1426129 - AddressSanitizer: heap-use-after-free near [@ mozilla::camera::PCamerasChild::SendNumberOfCaptureDevices]

Reporter

Description

•

5 years ago

While reducing the testcase for bug 1422820 I routinely hit the following uaf in m-c rev 5572465c08a9.

I have not yet been able to produce a testcase which reliably triggers the uaf but will update if one becomes available.

==3314==ERROR: AddressSanitizer: heap-use-after-free on address 0x6130001b1088 at pc 0x7ff8519356db bp 0x7ff7f775eef0 sp 0x7ff7f775eee8
READ of size 4 at 0x6130001b1088 thread T460 (Cameras IPC)
    #0 0x7ff8519356da in Id /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ipc/ProtocolUtils.h:181:33
    #1 0x7ff8519356da in mozilla::camera::PCamerasChild::SendNumberOfCaptureDevices(mozilla::camera::CaptureEngine const&) /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PCamerasChild.cpp:47
    #2 0x7ff8564eb52c in applyImpl<mozilla::camera::CamerasChild, bool (mozilla::camera::PCamerasChild::*)(const mozilla::camera::CaptureEngine &), StoreCopyPassByConstLRef<mozilla::camera::CaptureEngine> , 0> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1142:12
    #3 0x7ff8564eb52c in apply<mozilla::camera::CamerasChild, bool (mozilla::camera::PCamerasChild::*)(const mozilla::camera::CaptureEngine &)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1148
    #4 0x7ff8564eb52c in mozilla::detail::RunnableMethodImpl<mozilla::camera::CamerasChild*, bool (mozilla::camera::PCamerasChild::*)(mozilla::camera::CaptureEngine const&), false, (mozilla::RunnableKind)0, mozilla::camera::CaptureEngine>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1192
    #5 0x7ff8502c781e in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1033:14
    #6 0x7ff8502e35a0 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:508:10
    #7 0x7ff85115a29f in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:334:20
    #8 0x7ff8510ac839 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #9 0x7ff8510ac839 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #10 0x7ff8510ac839 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #11 0x7ff8502c262e in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:423:11
    #12 0x7ff86c84cd7e in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5
    #13 0x7ff86fe456b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #14 0x7ff86eece3dc in clone /build/glibc-bfm8X4/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

0x6130001b1088 is located 8 bytes inside of 384-byte region [0x6130001b1080,0x6130001b1200)
freed by thread T460 (Cameras IPC) here:
    #0 0x4c2f22 in __interceptor_free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:68:3
    #1 0x7ff851102735 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/CamerasChild.h:152:3
    #2 0x7ff851102735 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:41
    #3 0x7ff851102735 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:398
    #4 0x7ff851102735 in ~RefPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:79
    #5 0x7ff851102735 in mozilla::ipc::BackgroundChildImpl::DeallocPCamerasChild(mozilla::camera::PCamerasChild*) /builds/worker/workspace/build/src/ipc/glue/BackgroundChildImpl.cpp:377
    #6 0x7ff851591ce2 in mozilla::ipc::PBackgroundChild::DeallocSubtree() /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:2898:13
    #7 0x7ff85159427a in mozilla::ipc::PBackgroundChild::OnChannelError() /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:2334:5
    #8 0x7ff851153d6b in mozilla::ipc::MessageChannel::OnNotifyMaybeChannelError() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp
    #9 0x7ff85116b7f4 in applyImpl<mozilla::ipc::MessageChannel, void (mozilla::ipc::MessageChannel::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1142:12
    #10 0x7ff85116b7f4 in apply<mozilla::ipc::MessageChannel, void (mozilla::ipc::MessageChannel::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1148
    #11 0x7ff85116b7f4 in mozilla::detail::RunnableMethodImpl<mozilla::ipc::MessageChannel*, void (mozilla::ipc::MessageChannel::*)(), false, (mozilla::RunnableKind)1>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1192
    #12 0x7ff8502c781e in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1033:14
    #13 0x7ff8502e35a0 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:508:10
    #14 0x7ff85115a295 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:364:5
    #15 0x7ff8510ac839 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #16 0x7ff8510ac839 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #17 0x7ff8510ac839 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #18 0x7ff8502c262e in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:423:11
    #19 0x7ff86c84cd7e in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5
    #20 0x7ff86fe456b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

