1436759 - Intermittent SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/media/mtransport/sigslot.h:2007:11 in sigslot::_connection4<mozilla::TransportLayerIce, mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::si

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Reporter

Description

•

7 years ago

https://treeherder.mozilla.org/logviewer.html#?job_id=161029003&repo=autoland [task 2018-02-08T05:39:27.458Z] 05:39:27 INFO - TEST-START | TransportTest.TestTransferIceMultiple [task 2018-02-08T05:39:27.466Z] 05:39:27 INFO - Got candidate candidate:0 1 UDP 2122121471 127.0.0.1 42306 typ host [task 2018-02-08T05:39:27.466Z] 05:39:27 INFO - Got candidate candidate:2 1 UDP 2122252543 172.17.0.4 59682 typ host [task 2018-02-08T05:39:27.467Z] 05:39:27 INFO - Got candidate candidate:4 1 UDP 2122187007 ::1 60001 typ host [task 2018-02-08T05:39:27.467Z] 05:39:27 INFO - Got candidate candidate:6 1 TCP 2105377023 127.0.0.1 55942 typ host tcptype passive [task 2018-02-08T05:39:27.467Z] 05:39:27 INFO - Got candidate candidate:6 1 TCP 2105393407 127.0.0.1 9 typ host tcptype active [task 2018-02-08T05:39:27.468Z] 05:39:27 INFO - Got candidate candidate:6 1 TCP 2105360639 127.0.0.1 63121 typ host tcptype so [task 2018-02-08T05:39:27.468Z] 05:39:27 INFO - Got candidate candidate:7 1 TCP 2105508095 172.17.0.4 51636 typ host tcptype passive [task 2018-02-08T05:39:27.468Z] 05:39:27 INFO - Got candidate candidate:7 1 TCP 2105524479 172.17.0.4 9 typ host tcptype active [task 2018-02-08T05:39:27.468Z] 05:39:27 INFO - Got candidate candidate:7 1 TCP 2105491711 172.17.0.4 61147 typ host tcptype so [task 2018-02-08T05:39:27.469Z] 05:39:27 INFO - Got candidate candidate:8 1 TCP 2105442559 ::1 59030 typ host tcptype passive [task 2018-02-08T05:39:27.469Z] 05:39:27 INFO - Got candidate candidate:8 1 TCP 2105458943 ::1 9 typ host tcptype active [task 2018-02-08T05:39:27.469Z] 05:39:27 INFO - Got candidate candidate:8 1 TCP 2105426175 ::1 50644 typ host tcptype so [task 2018-02-08T05:39:27.470Z] 05:39:27 INFO - Got candidate candidate:0 1 UDP 2122121471 127.0.0.1 42842 typ host [task 2018-02-08T05:39:27.470Z] 05:39:27 INFO - Got candidate candidate:2 1 UDP 2122252543 172.17.0.4 60610 typ host [task 2018-02-08T05:39:27.470Z] 05:39:27 INFO - Got candidate candidate:4 1 UDP 2122187007 ::1 41562 typ host [task 2018-02-08T05:39:27.471Z] 05:39:27 INFO - Got candidate candidate:6 1 TCP 2105377023 127.0.0.1 58862 typ host tcptype passive [task 2018-02-08T05:39:27.471Z] 05:39:27 INFO - Got candidate candidate:6 1 TCP 2105393407 127.0.0.1 9 typ host tcptype active [task 2018-02-08T05:39:27.471Z] 05:39:27 INFO - Got candidate candidate:6 1 TCP 2105360639 127.0.0.1 59670 typ host tcptype so [task 2018-02-08T05:39:27.471Z] 05:39:27 INFO - Got candidate candidate:7 1 TCP 2105508095 172.17.0.4 62227 typ host tcptype passive [task 2018-02-08T05:39:27.472Z] 05:39:27 INFO - Got candidate candidate:7 1 TCP 2105524479 172.17.0.4 9 typ host tcptype active [task 2018-02-08T05:39:27.472Z] 05:39:27 INFO - Got candidate candidate:7 1 TCP 2105491711 