1384446 - Crash in mozalloc_abort | NS_DebugBreak | ErrorLoadingSheet

Status: RESOLVED DUPLICATE of bug 1385891

(Core :: Security: Process Sandboxing, defect)

Description

[Chris Peterson [:cpeterson]]

This bug was filed from the Socorro interface and is 
report bp-8f447546-c06d-4886-886d-e20d30170726.
=============================================================

@ Ting-Yu: could this be a regression from your recent fix for bug 1321754? Your fix touched the nsLayoutStylesheetCache::ScrollbarsSheet() function that is in these crash reports' stack traces.

This crash affects both Stylo and non-Stylo users, but there was a spike of almost 200 crash reports in the last 24 hours which is suspicious given recent Stylo changes.

Of the 3537 crash reports with this signature over the last six months, 95% were Windows and 5% were Linux. In contrast, in the last 24 hours, 96% were from Linux and 5% from Windows. Curiously, *none* of the reports from the last six months were from Mac users!

Comment 1

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

This is unlikely to be the regression of bug 1321754 nor related to stylo. Loading scrollbar sheet won't fail unless the file is already broken. It's suspicious that all the crashes are due to loading scrollbar sheet, but the spike might come from the same user though.

Comment 2

[Chris Peterson [:cpeterson]]

Thanks. I'll remove the Stylo label, too. It looks like most of the recent crash reports are from a small number of users.

Comment 3

[Andrew McCreight [:mccr8]]

Haik, does this look like a dupe of bug 1380690?

Comment 4

[Haik Aftandilian [:haik]]

(In reply to Andrew McCreight [:mccr8] from comment #3)
> Haik, does this look like a dupe of bug 1380690?

No, this wouldn't be affected by 1380690 because it's on Linux, but the ErrorLoadingSheet failure is something we had seen on Mac when the repo dir wasn't correctly read-access whitelisted by the sandbox.

And the crash data shows the sandbox level is 3 which was just turned on for Linux. Forwarding the needinfo to gcp to take a look.

The crash metadata shows "Theme: arc-theme" which might be relevant.

Comment 5

[Gian-Carlo Pascutto [:gcp]]

Installing:
https://addons.mozilla.org/en-US/firefox/collections/horst3180/a/

Makes it crash instantly. Maybe a dupe of bug 1385891.

Comment 6

[Gian-Carlo Pascutto [:gcp]]

Confirmed fixed by bug 1385891.

Comment 7

[Chris Peterson [:cpeterson]]

I am moving the crash signature from this bug to the real bug 1385891 so Socorro crash report queries show the correct bug.