previously allocated by thread T460 (Cameras IPC) here:
    #0 0x4c3263 in malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3
    #1 0x4f3d2d in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:84:17
    #2 0x7ff85110266f in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:206:12
    #3 0x7ff85110266f in mozilla::ipc::BackgroundChildImpl::AllocPCamerasChild() /builds/worker/workspace/build/src/ipc/glue/BackgroundChildImpl.cpp:361
    #4 0x7ff8515786f5 in mozilla::ipc::PBackgroundChild::SendPCamerasConstructor() /builds/worker/workspace/build/src/obj-firefox/ipc/ipdl/PBackgroundChild.cpp:667:36
    #5 0x7ff8564e9262 in mozilla::camera::InitializeIPCThread::Run() /builds/worker/workspace/build/src/dom/media/systemservices/CamerasChild.cpp:103:76
    #6 0x7ff8503529dd in mozilla::SyncRunnable::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/SyncRunnable.h:112:16
    #7 0x7ff8502c781e in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1033:14
    #8 0x7ff8502e35a0 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:508:10
    #9 0x7ff85115a100 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:334:20
    #10 0x7ff8510ac839 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #11 0x7ff8510ac839 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #12 0x7ff8510ac839 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #13 0x7ff8502c262e in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:423:11
    #14 0x7ff86c84cd7e in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5
    #15 0x7ff86fe456b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Thread T460 (Cameras IPC) created by T253 (MediaManager) here:
    #0 0x4ac5bd in __interceptor_pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:204:3
    #1 0x7ff86c849acf in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:457:14
    #2 0x7ff86c8496be in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:548:12
    #3 0x7ff8502c43f3 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:594:8
    #4 0x7ff8502ccbd1 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:357:22
    #5 0x7ff8502e0dfb in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:134:45
    #6 0x7ff8564c8fd3 in NS_NewNamedThread<12> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:72:10
    #7 0x7ff8564c8fd3 in mozilla::camera::GetCamerasChild() /builds/worker/workspace/build/src/dom/media/systemservices/CamerasChild.cpp:123
    #8 0x7ff856625a2e in GetChildAndCall<int (mozilla::camera::CamerasChild::*)(mozilla::DeviceChangeCallback *), mozilla::MediaEngineWebRTC *> /builds/worker/workspace/build/src/obj-firefox/dist/include/CamerasChild.h:135:25
    #9 0x7ff856625a2e in mozilla::MediaEngineWebRTC::MediaEngineWebRTC(mozilla::MediaEnginePrefs&) /builds/worker/workspace/build/src/dom/media/webrtc/MediaEngineWebRTC.cpp:123
    #10 0x7ff855ff1515 in mozilla::MediaManager::GetBackend(unsigned long) /builds/worker/workspace/build/src/dom/media/MediaManager.cpp:2909:20
    #11 0x7ff856044a55 in operator() /builds/worker/workspace/build/src/dom/media/MediaManager.cpp:1721:30
    #12 0x7ff856044a55 in mozilla::media::LambdaTask<mozilla::MediaManager::EnumerateRawDevices(unsigned long, mozilla::dom::MediaSourceEnum, mozilla::dom::MediaSourceEnum, bool)::$_1>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/media/MediaTaskUtils.h:37
    #13 0x7ff8502c781e in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1033:14
    #14 0x7ff8502e35a0 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:508:10
    #15 0x7ff85115a295 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:364:5
    #16 0x7ff8510ac839 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #17 0x7ff8510ac839 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #18 0x7ff8510ac839 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #19 0x7ff8510cbdaf in base::Thread::ThreadMain() /builds/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:181:16
    #20 0x7ff8510bd81c in ThreadFunc(void*) /builds/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:38:13
    #21 0x7ff86fe456b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Thread T253 (MediaManager) created by T0 (file:// Content) here:
    #0 0x4ac5bd in __interceptor_pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:204:3
    #1 0x7ff8510bb16f in CreateThread /builds/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:135:14
    #2 0x7ff8510bb16f in PlatformThread::Create(unsigned long, PlatformThread::Delegate*, unsigned long*) /builds/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:146
    #3 0x7ff8510cb74f in base::Thread::StartWithOptions(base::Thread::Options const&) /builds/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:99:8
    #4 0x7ff855fe10a8 in mozilla::MediaManager::Get() /builds/worker/workspace/build/src/dom/media/MediaManager.cpp:1865:36
    #5 0x7ff855f03865 in mozilla::dom::MediaDevices::AddEventListener(nsTSubstring<char16_t> const&, mozilla::dom::EventListener*, mozilla::dom::AddEventListenerOptionsOrBoolean const&, mozilla::dom::Nullable<bool> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/media/MediaDevices.cpp:299:3
    #6 0x7ff854f1ab04 in mozilla::dom::EventTargetBinding::addEventListener(JSContext*, JS::Handle<JSObject*>, mozilla::dom::EventTarget*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventTargetBinding.cpp:850:9
    #7 0x7ff854f19a36 in mozilla::dom::EventTargetBinding::genericMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventTargetBinding.cpp:1150:13
    #8 0x7ff85bf89ae1 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:291:15
    #9 0x7ff85bf89ae1 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:473
    #10 0x7ff85bf6fb48 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:528:12
    #11 0x7ff85bf6fb48 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3096
    #12 0x7ff85bf5c2b0 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:12
    #13 0x7ff85bf8c9b1 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:706:15
    #14 0x7ff85bfe0c3a in EvalKernel(JSContext*, JS::Handle<JS::Value>, EvalType, js::AbstractFramePtr, JS::Handle<JSObject*>, unsigned char*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:323:12
    #15 0x7ff85bfe0153 in js::IndirectEval(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Eval.cpp:416:12
    #16 0x238cd5d98af5  (<unknown module>)
    #17 0x6210001ae9f7  (<unknown module>)
    #18 0x238cd5d98ce1  (<unknown module>)
    #19 0x621000203e87  (<unknown module>)
    #20 0x238cd5d314e7  (<unknown module>)
    #21 0x7ff85c202e4b in EnterBaseline /builds/worker/workspace/build/src/js/src/jit/BaselineJIT.cpp:149:9
    #22 0x7ff85c202e4b in js::jit::EnterBaselineAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*) /builds/worker/workspace/build/src/js/src/jit/BaselineJIT.cpp:226
    #23 0x7ff85bf7d984 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2049:28
    #24 0x7ff85bf5c2b0 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:12
    #25 0x7ff85bf8c9b1 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:706:15
    #26 0x7ff85bf8d14f in js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:738:12
    #27 0x7ff85ca97ee6 in ExecuteScript(JSContext*, JS::AutoObjectVector&, JS::Handle<JSScript*>, JS::Value*) /builds/worker/workspace/build/src/js/src/jsapi.cpp:4721:12
    #28 0x7ff8535c5686 in nsJSUtils::ExecutionContext::CompileAndExec(JS::CompileOptions&, JS::SourceBufferHolder&, JS::MutableHandle<JSScript*>) /builds/worker/workspace/build/src/dom/base/nsJSUtils.cpp:266:8
    #29 0x7ff8574052f9 in mozilla::dom::ScriptLoader::EvaluateScript(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:2285:25
    #30 0x7ff857400729 in mozilla::dom::ScriptLoader::ProcessRequest(mozilla::dom::ScriptLoadRequest*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1927:10
    #31 0x7ff8573e2f6a in mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) /builds/worker/workspace/build/src/dom/script/ScriptLoader.cpp:1625:10
    #32 0x7ff8573deee7 in mozilla::dom::ScriptElement::MaybeProcessScript() /builds/worker/workspace/build/src/dom/script/ScriptElement.cpp:147:18
    #33 0x7ff8523b40e6 in AttemptToExecute /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIScriptElement.h:226:18
    #34 0x7ff8523b40e6 in nsHtml5TreeOpExecutor::RunScript(nsIContent*) /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:735
    #35 0x7ff8523ad38d in nsHtml5TreeOpExecutor::RunFlushLoop() /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:539:7
    #36 0x7ff8523b9f9f in nsHtml5ExecutorReflusher::Run() /builds/worker/workspace/build/src/parser/html/nsHtml5TreeOpExecutor.cpp:56:18
    #37 0x7ff8502a0f44 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:396:25
    #38 0x7ff8502c781e in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1033:14
    #39 0x7ff8502e35a0 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:508:10
    #40 0x7ff851158e9a in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21
    #41 0x7ff8510ac839 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #42 0x7ff8510ac839 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #43 0x7ff8510ac839 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #44 0x7ff857590e5a in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:157:27
    #45 0x7ff85bca778b in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:865:22
    #46 0x7ff8510ac839 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #47 0x7ff8510ac839 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #48 0x7ff8510ac839 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #49 0x7ff85bca717d in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:691:34
    #50 0x4f2e8c in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
    #51 0x4f2e8c in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:280
    #52 0x7ff86ede782f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ipc/ProtocolUtils.h:181:33 in Id
Shadow bytes around the buggy address:
  0x0c268002e1c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c268002e1d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c268002e1e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c268002e1f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c268002e200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c268002e210: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c268002e220: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c268002e230: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c268002e240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c268002e250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c268002e260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3314==ABORTING

Daniel Veditz [:dveditz]

Updated

•

5 years ago

Group: core-security → media-core-security

Keywords: csectype-uaf, sec-high

Comment 1

•

5 years ago

It looks like CamerasChild::NumberOfCaptureDevices() creates a runnable with a weak (?) pointer to |this|, so we can end up firing off the runnable after it was destroyed.

Gian-Carlo Pascutto [:gcp]

Comment 2

•

5 years ago

The code contains quite a bit of machinery to make that impossible, but the crash stack shows "mozilla::ipc::PBackgroundChild::OnChannelError()" "mozilla::ipc::BackgroundChildImpl::DeallocPCamerasChild" which probably violates all assumptions about proper shutdown.

Gian-Carlo Pascutto [:gcp]

Comment 3

•

5 years ago

Jesup, can you find an owner? I see there's shutdown work in bug 1428390.

Flags: needinfo?(rjesup)

Gian-Carlo Pascutto [:gcp]

Comment 4

•

5 years ago

https://dxr.mozilla.org/mozilla-central/rev/c38d22170d6f27e94c3c53093215d20255fab27a/dom/media/systemservices/CamerasChild.cpp#279

It's supposed to block while the Runnable executes, but if the IPC channel dies it will give up, e.g:
https://dxr.mozilla.org/mozilla-central/rev/c38d22170d6f27e94c3c53093215d20255fab27a/dom/media/systemservices/CamerasChild.cpp#711

At this point we can't guarantee that the destructor won't run while the Runnables are still outstanding.

Randell Jesup [:jesup] (needinfo me)

Comment 5

•

5 years ago

jib?  Munro?

Flags: needinfo?(rjesup) → needinfo?(jib)

Jan-Ivar Bruaroey [:jib] (needinfo? me)

Comment 6

•

5 years ago

Both Munro and Andreas are on PTO until next week. Needinfo'ing both of them. Also, can someone add me to bug 1422820?

Flags: needinfo?(mchiang)

Flags: needinfo?(jib)

Flags: needinfo?(apehrson)

Jan-Ivar Bruaroey [:jib] (needinfo? me)

Comment 7

•

5 years ago

Looks like same-thread queued runnables not holding `this` alive. CamerasChild is apparently refcountable already [1]. Would promoting `this` to a RefPtr passed to the runnable solve this [2]?

