-team-l64-asan-0000000000000/build/src/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 456
10:30:00 INFO - ###!!! [Child][MessageChannel::SendAndWait] Error: Channel error: cannot send/recv
10:30:00 INFO - TEST-INFO | Main app process: killed by SIGHUP
Appears to be unrelated to the test being run.  Crash is in  nsWindow::NativeShow(bool) call from DestroyWidgetRunnable::Run()
Component: WebRTC: Audio/Video → Widget: Gtk
Looks like the object creation is in layers so maybe try that component.
Component: Widget: Gtk → Graphics: Layers
GDK is not thread-safe and so should not be called on another thread.

I don't see evidence that bug 1089456 comment 3 is involved here, but some symbol names could help.
Depends on: 933061
Using something not threadsafe on the compositor thread and the main thread sounds bad.
Keywords: sec-high
ryan - where's the link to the full log?  Is this a treeherder thing that the links don't show up?
Flags: needinfo?(ryanvm)
No, it's a "Ryan forgot to manually include it" thing since Treeherder can't mark security bugs. I'll try to dig it up next week when I'm back from vacation.
Group: gfx-core-security
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → INCOMPLETE
Group: core-security → core-security-release
Group: gfx-core-security
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.