Crash in mozilla::ipc::PMemoryStreamChild::SendAddChunk

RESOLVED FIXED in Firefox 54

Status

()

Core
DOM: Core & HTML
--
critical
RESOLVED FIXED
2 months ago
a month ago

People

(Reporter: philipp, Assigned: baku)

Tracking

({crash, regression})

54 Branch
mozilla55
crash, regression
Points:
---

Firefox Tracking Flags

(firefox52 unaffected, firefox53 unaffected, firefox54 fixed, firefox55 fixed, firefox-esr45 unaffected, firefox-esr52 unaffected)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

2 months ago
This bug was filed from the Socorro interface and is 
report bp-53ec7f04-294b-4236-880b-f11ab0170414.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::ipc::PMemoryStreamChild::SendAddChunk(nsTArray<unsigned char> const&) 	obj-firefox/ipc/ipdl/PMemoryStreamChild.cpp:38
1 	xul.dll 	mozilla::dom::`anonymous namespace'::SerializeInputStreamInChunks<mozilla::dom::nsIContentChild> 	dom/file/ipc/Blob.cpp:661
2 	xul.dll 	mozilla::dom::BlobDataFromBlobImpl<mozilla::dom::nsIContentChild>(mozilla::dom::nsIContentChild*, mozilla::dom::BlobImpl*, mozilla::dom::BlobData&) 	dom/file/ipc/Blob.cpp:995
3 	xul.dll 	nsTArray_Impl<mozilla::dom::BlobData, nsTArrayInfallibleAllocator>::InsertElementsAt<nsTArrayInfallibleAllocator>(unsigned int, unsigned int) 	obj-firefox/dist/include/nsTArray.h:1903
4 	xul.dll 	mozilla::dom::BlobDataFromBlobImpl<mozilla::dom::nsIContentChild>(mozilla::dom::nsIContentChild*, mozilla::dom::BlobImpl*, mozilla::dom::BlobData&) 	dom/file/ipc/Blob.cpp:968
5 	xul.dll 	mozilla::dom::BlobDataFromBlobImpl<mozilla::dom::nsIContentChild>(mozilla::dom::nsIContentChild*, mozilla::dom::BlobImpl*, mozilla::dom::BlobData&) 	dom/file/ipc/Blob.cpp:968
6 	xul.dll 	mozilla::dom::MultipartBlobImpl::QueryInterface(nsID const&, void**) 	dom/file/MultipartBlobImpl.cpp:25
7 	xul.dll 	mozilla::dom::BlobChild::GetOrCreateFromImpl<mozilla::dom::nsIContentChild>(mozilla::dom::nsIContentChild*, mozilla::dom::BlobImpl*) 	dom/file/ipc/Blob.cpp:3603
8 	xul.dll 	mozilla::BroadcastBlobURLRegistration(nsACString const&, mozilla::dom::BlobImpl*, nsIPrincipal*) 	dom/file/nsHostObjectProtocolHandler.cpp:147
9 	xul.dll 	nsHostObjectProtocolHandler::AddDataEntry(mozilla::dom::BlobImpl*, nsIPrincipal*, nsACString&) 	dom/file/nsHostObjectProtocolHandler.cpp:524
10 	xul.dll 	mozilla::dom::`anonymous namespace'::CreateObjectURLInternal<mozilla::dom::BlobImpl*> 	dom/url/URL.cpp:52
11 	xul.dll 	mozilla::dom::URL::CreateObjectURL(mozilla::dom::GlobalObject const&, mozilla::dom::Blob&, nsAString&, mozilla::ErrorResult&) 	dom/url/URL.cpp:1716
...

cross platform crahses with this signature started showing up in 55.0a1 & 54.0a2 in this cycle. this seems to coincide with the patch of bug 1340921 landing.
hi :baku, could you please take a look at this?
Flags: needinfo?(amarchesini)
(Assignee)

Comment 2

a month ago
Created attachment 8859148 [details] [diff] [review]
crash_memoryStream.patch
Assignee: nobody → amarchesini
Flags: needinfo?(amarchesini)
Attachment #8859148 - Flags: review?(kyle)
Attachment #8859148 - Flags: review?(kyle) → review+

Comment 3

a month ago
Pushed by amarchesini@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/603563fad0fe
Better check of PMemoryStream actor creation in Blob code, r=qdot
(Assignee)

Comment 4

a month ago
Comment on attachment 8859148 [details] [diff] [review]
crash_memoryStream.patch

Approval Request Comment
[Feature/Bug causing the regression]: multi-e10s and PBlob
[User impact if declined]: a crash can occur
[Is this code covered by automated tests?]: none. very hard to reproduce.
[Has the fix been verified in Nightly?]: I don't think it's possible to verify.
[Needs manual test from QE? If yes, steps to reproduce]: none
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: I added a null check.
[String changes made/needed]: none
Attachment #8859148 - Flags: approval-mozilla-beta?
Attachment #8859148 - Flags: approval-mozilla-aurora?
Comment on attachment 8859148 [details] [diff] [review]
crash_memoryStream.patch

54 went to Beta today and Aurora's gone.
Attachment #8859148 - Flags: approval-mozilla-aurora?

Comment 6

a month ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/603563fad0fe
Status: NEW → RESOLVED
Last Resolved: a month ago
status-firefox55: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
Comment on attachment 8859148 [details] [diff] [review]
crash_memoryStream.patch

Fix a crash. Beta54+. Should be in 54 beta 1.
Attachment #8859148 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

Comment 8

a month ago
Pushed: https://hg.mozilla.org/releases/mozilla-beta/rev/c8a873cdb79a - Andrea Marchesini - Bug 1356580 - Better check of PMemoryStream actor creation in Blob code, r=qdot. a=gchang
status-firefox54: affected → fixed
You need to log in before you can comment on or make changes to this bug.