[1] https://searchfox.org/mozilla-central/rev/88439dc6c5b02e167032374071cdc697a056efa1/ipc/glue/BackgroundChildImpl.cpp#372
[2] https://searchfox.org/mozilla-central/rev/03877052c151a8f062eea177f684a2743cd7b1d5/dom/media/systemservices/CamerasChild.cpp#312

Randell Jesup [:jesup] (needinfo me)

Comment 8

•

5 years ago

Quite possibly.... 'this' with lambdas or BlahRunnableFrom/etc is a dangerous pattern unless it's known to be held alive in some other way

Gian-Carlo Pascutto [:gcp]

Comment 9

•

5 years ago

CamerasParent uses this technique throughout:
https://searchfox.org/mozilla-central/rev/88439dc6c5b02e167032374071cdc697a056efa1/dom/media/systemservices/CamerasParent.cpp#212

Note sure why it wasn't used in CamerasChild: https://searchfox.org/mozilla-central/rev/88439dc6c5b02e167032374071cdc697a056efa1/dom/media/systemservices/CamerasChild.h#110

Jan-Ivar Bruaroey [:jib] (needinfo? me)

Updated

•

5 years ago

Rank: 12

Priority: -- → P2

Munro Mengjue Chiang [:mchiang] Be Mozillian since 1/19/2018

Updated

•

5 years ago

Assignee: nobody → mchiang

Flags: needinfo?(mchiang)

Munro Mengjue Chiang [:mchiang] Be Mozillian since 1/19/2018

Comment 10

•

5 years ago

Could you add me into bug 1422820?
I want to verify my wip with the reduced test case.

Flags: needinfo?(jkratzer)

Munro Mengjue Chiang [:mchiang] Be Mozillian since 1/19/2018

Comment 11

•

5 years ago

Attached patch Bug-1426129-hold-CamerasChild-via-promoting-this-to-a-RefPtr.patch — Details — Splinter Review

Attachment #8942830 - Flags: review?(jib)

Munro Mengjue Chiang [:mchiang] Be Mozillian since 1/19/2018

Comment 12

•

5 years ago

https://treeherder.mozilla.org/#/jobs?repo=try&revision=19fc8a449472080242ef036106b994d03a6fd4cb&selectedJob=156531015

Jan-Ivar Bruaroey [:jib] (needinfo? me)

Comment 13

•

5 years ago

Comment on attachment 8942830 [details] [diff] [review]
Bug-1426129-hold-CamerasChild-via-promoting-this-to-a-RefPtr.patch

Review of attachment 8942830 [details] [diff] [review]:
-----------------------------------------------------------------

Lgtm.

Attachment #8942830 - Flags: review?(jib) → review+

Jason Kratzer [:jkratzer]

Reporter

Comment 14

•

5 years ago

(In reply to Munro Mengjue Chiang [:mchiang] from comment #10)
> Could you add me into bug 1422820?
> I want to verify my wip with the reduced test case.

Done.

Jason Kratzer [:jkratzer]

Reporter

Updated

•

5 years ago

Flags: needinfo?(jkratzer)

Munro Mengjue Chiang [:mchiang] Be Mozillian since 1/19/2018

Comment 15

•

5 years ago

Comment on attachment 8942830 [details] [diff] [review]
Bug-1426129-hold-CamerasChild-via-promoting-this-to-a-RefPtr.patch

[Security approval request comment]
How easily could an exploit be constructed based on the patch?
Hard to inject anything of substance

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?

No.

Which older supported branches are affected by this flaw?
all supported branches

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?

backport should be trivial

How likely is this patch to cause regressions; how much testing does it need?
very low. Run fuzzing with domfuzz2.

Attachment #8942830 - Flags: sec-approval?

Al Billings [:abillings - ex-MoCo]

Comment 16

•

5 years ago

This is too late for 58 and this release cycle.

This has sec-approval for checkin on February 6, two weeks into the next cycle. At that point, you should nominate a patch for beta and ESR52 as well.

status-firefox58: --- → wontfix

status-firefox60: --- → affected

status-firefox-esr52: --- → affected

tracking-firefox60: --- → +

tracking-firefox-esr52: --- → ?

Whiteboard: [checkin on 2/6]

Al Billings [:abillings - ex-MoCo]

Updated

•

5 years ago

Attachment #8942830 - Flags: sec-approval? → sec-approval+

Andreas Pehrson [:pehrsons]

Updated

•

5 years ago

Flags: needinfo?(apehrson)

Andreas Pehrson [:pehrsons]

Updated

•

5 years ago

Assignee: bonchiang → apehrson

Status: NEW → ASSIGNED

Nathan Froyd [:froydnj]

Comment 17

•

5 years ago

Wouldn't it be generally simpler and safer to use NS_NewRunnableMethod, so that the runnable is holding a reference to the CamerasChild for the entire lifetime of the runnable, rather than a single reference being held while the runnable is being dispatched?

Comment hidden (obsolete)

(In reply to Nathan Froyd [:froydnj] from comment #17)
> Wouldn't it be generally simpler and safer to use NS_NewRunnableMethod, so
> that the runnable is holding a reference to the CamerasChild for the entire
> lifetime of the runnable, rather than a single reference being held while
> the runnable is being dispatched?

I agree this would be simpler. However with this checkin happening tomorrow I'm leaning towards letting this patch go in as is. I have double checked that all uses of this pattern in this patch captures `self` in the lambda so it's safe. I can do this conversion in a followup that will ride the trains instead.

Ryan VanderMeulen [:RyanVM]

Comment 19

•

5 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/c59fcd67f97923d48aa359643d9bb37ab27e7a0c

This grafts cleanly to Beta as-landed. Please request approval on it when you get a chance. It'll also need a rebased patch for ESR52 (doesn't graft cleanly).

tracking-firefox59: --- → +

tracking-firefox-esr52: ? → 59+

Flags: needinfo?(apehrson)

Whiteboard: [checkin on 2/6]

Andreas Pehrson [:pehrsons]

Comment 20

•

5 years ago

(In reply to Andreas Pehrson [:pehrsons] from comment #18)
> (In reply to Nathan Froyd [:froydnj] from comment #17)
> > Wouldn't it be generally simpler and safer to use NS_NewRunnableMethod, so
> > that the runnable is holding a reference to the CamerasChild for the entire
> > lifetime of the runnable, rather than a single reference being held while
> > the runnable is being dispatched?
> 
> I agree this would be simpler. However with this checkin happening tomorrow
> I'm leaning towards letting this patch go in as is. I have double checked
> that all uses of this pattern in this patch captures `self` in the lambda so
> it's safe. I can do this conversion in a followup that will ride the trains
> instead.

Wait those are not lambda captures. Ugh. This will need a retake.

Andreas Pehrson [:pehrsons]

Comment 21

•

5 years ago

Ok, the landing was backed out anyway. I'm not sure why things failed:
https://hg.mozilla.org/integration/mozilla-inbound/rev/927dfa701c40

So we'll put up a new patch and do the whole cycle all over.

And with me knee deep in a bunch of other issues, Paul will take this one over, in case the android issues seen on try needs further investigation.

Assignee: apehrson → padenot

Flags: needinfo?(apehrson)

Paul Adenot (:padenot)

Assignee

Comment 22

•

5 years ago

This is a double lock, here are annotated stackframes leading to this:

  0  libmozglue.so!mozilla::detail::MutexImpl::lock [Mutex_posix.cpp:74 + 0x0]
  1  libxul.so!mozilla::OffTheBooksMutex::Lock [BlockingResourceBase.cpp:385 + 0x5]
  2  libxul.so!mozilla::BaseAutoLock<mozilla::OffTheBooksMutex>::BaseAutoLock [Mutex.h:166 + 0x3]
  3  libxul.so!mozilla::camera::CamerasChild::~CamerasChild [CamerasChild.cpp:732 + 0x7]
  4  libxul.so!mozilla::camera::CamerasChild::~CamerasChild [CamerasChild.cpp:728 + 0x3]
  5  libxul.so!mozilla::camera::CamerasChild::Release [CamerasChild.h:151 + 0x9]
  6  libxul.so!RefPtr<mozilla::camera::CamerasChild>::~RefPtr [RefPtr.h:41 + 0x3]
  7  libxul.so!mozilla::camera::CamerasChild::ShutdownParent [CamerasChild.cpp: 626 + 0xb]
  8  libxul.so!mozilla::camera::CamerasChild::ShutdownAll [CamerasChild.cpp: 604 + 0x3]
  9  libxul.so!mozilla::camera::Shutdown [CamerasChild.cpp:578 + 0x3]
 10  libxul.so!mozilla::MediaEngineWebRTC::Shutdown [MediaEngineWebRTC.cpp:354 + 0x3]

Stack frame 9 we take the global singleton mutex.
In the dtor of CameraChild (stack frame 3 and below), we are trying to re-acquire this mutex, and it errors out in debug, probably locks up in release builds.

