1418018 - Crash in u2fhid::platform::{{impl}}::cancel dom/webauthn/u2f-hid-rs/src/macos/transaction.rs:78

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, defect, P1)

Description

[J.C. Jones [:jcj] (he/they)]

This bug was filed from the Socorro interface and is
report bp-0e00ddac-2cf8-4b53-9a29-db7b10171116.
=============================================================

Top 9 frames of crashing thread:

0 CoreFoundation -[NSMutableArray sortUsingComparator:] 
1 XUL u2fhid::platform::{{impl}}::cancel dom/webauthn/u2f-hid-rs/src/macos/transaction.rs:78
2 XUL std::sys_common::backtrace::__rust_begin_short_backtrace<closure, > dom/webauthn/u2f-hid-rs/src/manager.rs:80
3 XUL alloc::boxed::{{impl}}::call_box<, closure> src/libstd/thread/mod.rs:394
4 XUL std::sys::imp::thread::{{impl}}::new::thread_start src/liballoc/boxed.rs:692
5 libsystem_pthread.dylib _pthread_body 
6 libsystem_pthread.dylib _pthread_start 
7 libsystem_pthread.dylib thread_start 
8 XUL XUL@0x43ed3ef 

=============================================================

These two crashes just happened on OSX post-revamp of the OSX code:

https://crash-stats.mozilla.com/report/index/87be440f-2fb0-4e8d-9522-8d6fb0171116 and https://crash-stats.mozilla.com/report/index/0e00ddac-2cf8-4b53-9a29-db7b10171116 

In both cases I was using U2F, one via Github and one via https://demo.yubico.com/u2f , and seemingly after a timeout expired the browser crashed. With Github, I deliberately triggered a re-register with no new tokens attached, so none blinked, and after approximately 15 seconds the browser crashed.

I am guessing this is a side effect of https://hg.mozilla.org/mozilla-central/rev/6fab343d63b66b26b0f42f2c317a3279257f31d9

Comment 1

[J.C. Jones [:jcj] (he/they)]

Patch upstream is https://github.com/jcjones/u2f-hid-rs/commit/c02ac553ca455e6fe06985fe65f59a0c81f196d8

Comment 2

[J.C. Jones [:jcj] (he/they)]

Tim, would you please land your upstream fix into m-c when you have a chance? :) Thanks.

Comment 3

[Tim Taubert [:ttaubert] (inactive)]

Will do. Pushed a small follow-up:

https://github.com/jcjones/u2f-hid-rs/commit/ceede2fd8ee566edbdd47236b4dcfcf13c9cdda8

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/965bc78fe711
[u2f-hid-rs] Use CFRetain() to ensure the CFRunLoop! is kept alive as long as we need it r=jcj

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/965bc78fe711