1277946 - Possible use-after-free in PBlobChild::DestroySubtree

Status: RESOLVED DUPLICATE of bug 1277614

(Core :: IPC, defect, P1)

Description

[Andrew McCreight [:mccr8]]

Looking at the crash reports for bug 1277614, a lot of the crash addresses contain jemalloc poison. PBlobChild is the second thing that PContentChild::DestroySubtree destroys. I don't see anything else in the top 300 with DestroySubtree, so I'm not sure why this in particular is where all of the crashes are.

Comment 1

[Andrew McCreight [:mccr8]]

If the line numbers match up, then the crash is on the first line of PBlobChild::DestroySubtree, so maybe the |this| pointer for the PBlobChild is poisoned? I noticed that DestroySubtree() doesn't hold the actors alive, so maybe this is some kind of iterator invalidation? It also does not clear the array of child actors, so maybe this is getting called twice? Or maybe destroying one PBlobChild somehow destroys a sibling?

Could you look at this, Bill?

Comment 2

[Andrew McCreight [:mccr8]]

Relevant is jld's bug 898006 comment 4, which links to an analysis of a similar-looking crash in another DestroySubtree in bug 1202887.

Comment 3

[Andrew McCreight [:mccr8]]

Maybe it would make more sense for baku or somebody familiar with the PBlob ActorDestroy to audit that for possible things that are destroying other blobs.

Comment 4

[Jim Mathies [:jimm]]

FYI these crashes occur during shutdown - 

https://crash-stats.mozilla.com/search/?product=Firefox&signature=%3Dmozilla%3A%3Adom%3A%3APBlobChild%3A%3ADestroySubtree&_facets=signature&_facets=shutdown_progress&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-shutdown_progress

Comment 5

[Andrew Overholt [:overholt]]

Gabor is working on a related public bug.

Comment 6

[Andrew McCreight [:mccr8]]

This is pretty deep in shutdown, so I'll mark this moderate for now.

Comment 7

[Andrew McCreight [:mccr8]]

This is really just a dupe, and I ended up marking this sec-moderate, so I'll just dupe it over.