Paul Adenot (:padenot)

Assignee

Comment 23

•

5 years ago

Attached patch Bug 1422820 - Don't recurse too much when shutting down cameras. r?pehrsons — Details — Splinter Review

Gross fix for the above analysis. The whole problem boils down to the fact that this is doing resources management in the dtor, and this should never be the case.

Green on try.

Attachment #8949757 - Flags: review?(apehrson)

Andreas Pehrson [:pehrsons]

Comment 24

•

5 years ago

Comment on attachment 8949757 [details] [diff] [review]
Bug 1422820 - Don't recurse too much when shutting down cameras. r?pehrsons

Review of attachment 8949757 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for fixing this Paul!

Attachment #8949757 - Flags: review?(apehrson) → review+

Paul Adenot (:padenot)

Assignee

Comment 25

•

5 years ago

We already have sec-approval here and we're past the 6th, I'm landing this. Will nominate for the other affected branches a bit later.

Paul Adenot (:padenot)

Assignee

Comment 26

•

5 years ago

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/425d921fee55b5798d45a081c6b504130cec38d3
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/246493ebf8627765eaa25e1ad4ce91c7acff8354

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 27

•

5 years ago

https://hg.mozilla.org/mozilla-central/rev/425d921fee55

Status: ASSIGNED → RESOLVED

Closed: 5 years ago

status-firefox60: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla60

Daniel Veditz [:dveditz]

Updated

•

5 years ago

Group: media-core-security → core-security-release

Ryan VanderMeulen [:RyanVM]

Comment 28

•

5 years ago

Is this ready for uplift requests?

Flags: needinfo?(padenot)

Paul Adenot (:padenot)

Assignee

Comment 29

•

5 years ago

Yes.

Flags: needinfo?(padenot)

Paul Adenot (:padenot)

Assignee

Comment 30

•

5 years ago

Comment on attachment 8942830 [details] [diff] [review]
Bug-1426129-hold-CamerasChild-via-promoting-this-to-a-RefPtr.patch

Approval Request Comment
[Feature/Bug causing the regression]: UAF leading to a crash.
[User impact if declined]: Crash, possible exploit, as often with UAFs.
[Is this code covered by automated tests?]: This crashes during shutdown in some tests we already have.
[Has the fix been verified in Nightly?]: yes
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: The two patches in this bug.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: This has baked on nightly for some time, also it's clearly a programming error (missing lock).
[String changes made/needed]: None.

Attachment #8942830 - Flags: approval-mozilla-beta?

Paul Adenot (:padenot)

Assignee

Comment 31

•

5 years ago

Attached patch Use `NewRunnableMethod` instead of the non-owning variant — Details — Splinter Review

It's unclear how to test this. The attachment in the other bug does not make it crash for me.

Attachment #8953503 - Flags: review?(apehrson)

Andreas Pehrson [:pehrsons]

Comment 32

•

5 years ago

Comment on attachment 8953503 [details] [diff] [review]
Use `NewRunnableMethod` instead of the non-owning variant

Review of attachment 8953503 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/media/systemservices/CamerasChild.cpp
@@ +298,2 @@
>        "camera::PCamerasChild::SendNumberOfCapabilities",
>        self,

Thanks! Note that you no longer need `self` now. Pass the rawptr `this` and it'll be addrefed automatically.

Attachment #8953503 - Flags: review?(apehrson) → review+

Ryan VanderMeulen [:RyanVM]

Comment 33

•

5 years ago

Based on IRC conversation with Andreas, this bug should have been reopened given the ongoing work happening in it. Also, I think a rollup patch for Beta/ESR52 uplifts would be helpful.

Status: RESOLVED → REOPENED

status-firefox60: fixed → affected

Resolution: FIXED → ---

Target Milestone: mozilla60 → ---

Ryan VanderMeulen [:RyanVM]

Comment 34

•

5 years ago

Comment on attachment 8942830 [details] [diff] [review]
Bug-1426129-hold-CamerasChild-via-promoting-this-to-a-RefPtr.patch

Canceling the uplift request for now.

Attachment #8942830 - Flags: approval-mozilla-beta?

Paul Adenot (:padenot)

Assignee

Comment 35

•

5 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/ee3fdd1fb7beb534833a6677733a8fec44e05ec9

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 36

•

5 years ago

https://hg.mozilla.org/mozilla-central/rev/ee3fdd1fb7be

Status: REOPENED → RESOLVED

Closed: 5 years ago → 5 years ago

status-firefox60: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla60

Jason Kratzer [:jkratzer]

Reporter

Comment 37

•

5 years ago

I'm still seeing this as recent as m-c rev b184be598740.

Jason Kratzer [:jkratzer]

Reporter

Updated

•

5 years ago

Status: RESOLVED → REOPENED

Resolution: FIXED → ---

Randell Jesup [:jesup] (needinfo me)

Comment 38

•

5 years ago

FYI

Flags: needinfo?(padenot)

Flags: needinfo?(apehrson)

Paul Adenot (:padenot)

Assignee

Comment 39

•

5 years ago

Jason, can you repro with the same test-case? I've been unsuccessful in doing so, do you do anything specific maybe ?

Flags: needinfo?(padenot) → needinfo?(jkratzer)

Andreas Pehrson [:pehrsons]

Comment 40

•

5 years ago

padenot owns this issue.

Flags: needinfo?(apehrson)

Jason Kratzer [:jkratzer]

Reporter

Comment 41

•

5 years ago

(In reply to Paul Adenot (:padenot) from comment #39)
> Jason, can you repro with the same test-case? I've been unsuccessful in
> doing so, do you do anything specific maybe ?

No.  It appears that the original testcase only triggers the issue in bug 1422820.  I'm trying to find a testcase that reproduces for this issue but don't currently have one.

Flags: needinfo?(jkratzer)

Ryan VanderMeulen [:RyanVM]

Comment 42

•

5 years ago

Given that we seem to all agree that the original testcase is indeed fixed, I think we should re-resolve this bug. Can we move any more follow-ups into a new bug if/when a different testcase is found?

Also, we're extremely low on time to get this fixed in Fx59 and ESR 52.7.0 as both have RC builds coming in the next few days. We could really use roll-up patches and approval requests at this point so we can close this out and not make tracking a pain.

Flags: needinfo?(padenot)

Paul Adenot (:padenot)

Assignee

Comment 43

•

5 years ago

Attached patch rollup-beta.patch (obsolete) — Details — Splinter Review

Approval Request Comment
[Feature/Bug causing the regression]: UAF leading to a crash.
[User impact if declined]: Crash, possible exploit, as often with UAFs.
[Is this code covered by automated tests?]: This crashes during shutdown in some tests we already have.
[Has the fix been verified in Nightly?]: yes, but somehow it can be reproduced in another way but we don't have a test-case.
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: This is a self contained patch that applies to beta.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: Baked for some time, fixes the test cases when running locally.
[String changes made/needed]: None.

Flags: needinfo?(padenot)

Attachment #8956116 - Flags: approval-mozilla-beta?

Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)

Comment 44

•

5 years ago

Comment on attachment 8956116 [details] [diff] [review]
rollup-beta.patch

This is meant for 59, so let's uplift to m-r.

