1255859 - IndexedDB - Crash in IsInPurpleBuffer()

Status: RESOLVED INVALID

(Core :: Storage: IndexedDB, defect, P5)

Description

[Looben Yang]

Firefox versioni: 47.0a1 (2016-03-06)

=================================================================
==2532==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fa71e5b9401 sp 0x7fff94e28120 bp 0x7fff94e28140 T0)
    #0 0x7fa71e5b9400 in IsInPurpleBuffer /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/nsISupportsImpl.h:305
    #1 0x7fa71e5b9400 in decr /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/nsISupportsImpl.h:273
    #2 0x7fa71e5b9400 in decr /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/nsISupportsImpl.h:265
    #3 0x7fa71e5b9400 in Release /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/indexedDB/IDBFactory.cpp:900
    #4 0x7fa71e5b9400 in Release /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:39
    #5 0x7fa71e5b9400 in Release /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:377
    #6 0x7fa71e5b9400 in ~RefPtr /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:77
    #7 0x7fa71e5b9400 in ~WorkerPermissionChallenge /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/indexedDB/ActorsChild.cpp:901
    #8 0x7fa71e5b9400 in mozilla::dom::indexedDB::(anonymous namespace)::WorkerPermissionChallenge::~WorkerPermissionChallenge() /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/indexedDB/ActorsChild.cpp:901
    #9 0x7fa718e8488c in nsRunnable::Release() /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:35
    #10 0x7fa71e5b9d42 in Release /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:39
    #11 0x7fa71e5b9d42 in Release /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:377
    #12 0x7fa71e5b9d42 in ~RefPtr /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:77
    #13 0x7fa71e5b9d42 in ~WorkerPermissionRequest /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/indexedDB/ActorsChild.cpp:871
    #14 0x7fa71e5b9d42 in mozilla::dom::indexedDB::(anonymous namespace)::WorkerPermissionRequest::~WorkerPermissionRequest() /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/indexedDB/ActorsChild.cpp:869
    #15 0x7fa71e5c74cd in mozilla::dom::indexedDB::PermissionRequestBase::Release() /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/indexedDB/PermissionRequestBase.cpp:194
    #16 0x7fa718cfc6b6 in operator[] /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/nsCOMPtr.h:295
    #17 0x7fa718cfc6b6 in PopLast /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/mozilla/SegmentedVector.h:98
    #18 0x7fa718cfc6b6 in mozilla::SegmentedVector<nsCOMPtr<nsISupports>, 4096ul, mozilla::MallocAllocPolicy>::PopLastN(unsigned int) /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/mozilla/SegmentedVector.h:266
    #19 0x7fa718cddb2a in mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/mozilla/dom/BindingUtils.h:2896
    #20 0x7fa718cdea94 in mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/base/CycleCollectedJSRuntime.cpp:1455
    #21 0x7fa718cdeef0 in mozilla::IncrementalFinalizeRunnable::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/base/CycleCollectedJSRuntime.cpp:1489
    #22 0x7fa718e0c4d0 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/threads/nsThread.cpp:994
    #23 0x7fa718e85a2a in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:297
    #24 0x7fa71982a779 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/glue/MessagePump.cpp:95
    #25 0x7fa71979158c in RunInternal /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234
    #26 0x7fa71979158c in RunHandler /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227
    #27 0x7fa71979158c in MessageLoop::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201
    #28 0x7fa71ecc9fc7 in nsBaseAppShell::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/widget/nsBaseAppShell.cpp:156
    #29 0x7fa720b3fc58 in nsAppStartup::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/toolkit/components/startup/nsAppStartup.cpp:281
    #30 0x7fa720c3752a in XREMain::XRE_mainRun() /builds/slave/m-cen-l64-asan-000000000000000/build/src/toolkit/xre/nsAppRunner.cpp:4327
    #31 0x7fa720c38796 in XREMain::XRE_main(int, char**, nsXREAppData const*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/toolkit/xre/nsAppRunner.cpp:4424
    #32 0x7fa720c395de in XRE_main /builds/slave/m-cen-l64-asan-000000000000000/build/src/toolkit/xre/nsAppRunner.cpp:4526
    #33 0x48a793 in do_main /builds/slave/m-cen-l64-asan-000000000000000/build/src/browser/app/nsBrowserApp.cpp:220
    #34 0x48a793 in main /builds/slave/m-cen-l64-asan-000000000000000/build/src/browser/app/nsBrowserApp.cpp:360
    #35 0x7fa732131ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #36 0x489bcc in _start (/home/parnell/FirefoxBuilds/firefox/firefox+0x489bcc)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dist/include/nsISupportsImpl.h:305 IsInPurpleBuffer
==2532==ABORTING

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Steps to reproduce?

Comment 2

[Jens Stutte [:jstutte]]

I do not expect any further information here, nor do we have anything actionable (the stack trace is 4 years old).