1239941 - Crash when using dynamic logging and restarting

Status: RESOLVED FIXED

(Core :: XPCOM, defect)

Description

[Valentin Gosu [:valentin] (he/him)]

Attachment: pref_crash.txt

I set the following prefs and restarted the browser:
logging.nsHttp = 5
logging.nsHostResolver = 5
logging.nsSocketTransport = 5
logging.nsStreamPump = 5

no env variables are set - logging is done at stderr
When opening a new tab, to say google.com, it crashes.
I can reproduce it almost immediately.

Comment 1

[Eric Rahm [:erahm]]

Confirmed, I was able to repro on linux w/ the specified prefs and navigating to youtube.com. It appears that the va_list is getting trashed when going into the long logline path.

Comment 2

[Eric Rahm [:erahm]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=fbad43ce0745

Comment 3

[Eric Rahm [:erahm]]

Attachment: Copy va_list before using it in LogModuleManager::Print

Comment 4

[Nathan Froyd [:froydnj]]

Comment on attachment 8708223 [details] [diff] [review]
Copy va_list before using it in LogModuleManager::Print

Review of attachment 8708223 [details] [diff] [review]:
-----------------------------------------------------------------

Ah, whoops!

Comment 5

[Eric Rahm [:erahm]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1e81d89a1c98c233989d675ce85b07c2b4887d3a
Bug 1239941 - Copy va_list before using it in LogModuleManager::Print. r=froydnj

Comment 6

[JW Wang [:jwwang] [:jw_wang]]

Does that mean we need va_copy whenever passing a va_list to another function like:

void foo(va_list va) {
  va_list va1;
  va_copy(va1, va);
  bar1(va1);
  va_end(va1);
}

void bar1(va_list va1) {
  va_list va2;
  va_copy(va2, va1);
  bar2(va2);
  va_end(va2);
}

void bar2(va_list va2) {
  va_list va3;
  va_copy(va3, va2);
  bar3(va3);
  va_end(va3);
}

Comment 7

[Eric Rahm [:erahm]]

(In reply to JW Wang [:jwwang] from comment #6)
> Does that mean we need va_copy whenever passing a va_list to another
> function like:
> 
> void foo(va_list va) {
>   va_list va1;
>   va_copy(va1, va);
>   bar1(va1);
>   va_end(va1);
> }
> 
> void bar1(va_list va1) {
>   va_list va2;
>   va_copy(va2, va1);
>   bar2(va2);
>   va_end(va2);
> }
> 
> void bar2(va_list va2) {
>   va_list va3;
>   va_copy(va3, va2);
>   bar3(va3);
>   va_end(va3);
> }

Only if it's used more than once. I don't think that would necessarily hurt anything though. In this case we sometimes used it twice, ie:

> void foo(va_list va) {
>  if (!bar(va))
>    bar2(va);
> }

And the fix was to copy it for the first case:
> void foo(va_list va) {
>  va_list va1; va_copy(va1, va);
>  if (!bar(va))
>    bar2(va);
>  va_end(va1);
> }

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1e81d89a1c98