1423224 - Hit MOZ_CRASH(Content child abort due to IPC error) at /builds/worker/workspace/build/src/dom/ipc/ContentChild.cpp:2374

Status: RESOLVED WORKSFORME

(Core :: DOM: Web Payments, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev b4cef8d1dff0.

OS|Linux|0.0.0 Linux 4.4.0-98-generic #121-Ubuntu SMP Tue Oct 10 14:24:03 UTC 2017 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::ContentChild::ProcessingError|hg:hg.mozilla.org/mozilla-central:dom/ipc/ContentChild.cpp:b4cef8d1dff0|2374|0x0
0|1|libxul.so|mozilla::ipc::MessageChannel::MaybeHandleError|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:b4cef8d1dff0|2513|0x13
0|2|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:b4cef8d1dff0|2040|0xb
0|3|libxul.so|mozilla::ipc::MessageChannel::RunMessage|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:b4cef8d1dff0|1886|0xb
0|4|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:b4cef8d1dff0|1919|0xc
0|5|libxul.so|mozilla::SchedulerGroup::Runnable::Run|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:b4cef8d1dff0|396|0x1c
0|6|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:b4cef8d1dff0|1033|0x15
0|7|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:b4cef8d1dff0|508|0x11
0|8|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b4cef8d1dff0|97|0xa
0|9|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b4cef8d1dff0|326|0x17
0|10|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b4cef8d1dff0|319|0x8
0|11|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:b4cef8d1dff0|157|0xd
0|12|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b4cef8d1dff0|865|0x11
0|13|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b4cef8d1dff0|269|0x5
0|14|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b4cef8d1dff0|326|0x17
0|15|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b4cef8d1dff0|319|0x8
0|16|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b4cef8d1dff0|691|0x8
0|17|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:b4cef8d1dff0|63|0x14
0|18|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:b4cef8d1dff0|280|0x11
0|19|libc-2.23.so||||0x20830
0|20|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:b4cef8d1dff0|165|0x5

Comment 1

[Henri Sivonen (:hsivonen)]

I can't repro in an ASAN build with e10s enabled and dom.payments.request.enabled set to true.

Comment 2

[Jason Kratzer [:jkratzer]]

(In reply to Henri Sivonen (:hsivonen) from comment #1)
> I can't repro in an ASAN build with e10s enabled and
> dom.payments.request.enabled set to true.

This no longer reproduces for me on the latest m-c.

Comment 3

[Matthew N. [:MattN]]

(In reply to Jason Kratzer [:jkratzer] from comment #2)
> (In reply to Henri Sivonen (:hsivonen) from comment #1)
> > I can't repro in an ASAN build with e10s enabled and
> > dom.payments.request.enabled set to true.
> 
> This no longer reproduces for me on the latest m-c.

Should we resolve this as WORKSFORME then? I'm not sure how you would normally handle this situation.

Comment 4

[Jason Kratzer [:jkratzer]]

(In reply to Matthew N. [:MattN] (PM if requests are blocking you) from comment #3)
> (In reply to Jason Kratzer [:jkratzer] from comment #2)
> > (In reply to Henri Sivonen (:hsivonen) from comment #1)
> > > I can't repro in an ASAN build with e10s enabled and
> > > dom.payments.request.enabled set to true.
> > 
> > This no longer reproduces for me on the latest m-c.
> 
> Should we resolve this as WORKSFORME then? I'm not sure how you would
> normally handle this situation.

That seems fine to me.  I verified that the testcase does reproduce on a build from 2017-12-05 so it looks like this was fixed at some point in the recent past.