1122750 - Crash [@ mozilla::detail::AtomicBaseIncDec<int, (mozilla::MemoryOrdering)2u>::operator-- ]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Nicholas Troast [:ntroast]]

We have been observing the following crash signature during monkey runs.

[@ mozilla::detail::AtomicBaseIncDec<int, (mozilla::MemoryOrdering)2u>::operator-- | mozilla::dom::BlobParent::IDTableEntry::Release | nsRefPtr<mozilla::dom::BlobParent::IDTableEntry>::~nsRefPtr | mozilla::dom::BlobParent::~BlobParent ]

STR not availiable. Cafbot will upload the minidump shortly.

Comment 1

[cafbot (PoC: ggrisco)]

Attachment: EXTRA file attachment -

Comment 2

[cafbot (PoC: ggrisco)]

Attachment: decoded minidump -

Comment 3

[Ben Turner (not reading bugmail, use the needinfo flag!)]

What branch is this based on?

Comment 4

[Greg Grisco]

(In reply to ben turner [:bent] (use the needinfo? flag!) from comment #3)
> What branch is this based on?

This is v2.2.  The last crash we saw was with 

Gaia:  http://git.mozilla.org/?p=releases/gaia.git;a=commit;h=69ac77cfa938fae2763ac426a80ca6e5feb6ad25
Gecko: http://git.mozilla.org/?p=releases/gecko.git;a=commit;h=16a3a81985429f9831283b38a1d79af3a741dedb

Comment 5

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch, v1

Ugh, IPDL automatically destroys actors if the constructor message fails, so we're double-deleting at the moment...

Comment 6

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Looks like this was introduces in bug 994190.

Comment 7

[Ben Turner (not reading bugmail, use the needinfo flag!)]

This should be rare though... It requires a child process to die at just the right moment before sending one of these messages.

Comment 8

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 8551430 [details] [diff] [review]
Patch, v1

[Security approval request comment]
How easily could an exploit be constructed based on the patch? Hard, requires narrow timing between child process crash and parent process message being sent

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? No, but the changes to the code make the problem pretty obvious...

Which older supported branches are affected by this flaw? See flags

If not all supported branches, which bug introduced the flaw? See above

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? Should be identical for all branches

How likely is this patch to cause regressions; how much testing does it need? This is an obviously correct fix, I don't expect any regressions.

Comment 9

[Greg Grisco]

ni for Bhavana at her request.

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Comment on attachment 8551430 [details] [diff] [review]
Patch, v1

sec-approval+ for trunk. Please make and nominate patches for affected branches.

Comment 12

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 8551430 [details] [diff] [review]
Patch, v1

Approval Request Comment

(See above)

Comment 13

[Ben Turner (not reading bugmail, use the needinfo flag!)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8bab67d1c792

Comment 14

[Ryan VanderMeulen [:RyanVM]]

This was merged to m-c:
https://hg.mozilla.org/mozilla-central/rev/8bab67d1c792
https://hg.mozilla.org/releases/mozilla-aurora/rev/d947f5f0abca
https://hg.mozilla.org/releases/mozilla-beta/rev/508190797a80

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/d947f5f0abca

Comment 16

[Kai-Chih Hu [:khu]]

This bug was reported by codeaurora.org. IMO, we can enable QC confidential group.

Comment 17

[Julien Wajsberg [:julienw]]

Kevin, I don't think this is necessary, there is no confidential information in this bug.

Comment 18

[Michael Vines [:m1] [:evilmachines]]

(In reply to Kevin Hu [:khu] from comment #16)
> This bug was reported by codeaurora.org. IMO, we can enable QC confidential
> group.

Just FYI, this group is not really needed in general.  QC confidential data has no place on bugzilla.

Comment 19

[Al Billings [:abillings - ex-MoCo]]

Could this bug be triggered outside of Firefox OS?

Comment 20

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Probably only in e10s mode.