Attachment #8956116 - Flags: approval-mozilla-release+

Attachment #8956116 - Flags: approval-mozilla-beta?

Attachment #8956116 - Flags: approval-mozilla-beta-

Ryan VanderMeulen [:RyanVM]

Updated

•

5 years ago

Status: REOPENED → RESOLVED

Closed: 5 years ago → 5 years ago

Resolution: --- → FIXED

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 45

•

5 years ago

Landed:
https://hg.mozilla.org/releases/mozilla-beta/rev/d613c28bb2fc2771d381e43b3b7f8e25553b50a7 (FIREFOX_59b_RELBRANCH)
https://hg.mozilla.org/releases/mozilla-release/rev/d656aa52e9d6a6bbda825354867f5d9f0bf53cd2

And backed out for crashing in mda's dom/media/tests/mochitest/test_enumerateDevices.html:
https://hg.mozilla.org/releases/mozilla-beta/rev/e633045eb64aa3935340eda5cacfbedcd5d72110 (FIREFOX_59b_RELBRANCH)
https://hg.mozilla.org/releases/mozilla-release/rev/2f6a4d2cf42c9d59626061d45c043817cb220814

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-release&revision=51cb98b0074df774faf333f2b3a2e977e8b97f8c&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-resultStatus=retry&filter-resultStatus=usercancel&filter-resultStatus=runnable

Failure log Android test_enumerateDevices.html: https://treeherder.mozilla.org/logviewer.html#?job_id=166045621&repo=mozilla-release

