crash in mozilla::ipc::MessageChannel::OnChannelErrorFromLink() on asan builds

NEW
Unassigned

Status

()

Core
IPC
P2
normal
a year ago
3 months ago

People

(Reporter: Hanno Boeck, Unassigned)

Tracking

(Blocks: 1 bug)

Trunk
Points:
---

Firefox Tracking Flags

(firefox55 affected)

Details

(crash signature)

Attachments

(4 attachments)

(Reporter)

Description

a year ago
Created attachment 8855373 [details]
asan-mozilla::ipc::MessageChannel::OnChannelErrorFromLink-MessageChannel.cpp:2280.txt

I'm getting occasional crashes (with crash dumps) with the asan builds of mozilla. (asan build "target.tar.bz2" downloaded on 2017-04-04, sha256 69926deabcd04a4a2e6030001dae365bca5985ab83979b42bf1675b969e2377f)

The crashes usually happen if I want to close the browser during heavy activity (I was experimenting with HTML files including lots of iframes). However I could also reproduce them most reliably by just starting firefox and killing it shortly after, e.g.:
./firefox & sleep 3; killall firefox

(This doesn't depend on "killall", it also sometimes works with clicking the close symbol, but needs the right timing)

I got different stack traces, but the by far most common one indicates a crash in  mozilla::ipc::MessageChannel::OnChannelErrorFromLink().

I got a different crash in mozilla::ipc::BackgroundChildImpl::ProcessingError(), however I was not able to reproduce that and only got it once.

A third crash is probably irrelevant: It happens in RunWatchdog(), looking at the code it is just some kind of timeout where it kills the application if it supposedly hangs. I just mention it for completeness.

I'll attach all three stack traces.
(Reporter)

Comment 1

a year ago
Created attachment 8855374 [details]
asan-mozilla::ipc::MessageChannel::OnChannelErrorFromLink-MessageChannel.cpp:2280.txt
(Reporter)

Comment 2

a year ago
Created attachment 8855376 [details]
asan-mozilla::ipc::BackgroundChildImpl::ProcessingError-BackgroundChildImpl.cpp:142.txt
(Reporter)

Comment 3

a year ago
Created attachment 8855377 [details]
asan-mozilla::_::RunWatchdog-nsTerminator.cpp:159.txt
These are all various intentional crashes when we detect an error. The OnChannelError ones are here:
  MOZ_CRASH("Aborting on channel error.");
The nsTerminator one is here:
  MOZ_CRASH("Shutdown too long, probably frozen, causing a crash.");
Group: core-security

Updated

10 months ago
Priority: -- → P2

Updated

10 months ago
Depends on: 1397419

Updated

10 months ago
Blocks: 1397419
No longer depends on: 1397419

Updated

3 months ago
Crash Signature: mozilla::ipc::MessageChannel::OnChannelErrorFromLink
You need to log in before you can comment on or make changes to this bug.