1163079 - GeckoChildProcessHost.cpp calls nsDirectoryService::Get off main-thread (unsafe race)

Status: RESOLVED FIXED

(Core :: IPC, defect, P5)

Description

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

STR: Start firefox with patch in Bug 1163021 comment 8.

In Gecko_IOThread (5) here http://mxr.mozilla.org/mozilla-central/source/ipc/glue/GeckoChildProcessHost.cpp?rev=c4d062966fee#519

This is unsafe as pointed out in Bug 1163021 comment 2.

Comment 1

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

> Gecko_IOThread (5)
> #0	0x00000001016c2014 in nsDirectoryService::Get(char const*, nsID const&, void**) at /Users/Jan/moz/mozilla-central/xpcom/io/nsDirectoryService.cpp:364
> #1	0x00000001016c29da in non-virtual thunk to nsDirectoryService::Get(char const*, nsID const&, void**) at /Users/Jan/moz/mozilla-central/xpcom/io/nsDirectoryService.cpp:407
> #2	0x0000000101db4ec5 in AddAppDirToCommandLine(std::vector<std::string, std::allocator<std::string> >&) at /Users/Jan/moz/mozilla-central/ipc/glue/GeckoChildProcessHost.cpp:519
> #3	0x0000000101db4614 in mozilla::ipc::GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string, std::allocator<std::string> >&, base::ProcessArchitecture) at /Users/Jan/moz/mozilla-central/ipc/glue/GeckoChildProcessHost.cpp:699
> #4	0x0000000101db3e03 in mozilla::ipc::GeckoChildProcessHost::PerformAsyncLaunch(std::vector<std::string, std::allocator<std::string> >, base::ProcessArchitecture) at /Users/Jan/moz/mozilla-central/ipc/glue/GeckoChildProcessHost.cpp:487
> #5	0x0000000101db37bd in mozilla::ipc::GeckoChildProcessHost::RunPerformAsyncLaunch(std::vector<std::string, std::allocator<std::string> >, base::ProcessArchitecture) at /Users/Jan/moz/mozilla-central/ipc/glue/GeckoChildProcessHost.cpp:500
> #6	0x0000000101dbac9d in void DispatchToMethod<mozilla::ipc::GeckoChildProcessHost, bool (mozilla::ipc::GeckoChildProcessHost::*)(std::vector<std::string, std::allocator<std::string> >, base::ProcessArchitecture), std::vector<std::string, std::allocator<std::string> >, base::ProcessArchitecture>(mozilla::ipc::GeckoChildProcessHost*, bool (mozilla::ipc::GeckoChildProcessHost::*)(std::vector<std::string, std::allocator<std::string> >, base::ProcessArchitecture), Tuple2<std::vector<std::string, std::allocator<std::string> >, base::ProcessArchitecture> const&) at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/tuple.h:400
> #7	0x0000000101dbab5e in RunnableMethod<mozilla::ipc::GeckoChildProcessHost, bool (mozilla::ipc::GeckoChildProcessHost::*)(std::vector<std::string, std::allocator<std::string> >, base::ProcessArchitecture), Tuple2<std::vector<std::string, std::allocator<std::string> >, base::ProcessArchitecture> >::Run() at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/task.h:310
> #8	0x0000000101d3cc50 in MessageLoop::RunTask(Task*) at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/message_loop.cc:361
> #9	0x0000000101d3d1cf in MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/message_loop.cc:369
> #10	0x0000000101d3d3f4 in MessageLoop::DoWork() at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/message_loop.cc:456
> #11	0x0000000101d3ef7b in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/message_pump_libevent.cc:328
> #12	0x0000000101d3cb35 in MessageLoop::RunInternal() at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/message_loop.cc:233
> #13	0x0000000101d3ca45 in MessageLoop::RunHandler() at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/message_loop.cc:226
> #14	0x0000000101d3c9ed in MessageLoop::Run() at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/message_loop.cc:200
> #15	0x0000000101d620f9 in base::Thread::ThreadMain() at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/thread.cc:170
> #16	0x0000000101d6333c in ThreadFunc(void*) at /Users/Jan/moz/mozilla-central/ipc/chromium/src/base/platform_thread_posix.cc:39
> #17	0x00007fff89375899 in _pthread_body ()
> #18	0x00007fff8937572a in _pthread_start ()
> #19	0x00007fff89379fc9 in thread_start ()

Comment 2

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

FYI also seen post startup when flash starts (I went to cnn.com).

Last line in log before breakpoint:

> For application/x-shockwave-flash found plugin Flash Player.plugin

Since this bug is a potential data-race on the hash table, might it be contributing to intermittent crashes around flash?

Comment 3

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven't been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.

Comment 4

[:Gijs (he/him)]

Attachment: Bug 1163079 - ensure we fetch app/profile dir information on the main thread in GeckoChildProcessHost

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b4df7e108b5d
ensure we fetch app/profile dir information on the main thread in GeckoChildProcessHost r=jld,bryce,haik

Comment 6

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/b4df7e108b5d