[task 2018-03-05T19:23:20.071Z] 19:23:20     INFO -  9 INFO None10 INFO TEST-START | dom/media/tests/mochitest/test_enumerateDevices.html
[task 2018-03-05T19:24:11.523Z] 19:24:11     INFO -  INFO | automation.py | Application ran for: 0:04:07.108848
[task 2018-03-05T19:24:11.523Z] 19:24:11     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpm3atWwpidlog
[task 2018-03-05T19:24:12.610Z] 19:24:12     INFO -  mozcrash Copy/paste: /usr/local/bin/linux64-minidump_stackwalk /tmp/tmpOugc90/6221edd3-e7dd-d648-1485-a663aaf41305.dmp /builds/worker/workspace/build/symbols
[task 2018-03-05T19:24:21.648Z] 19:24:21     INFO -  mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/6221edd3-e7dd-d648-1485-a663aaf41305.dmp
[task 2018-03-05T19:24:21.649Z] 19:24:21     INFO -  mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/6221edd3-e7dd-d648-1485-a663aaf41305.extra
[task 2018-03-05T19:24:21.653Z] 19:24:21  WARNING -  PROCESS-CRASH | dom/media/tests/mochitest/test_enumerateDevices.html | application crashed [@ MOZ_CrashOOL]
[task 2018-03-05T19:24:21.653Z] 19:24:21     INFO -  Crash dump filename: /tmp/tmpOugc90/6221edd3-e7dd-d648-1485-a663aaf41305.dmp
[task 2018-03-05T19:24:21.655Z] 19:24:21     INFO -  Operating system: Android
[task 2018-03-05T19:24:21.655Z] 19:24:21     INFO -                    0.0.0 Linux 2.6.29-gea477bb #1 Wed Sep 26 11:04:45 PDT 2012 armv7l
[task 2018-03-05T19:24:21.655Z] 19:24:21     INFO -  CPU: arm
[task 2018-03-05T19:24:21.655Z] 19:24:21     INFO -       ARMv7 ARM Cortex-A8 features: swp,half,thumb,fastmult,vfpv2,edsp,neon,vfpv3
[task 2018-03-05T19:24:21.655Z] 19:24:21     INFO -       1 CPU
[task 2018-03-05T19:24:21.655Z] 19:24:21     INFO -  GPU: UNKNOWN
[task 2018-03-05T19:24:21.655Z] 19:24:21     INFO -  Crash reason:  SIGSEGV
[task 2018-03-05T19:24:21.655Z] 19:24:21     INFO -  Crash address: 0x0
[task 2018-03-05T19:24:21.656Z] 19:24:21     INFO -  Process uptime: not available
[task 2018-03-05T19:24:21.656Z] 19:24:21     INFO -  Thread 62 (crashed)
[task 2018-03-05T19:24:21.656Z] 19:24:21     INFO -   0  libmozglue.so!MOZ_CrashOOL [Assertions.cpp:51cb98b0074d : 33 + 0x0]
[task 2018-03-05T19:24:21.656Z] 19:24:21     INFO -       r0 = 0x00000000    r1 = 0x5a7d2ebe    r2 = 0x5e4201b7    r3 = 0x0000002e
[task 2018-03-05T19:24:21.656Z] 19:24:21     INFO -       r4 = 0x5e466dcd    r5 = 0x0000002e    r6 = 0x687041c0    r7 = 0x53bffb48
[task 2018-03-05T19:24:21.656Z] 19:24:21     INFO -       r8 = 0x53bffbd0    r9 = 0x5b890b51   r10 = 0x59af3b44   r12 = 0x00000003
[task 2018-03-05T19:24:21.657Z] 19:24:21     INFO -       fp = 0x53bffcf8    sp = 0x53bffb40    lr = 0x52783cf9    pc = 0x52798304
[task 2018-03-05T19:24:21.657Z] 19:24:21     INFO -      Found by: given as instruction pointer in context
[task 2018-03-05T19:24:21.657Z] 19:24:21     INFO -   1  libxul.so!nsAutoOwningThread::AssertCurrentThreadOwnsMe [nsISupportsImpl.cpp:51cb98b0074d : 46 + 0xb]
[task 2018-03-05T19:24:21.657Z] 19:24:21     INFO -       r4 = 0x5e466dcd    r5 = 0x55a8ff80    r6 = 0x687041c0    r7 = 0x53bffb58
[task 2018-03-05T19:24:21.658Z] 19:24:21     INFO -       r8 = 0x53bffbd0    r9 = 0x5b890b51   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.658Z] 19:24:21     INFO -       sp = 0x53bffb50    lr = 0x5b2fc963    pc = 0x5b2fc963
[task 2018-03-05T19:24:21.658Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.659Z] 19:24:21     INFO -   2  libxul.so!mozilla::camera::CamerasChild::AddRef [nsISupportsImpl.h:51cb98b0074d : 69 + 0x5]
[task 2018-03-05T19:24:21.659Z] 19:24:21     INFO -       r4 = 0x55624c50    r5 = 0x53bffbf4    r6 = 0x687041c0    r7 = 0x53bffb68
[task 2018-03-05T19:24:21.659Z] 19:24:21     INFO -       r8 = 0x53bffbd0    r9 = 0x5b890b51   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.659Z] 19:24:21     INFO -       sp = 0x53bffb60    lr = 0x5b66dc3f    pc = 0x5b66dc3f
[task 2018-03-05T19:24:21.660Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.660Z] 19:24:21     INFO -   3  libxul.so!RefPtr<mozilla::camera::CamerasChild>::RefPtr [RefPtr.h:51cb98b0074d : 38 + 0x5]
[task 2018-03-05T19:24:21.660Z] 19:24:21     INFO -       r4 = 0x687041d0    r5 = 0x53bffbf4    r6 = 0x687041c0    r7 = 0x53bffb78
[task 2018-03-05T19:24:21.661Z] 19:24:21     INFO -       r8 = 0x53bffbd0    r9 = 0x5b890b51   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.661Z] 19:24:21     INFO -       sp = 0x53bffb70    lr = 0x5b66d04b    pc = 0x5b66d04b
[task 2018-03-05T19:24:21.661Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.662Z] 19:24:21     INFO -   4  libxul.so!mozilla::detail::RunnableMethodImpl<mozilla::camera::CamerasChild *, bool (mozilla::camera::PCamerasChild::*)(const mozilla::camera::CaptureEngine &), true, mozilla::RunnableKind::Standard, mozilla::camera::CaptureEngine>::RunnableMethodImpl<mozilla::camera::CamerasChild *, mozilla::camera::CaptureEngine &> [nsThreadUtils.h:51cb98b0074d : 737 + 0x3]
[task 2018-03-05T19:24:21.662Z] 19:24:21     INFO -       r4 = 0x5b890b51    r5 = 0x53bffbf4    r6 = 0x687041c0    r7 = 0x53bffb90
[task 2018-03-05T19:24:21.662Z] 19:24:21     INFO -       r8 = 0x53bffbd0    r9 = 0x5b890b51   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.662Z] 19:24:21     INFO -       sp = 0x53bffb80    lr = 0x5c5d736b    pc = 0x5c5d736b
[task 2018-03-05T19:24:21.663Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.663Z] 19:24:21     INFO -   5  libxul.so!mozilla::NewRunnableMethod<mozilla::camera::CaptureEngine, mozilla::camera::CamerasChild *, bool (mozilla::camera::PCamerasChild::*)(const mozilla::camera::CaptureEngine &), mozilla::camera::CaptureEngine &> [nsThreadUtils.h:51cb98b0074d : 1477 + 0xf]
[task 2018-03-05T19:24:21.663Z] 19:24:21     INFO -       r4 = 0x687041c0    r5 = 0x53bffbf4    r6 = 0x5c5d0924    r7 = 0x53bffbc0
[task 2018-03-05T19:24:21.663Z] 19:24:21     INFO -       r8 = 0x53bffbd0    r9 = 0x5b890b51   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.664Z] 19:24:21     INFO -       sp = 0x53bffb98    lr = 0x5c5d0ce5    pc = 0x5c5d0ce5
[task 2018-03-05T19:24:21.664Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.664Z] 19:24:21     INFO -   6  libxul.so!mozilla::camera::CamerasChild::EnsureInitialized [CamerasChild.cpp:51cb98b0074d : 339 + 0xb]
[task 2018-03-05T19:24:21.665Z] 19:24:21     INFO -       r4 = 0x53bffbd0    r5 = 0x55624c50    r6 = 0x53bffbf4    r7 = 0x53bffc18
[task 2018-03-05T19:24:21.665Z] 19:24:21     INFO -       r8 = 0x53bffc5c    r9 = 0x00000000   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.665Z] 19:24:21     INFO -       sp = 0x53bffbc8    lr = 0x5c5d08cd    pc = 0x5c5d08cd
[task 2018-03-05T19:24:21.665Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.666Z] 19:24:21     INFO -   7  libxul.so!mozilla::camera::CamerasChild::AddDeviceChangeCallback [CamerasChild.cpp:51cb98b0074d : 171 + 0x7]
[task 2018-03-05T19:24:21.666Z] 19:24:21     INFO -       r4 = 0x55a8fc80    r5 = 0x55624c50    r6 = 0x53bffc60    r7 = 0x53bffc28
[task 2018-03-05T19:24:21.666Z] 19:24:21     INFO -       r8 = 0x53bffc5c    r9 = 0x53bffd87   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.669Z] 19:24:21     INFO -       sp = 0x53bffc20    lr = 0x5c5d0893    pc = 0x5c5d0893
[task 2018-03-05T19:24:21.669Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.669Z] 19:24:21     INFO -   8  libxul.so!mozilla::camera::GetChildAndCall<int (mozilla::camera::CamerasChild::*)(mozilla::DeviceChangeCallback *), mozilla::MediaEngineWebRTC *> + 0x47
[task 2018-03-05T19:24:21.669Z] 19:24:21     INFO -       r4 = 0x53bffc34    r5 = 0xffffffff    r6 = 0x53bffc60    r7 = 0x53bffc50
[task 2018-03-05T19:24:21.669Z] 19:24:21     INFO -       r8 = 0x53bffc5c    r9 = 0x53bffd87   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.670Z] 19:24:21     INFO -       sp = 0x53bffc30    lr = 0x5c60d43d    pc = 0x5c60d43d
[task 2018-03-05T19:24:21.670Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.670Z] 19:24:21     INFO -   9  libxul.so!mozilla::MediaEngineWebRTC::MediaEngineWebRTC [MediaEngineWebRTC.cpp:51cb98b0074d : 122 + 0x3]
[task 2018-03-05T19:24:21.670Z] 19:24:21     INFO -       r4 = 0x55a8fc80    r5 = 0x55a8fcc7    r6 = 0x53bffc6c    r7 = 0x53bffc80
[task 2018-03-05T19:24:21.670Z] 19:24:21     INFO -       r8 = 0x59d41cc0    r9 = 0x53bffd87   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.670Z] 19:24:21     INFO -       sp = 0x53bffc58    lr = 0x5c60d39f    pc = 0x5c60d39f
[task 2018-03-05T19:24:21.670Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.670Z] 19:24:21     INFO -  10  libxul.so!mozilla::MediaManager::GetBackend [MediaManager.cpp:51cb98b0074d : 2916 + 0x3]
[task 2018-03-05T19:24:21.670Z] 19:24:21     INFO -       r4 = 0x68858740    r5 = 0x688587f8    r6 = 0x55a8fc80    r7 = 0x53bffc98
[task 2018-03-05T19:24:21.671Z] 19:24:21     INFO -       r8 = 0x59d41cc0    r9 = 0x53bffd87   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.671Z] 19:24:21     INFO -       sp = 0x53bffc88    lr = 0x5c500655    pc = 0x5c500655
[task 2018-03-05T19:24:21.671Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.671Z] 19:24:21     INFO -  11  libxul.so!mozilla::media::LambdaTask<(lambda at /builds/worker/workspace/build/src/dom/media/MediaManager.cpp:1711:39)>::Run [MediaManager.cpp:51cb98b0074d : 1723 + 0x3]
[task 2018-03-05T19:24:21.671Z] 19:24:21     INFO -       r4 = 0x59af3b30    r5 = 0x53bffcf8    r6 = 0x00000001    r7 = 0x53bffce0
[task 2018-03-05T19:24:21.672Z] 19:24:21     INFO -       r8 = 0x59d41cc0    r9 = 0x53bffd87   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.672Z] 19:24:21     INFO -       sp = 0x53bffca0    lr = 0x5c510a35    pc = 0x5c510a35
[task 2018-03-05T19:24:21.672Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.673Z] 19:24:21     INFO -  12  libxul.so!mozilla::media::LambdaTask<(lambda at /builds/worker/workspace/build/src/dom/media/MediaManager.cpp:3258:40)>::Run [MediaManager.cpp:51cb98b0074d : 3259 + 0x5]
[task 2018-03-05T19:24:21.673Z] 19:24:21     INFO -       r4 = 0x59af3b30    r5 = 0x53bffcf8    r6 = 0x00000001    r7 = 0x53bffce8
[task 2018-03-05T19:24:21.673Z] 19:24:21     INFO -       r8 = 0x00000001    r9 = 0x53bffd87   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.674Z] 19:24:21     INFO -       sp = 0x53bffce8    lr = 0x5c513655    pc = 0x5c513655
[task 2018-03-05T19:24:21.674Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.674Z] 19:24:21     INFO -  13  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp:51cb98b0074d : 1040 + 0x5]
[task 2018-03-05T19:24:21.674Z] 19:24:21     INFO -       r4 = 0x59af3b30    r5 = 0x53bffcf8    r6 = 0x00000001    r7 = 0x53bffd78
[task 2018-03-05T19:24:21.674Z] 19:24:21     INFO -       r8 = 0x00000001    r9 = 0x53bffd87   r10 = 0x59af3b44    fp = 0x53bffcf8
[task 2018-03-05T19:24:21.675Z] 19:24:21     INFO -       sp = 0x53bffcf0    lr = 0x5b34db09    pc = 0x5b34db09
[task 2018-03-05T19:24:21.675Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.675Z] 19:24:21     INFO -  14  libxul.so!NS_ProcessNextEvent [nsThreadUtils.cpp:51cb98b0074d : 517 + 0xd]
[task 2018-03-05T19:24:21.676Z] 19:24:21     INFO -       r4 = 0x00000001    r5 = 0x59af3b30    r6 = 0x00000000    r7 = 0x53bffd98
[task 2018-03-05T19:24:21.676Z] 19:24:21     INFO -       r8 = 0x5598fa7c    r9 = 0x59af3b30   r10 = 0x5598fa70    fp = 0x2a36c198
[task 2018-03-05T19:24:21.676Z] 19:24:21     INFO -       sp = 0x53bffd80    lr = 0x5b354c81    pc = 0x5b354c81
[task 2018-03-05T19:24:21.676Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.677Z] 19:24:21     INFO -  15  libxul.so!mozilla::ipc::MessagePumpForNonMainThreads::Run [MessagePump.cpp:51cb98b0074d : 364 + 0x7]
[task 2018-03-05T19:24:21.677Z] 19:24:21     INFO -       r4 = 0x5598fa60    r5 = 0x53bffe18    r6 = 0x00000000    r7 = 0x53bffdc0
[task 2018-03-05T19:24:21.677Z] 19:24:21     INFO -       r8 = 0x5598fa7c    r9 = 0x59af3b30   r10 = 0x5598fa70    fp = 0x2a36c198
[task 2018-03-05T19:24:21.677Z] 19:24:21     INFO -       sp = 0x53bffda0    lr = 0x5b6823a9    pc = 0x5b6823a9
[task 2018-03-05T19:24:21.678Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.678Z] 19:24:21     INFO -  16  libxul.so!MessageLoop::RunInternal [message_loop.cc:51cb98b0074d : 326 + 0x7]
[task 2018-03-05T19:24:21.678Z] 19:24:21     INFO -       r4 = 0x53bffe18    r5 = 0x5973def4    r6 = 0x00000005    r7 = 0x53bffde0
[task 2018-03-05T19:24:21.679Z] 19:24:21     INFO -       r8 = 0x53bffe18    r9 = 0x53b00000   r10 = 0x53bfff00    fp = 0x2a36c198
[task 2018-03-05T19:24:21.679Z] 19:24:21     INFO -       sp = 0x53bffdc8    lr = 0x5b63e105    pc = 0x5b63e105
[task 2018-03-05T19:24:21.679Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.680Z] 19:24:21     INFO -  17  libxul.so!MessageLoop::Run [message_loop.cc:51cb98b0074d : 319 + 0x5]
[task 2018-03-05T19:24:21.680Z] 19:24:21     INFO -       r0 = 0x53bffe18    r1 = 0x00000000    r2 = 0x00000001    r3 = 0x000003c2
[task 2018-03-05T19:24:21.680Z] 19:24:21     INFO -       r4 = 0x53bffe18    r5 = 0x5973def4    r6 = 0x00000005    r7 = 0x53bffe00
[task 2018-03-05T19:24:21.680Z] 19:24:21     INFO -       r8 = 0x53bffe18    r9 = 0x53b00000   r10 = 0x53bfff00    fp = 0x2a36c198
[task 2018-03-05T19:24:21.680Z] 19:24:21     INFO -       sp = 0x53bffde8    lr = 0x5b63e0b3    pc = 0x5b63e0b3
[task 2018-03-05T19:24:21.681Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.681Z] 19:24:21     INFO -  18  libxul.so!base::Thread::ThreadMain [thread.cc:51cb98b0074d : 181 + 0x5]
[task 2018-03-05T19:24:21.681Z] 19:24:21     INFO -       r0 = 0x00000001    r1 = 0x00000000    r2 = 0x53bffe18    r3 = 0x00000000
[task 2018-03-05T19:24:21.681Z] 19:24:21     INFO -       r4 = 0x5973dee0    r5 = 0x5973def4    r6 = 0x00000005    r7 = 0x53bffed8
[task 2018-03-05T19:24:21.681Z] 19:24:21     INFO -       r8 = 0x53bffe18    r9 = 0x53b00000   r10 = 0x53bfff00    fp = 0x2a36c198
[task 2018-03-05T19:24:21.681Z] 19:24:21     INFO -       sp = 0x53bffe08    lr = 0x5b64930f    pc = 0x5b64930f
[task 2018-03-05T19:24:21.681Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.681Z] 19:24:21     INFO -  19  libxul.so!ThreadFunc [platform_thread_posix.cc:51cb98b0074d : 38 + 0x5]
[task 2018-03-05T19:24:21.682Z] 19:24:21     INFO -       r4 = 0x53bfff00    r5 = 0x2a36c198    r6 = 0x5b641787    r7 = 0x53bffee0
[task 2018-03-05T19:24:21.682Z] 19:24:21     INFO -       r8 = 0x5973dee8    r9 = 0x53b00000   r10 = 0x53bfff00    fp = 0x2a36c198
[task 2018-03-05T19:24:21.682Z] 19:24:21     INFO -       sp = 0x53bffee0    lr = 0x5b641791    pc = 0x5b641791
[task 2018-03-05T19:24:21.682Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.683Z] 19:24:21     INFO -  20  libc.so + 0xca5a
[task 2018-03-05T19:24:21.683Z] 19:24:21     INFO -       r4 = 0x53bfff00    r5 = 0x2a36c198    r6 = 0x5b641787    r7 = 0x5973dee0
[task 2018-03-05T19:24:21.683Z] 19:24:21     INFO -       r8 = 0x5973dee8    r9 = 0x53b00000   r10 = 0x53bfff00    fp = 0x2a36c198
[task 2018-03-05T19:24:21.683Z] 19:24:21     INFO -       sp = 0x53bffee8    lr = 0x40033a5c    pc = 0x40033a5c
[task 2018-03-05T19:24:21.683Z] 19:24:21     INFO -      Found by: call frame info
[task 2018-03-05T19:24:21.683Z] 19:24:21     INFO -  21  libc.so + 0xcbd6
[task 2018-03-05T19:24:21.685Z] 19:24:21     INFO -       sp = 0x53bfff00    pc = 0x40033bd8
[task 2018-03-05T19:24:21.685Z] 19:24:21     INFO -      Found by: stack scanning
[task 2018-03-05T19:24:21.685Z] 19:24:21     INFO -  22  dalvik-jit-code-cache (deleted) + 0x2debc
[task 2018-03-05T19:24:21.685Z] 19:24:21     INFO -       sp = 0x53bfff18    pc = 0x5a7d2ebe
[task 2018-03-05T19:24:21.685Z] 19:24:21     INFO -      Found by: stack scanning


On Linux dom/media/tests/mochitest/test_fingerprinting_resistance.html fails: https://treeherder.mozilla.org/logviewer.html#?job_id=166047160&repo=mozilla-release Might be the same reason.

Flags: needinfo?(padenot)

Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)

Comment 46

•

5 years ago

We may need to wontfix this for 59. 

dveditz, is that ok with you or should we push to get this into RC2? 
Can it wait for either a dot release, or for 60?

Flags: needinfo?(dveditz)

Al Billings [:abillings - ex-MoCo]

Comment 47

•

5 years ago

I'd suggest 60. Even in a dot release, if we're not ready to take this now, would it really be something we'd want to add to a chemspill?

Randell Jesup [:jesup] (needinfo me)

Updated

•

5 years ago

Flags: needinfo?(jib)

Daniel Veditz [:dveditz]

Comment 48

•

5 years ago

Agree with Al: if it's dodgy for 59.0 with a week to go we should not consider dropping it into a point release!

status-firefox59: affected → wontfix

tracking-firefox-esr52: 59+ → 60+

Flags: needinfo?(dveditz)

Paul Adenot (:padenot)

Assignee

Comment 49

•

5 years ago

No panic, I had just missed that the old branch was having non-thread safe addref and release. Here is a push with it added:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e5c3da3ae3ca4aeeac77b609dea8c4924f6ff754

Flags: needinfo?(padenot)

Paul Adenot (:padenot)

Assignee

Comment 50

•

5 years ago

Attached patch rollup witht the threadsafe addref/release — Details — Splinter Review

Attachment #8956116 - Attachment is obsolete: true

Attachment #8956534 - Flags: approval-mozilla-release?

Paul Adenot (:padenot)

Assignee

Comment 51

•

5 years ago

Liz, your call if you want to take this new one, try looks good and the reason for the failures is pretty obvious. Obviously it should have been caught locally but time is a bit tight as minute.

Flags: needinfo?(lhenry)

Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)

Comment 52

•

5 years ago

Comment on attachment 8956534 [details] [diff] [review]
rollup witht the threadsafe addref/release

With a lot of issues in flux right now that we can't avoid, I'd like to stick with this landing for 60. We actually would have more time in a dot release (not a chemspill) situation for landing and testing this than we do now. Right now for the RC2, anything extra we try to land adds a risk of delaying the release.

Flags: needinfo?(lhenry)

Attachment #8956534 - Flags: approval-mozilla-release? → approval-mozilla-release-

Ryan VanderMeulen [:RyanVM]

Updated

•

5 years ago

Attachment #8956116 - Flags: approval-mozilla-release+

Jan-Ivar Bruaroey [:jib] (needinfo? me)

Updated

•

5 years ago

Flags: needinfo?(jib)

Ryan VanderMeulen [:RyanVM]

Comment 53

•

5 years ago

Did we ever determine whether or not ESR52 is really affected?

Flags: needinfo?(padenot)

Paul Adenot (:padenot)

Assignee

Comment 54

•

5 years ago

The logic has been changed a lot since then, I'd be surprised if it were the case.

Flags: needinfo?(padenot)

Ryan VanderMeulen [:RyanVM]

Comment 55

•

5 years ago

Per IRC discussion with Paul, it appears that ESR52 is in fact affected by virtue of bug 1336510. NI him for a rebased patch for 52.8.0 uplift.

Flags: needinfo?(padenot)

Paul Adenot (:padenot)

Assignee

Comment 56

•

5 years ago

Attached patch Patch for esr52 (obsolete) — Details — Splinter Review

Slight adjustments were needed because of changes in NonOwningRunnableMethod.

Andreas, can you double check this?

Flags: needinfo?(padenot)

Attachment #8968207 - Flags: review?(apehrson)

Paul Adenot (:padenot)

Assignee

Updated

•

5 years ago

Attachment #8968207 - Attachment is patch: true

Andreas Pehrson [:pehrsons]

Comment 57

•

5 years ago

Comment on attachment 8968207 [details] [diff] [review]
Patch for esr52

Review of attachment 8968207 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/media/systemservices/CamerasChild.cpp
@@ +286,5 @@
>  {
>    LOG((__PRETTY_FUNCTION__));
>    LOG(("NumberOfCapabilities for %s", deviceUniqueIdUTF8));
>    nsCString unique_id(deviceUniqueIdUTF8);
> +  RefPtr<CamerasChild> self = this;

Addrefing here doesn't help when the runnable methods are non-owning, see comment 31, etc.

Skip this addref and make the runnables own the instance they'll be running on instead.

Attachment #8968207 - Flags: review?(apehrson) → review-

Al Billings [:abillings - ex-MoCo]

Comment 58

•

5 years ago

(In reply to Andreas Pehrson [:pehrsons] from comment #57)
> Comment on attachment 8968207 [details] [diff] [review]
> Patch for esr52
> 
> Review of attachment 8968207 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: dom/media/systemservices/CamerasChild.cpp
> @@ +286,5 @@
> >  {
> >    LOG((__PRETTY_FUNCTION__));
> >    LOG(("NumberOfCapabilities for %s", deviceUniqueIdUTF8));
> >    nsCString unique_id(deviceUniqueIdUTF8);
> > +  RefPtr<CamerasChild> self = this;
> 
> Addrefing here doesn't help when the runnable methods are non-owning, see
> comment 31, etc.
> 
> Skip this addref and make the runnables own the instance they'll be running
> on instead.

This appears to not be in the ESR52 release now, which ships next week.

Flags: needinfo?(padenot)

Paul Adenot (:padenot)

Assignee

Comment 59

•

5 years ago

Attached patch patch-esr52 — Details — Splinter Review

Attachment #8968207 - Attachment is obsolete: true

Flags: needinfo?(padenot)

Attachment #8971552 - Flags: review?(apehrson)

Andreas Pehrson [:pehrsons]

Updated

•

5 years ago

Attachment #8971552 - Flags: review?(apehrson) → review+

Paul Adenot (:padenot)

Assignee

Comment 60

•

5 years ago

For people following along, comment 11 is half-correct half-incorrect,  because the calls to LockAndDispatch waits synchronously for a reply from the parent process, so we're good here, simply addreffing in the scope works.

Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)

Comment 61

•

5 years ago

Can you request uplift to esr52? Thanks.

Flags: needinfo?(padenot)

Paul Adenot (:padenot)

Assignee

Comment 62

•

5 years ago

Comment on attachment 8971552 [details] [diff] [review]
patch-esr52

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration: N/A
User impact if declined: crash
Fix Landed on Version: All other versions
Risk to taking this patch (and alternatives if risky): Well tested, and landed everywhere
String or UUID changes made by this patch: None

See https://wiki.mozilla.org/Release_Management/ESR_Landing_Process for more info.

Flags: needinfo?(padenot)

Attachment #8971552 - Flags: approval-mozilla-esr52?

Ryan VanderMeulen [:RyanVM]

Comment 63

•

5 years ago

Comment on attachment 8971552 [details] [diff] [review]
patch-esr52

Approved for ESR 52.8.0. Thanks for doing the rebase, Paul!

Attachment #8971552 - Flags: approval-mozilla-esr52? → approval-mozilla-esr52+

Ryan VanderMeulen [:RyanVM]

Comment 64

•

5 years ago

uplift

https://hg.mozilla.org/releases/mozilla-esr52/rev/3f2ec03c0405

status-firefox-esr52: affected → fixed

Al Billings [:abillings - ex-MoCo]

Updated

•

5 years ago

Whiteboard: [adv-main60+][adv-esr52.8+]

Andrei Vaida [:avaida]

Updated

•

5 years ago

Flags: qe-verify-

Whiteboard: [adv-main60+][adv-esr52.8+] → [adv-main60+][adv-esr52.8+][post-critsmash-triage]

Daniel Veditz [:dveditz]

Updated

•

5 years ago

Group: core-security-release

Sylvestre Ledru [:Sylvestre]

Updated

•

3 years ago

Blocks: asan-maintenance

Bug-1426129-hold-CamerasChild-via-promoting-this-to-a-RefPtr.patch 5 years ago Munro Mengjue Chiang [:mchiang] Be Mozillian since 1/19/2018 5.99 KB, patch	jib : review+ abillings : sec-approval+	Details \| Diff \| Splinter Review
Bug 1422820 - Don't recurse too much when shutting down cameras. r?pehrsons 5 years ago Paul Adenot (:padenot) 3.81 KB, patch	pehrsons : review+	Details \| Diff \| Splinter Review
Use `NewRunnableMethod` instead of the non-owning variant 5 years ago Paul Adenot (:padenot) 8.14 KB, patch	pehrsons : review+	Details \| Diff \| Splinter Review
rollup-beta.patch 5 years ago Paul Adenot (:padenot) 11.04 KB, patch	lizzard : approval-mozilla-beta-	Details \| Diff \| Splinter Review
rollup witht the threadsafe addref/release 5 years ago Paul Adenot (:padenot) 11.99 KB, patch	lizzard : approval-mozilla-release-	Details \| Diff \| Splinter Review
Patch for esr52 5 years ago Paul Adenot (:padenot) 11.61 KB, patch	pehrsons : review-	Details \| Diff \| Splinter Review
patch-esr52 5 years ago Paul Adenot (:padenot) 10.49 KB, patch	pehrsons : review+ RyanVM : approval-mozilla-esr52+	Details \| Diff \| Splinter Review