172.17.0.4 58712 typ host tcptype so [task 2018-02-08T05:39:27.472Z] 05:39:27 INFO - Got candidate candidate:8 1 TCP 2105442559 ::1 58730 typ host tcptype passive [task 2018-02-08T05:39:27.473Z] 05:39:27 INFO - Got candidate candidate:8 1 TCP 2105458943 ::1 9 typ host tcptype active [task 2018-02-08T05:39:27.473Z] 05:39:27 INFO - Got candidate candidate:8 1 TCP 2105426175 ::1 63527 typ host tcptype so [task 2018-02-08T05:39:27.590Z] 05:39:27 INFO - Now connected [task 2018-02-08T05:39:27.591Z] 05:39:27 INFO - Now connected [task 2018-02-08T05:39:27.592Z] 05:39:27 INFO - Received 1024 bytes [task 2018-02-08T05:39:27.593Z] 05:39:27 INFO - Received 1024 bytes [task 2018-02-08T05:39:27.593Z] 05:39:27 INFO - Received 1024 bytes [task 2018-02-08T05:39:27.593Z] 05:39:27 INFO - Received == 3 packets [task 2018-02-08T05:39:27.594Z] 05:39:27 INFO - ================================================================= [task 2018-02-08T05:39:27.595Z] 05:39:27 ERROR - ==953==ERROR: AddressSanitizer: heap-use-after-free on address 0x603006f1db08 at pc 0x7f450913dea2 bp 0x7ffeecf9abe0 sp 0x7ffeecf9abd8 [task 2018-02-08T05:39:27.596Z] 05:39:27 INFO - READ of size 8 at 0x603006f1db08 thread T0 [task 2018-02-08T05:39:28.478Z] 05:39:28 INFO - #0 0x7f450913dea1 in sigslot::_connection4<mozilla::TransportLayerIce, mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::getdest() const /builds/worker/workspace/build/src/media/mtransport/sigslot.h:2007:11 [task 2018-02-08T05:39:28.478Z] 05:39:28 INFO - #1 0x7f45090aa94a in disconnect_all /builds/worker/workspace/build/src/media/mtransport/sigslot.h:1150:12 [task 2018-02-08T05:39:28.478Z] 05:39:28 INFO - #2 0x7f45090aa94a in sigslot::_signal_base4<mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::~_signal_base4() /builds/worker/workspace/build/src/media/mtransport/sigslot.h:1131 [task 2018-02-08T05:39:28.479Z] 05:39:28 INFO - #3 0x7f45090aa79a in mozilla::NrIceMediaStream::~NrIceMediaStream() /builds/worker/workspace/build/src/media/mtransport/nricemediastream.cpp:224:1 [task 2018-02-08T05:39:28.494Z] 05:39:28 INFO - #4 0x7f451498d5d9 in Release /builds/worker/workspace/build/src/media/mtransport/nricemediastream.h:216:3 [task 2018-02-08T05:39:28.495Z] 05:39:28 INFO - #5 0x7f451498d5d9 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:41 [task 2018-02-08T05:39:28.495Z] 05:39:28 INFO - #6 0x7f451498d5d9 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:398 [task 2018-02-08T05:39:28.496Z] 05:39:28 INFO - #7 0x7f451498d5d9 in ~RefPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:79 [task 2018-02-08T05:39:28.496Z] 05:39:28 INFO - #8 0x7f451498d5d9 in _Destroy<RefPtr<mozilla::NrIceMediaStream> > /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/bits/stl_construct.h:93 [task 2018-02-08T05:39:28.496Z] 05:39:28 INFO - #9 0x7f451498d5d9 in __destroy<RefPtr<mozilla::NrIceMediaStream> *> /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/bits/stl_construct.h:103 [task 2018-02-08T05:39:28.496Z] 05:39:28 INFO - #10 0x7f451498d5d9 in _Destroy<RefPtr<mozilla::NrIceMediaStream> *> /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/bits/stl_construct.h:126 [task 2018-02-08T05:39:28.497Z] 05:39:28 INFO - #11 0x7f451498d5d9 in _Destroy<RefPtr<mozilla::NrIceMediaStream> *, RefPtr<mozilla::NrIceMediaStream> > /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/bits/stl_construct.h:151 [task 2018-02-08T05:39:28.497Z] 05:39:28 INFO - #12 0x7f451498d5d9 in ~vector /builds/worker/workspace/build/src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/bits/stl_vector.h:424 [task 2018-02-08T05:39:28.497Z] 05:39:28 INFO - #13 0x7f451498d5d9 in (anonymous namespace)::TransportTestPeer::~TransportTestPeer() /builds/worker/workspace/build/src/media/mtransport/test/transport_unittests.cpp:475 [task 2018-02-08T05:39:28.498Z] 05:39:28 INFO - #14 0x7f451498dbbd in (anonymous namespace)::TransportTestPeer::~TransportTestPeer() /builds/worker/workspace/build/src/media/mtransport/test/transport_unittests.cpp:471:24 [task 2018-02-08T05:39:28.498Z] 05:39:28 INFO - #15 0x7f451498a191 in (anonymous namespace)::TransportTest::TearDown() /builds/worker/workspace/build/src/media/mtransport/test/transport_unittests.cpp:838:5 [task 2018-02-08T05:39:28.514Z] 05:39:28 INFO - #16 0x7f4513af3714 in testing::TestInfo::Run() /builds/worker/workspace/build/src/testing/gtest/gtest/src/gtest.cc:2658:11 [task 2018-02-08T05:39:28.514Z] 05:39:28 INFO - #17 0x7f4513af4766 in testing::TestCase::Run() /builds/worker/workspace/build/src/testing/gtest/gtest/src/gtest.cc:2776:28 [task 2018-02-08T05:39:28.514Z] 05:39:28 INFO - #18 0x7f4513b0b5f6 in testing::internal::UnitTestImpl::RunAllTests() /builds/worker/workspace/build/src/testing/gtest/gtest/src/gtest.cc:4651:43 [task 2018-02-08T05:39:28.515Z] 05:39:28 INFO - #19 0x7f4513b0ab8a in testing::UnitTest::Run() /builds/worker/workspace/build/src/testing/gtest/gtest/src/gtest.cc [task 2018-02-08T05:39:28.515Z] 05:39:28 INFO - #20 0x7f4513b3c691 in RUN_ALL_TESTS /builds/worker/workspace/build/src/obj-firefox/dist/include/gtest/gtest.h:2233:46 [task 2018-02-08T05:39:28.515Z] 05:39:28 INFO - #21 0x7f4513b3c691 in mozilla::RunGTestFunc(int*, char**) /builds/worker/workspace/build/src/testing/gtest/mozilla/GTestRunner.cpp:113 [task 2018-02-08T05:39:28.516Z] 05:39:28 INFO - #22 0x7f4512977738 in XREMain::XRE_mainStartup(bool*) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:3878:16 [task 2018-02-08T05:39:28.516Z] 05:39:28 INFO - #23 0x7f4512987edc in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4796:12 [task 2018-02-08T05:39:28.517Z] 05:39:28 INFO - #24 0x7f4512989784 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4903:21 [task 2018-02-08T05:39:28.520Z] 05:39:28 INFO - #25 0x4f168b in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:231:22 [task 2018-02-08T05:39:28.520Z] 05:39:28 INFO - #26 0x4f168b in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:304 [task 2018-02-08T05:39:28.568Z] 05:39:28 INFO - #27 0x7f452821782f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 [task 2018-02-08T05:39:28.569Z] 05:39:28 INFO - #28 0x420f48 in _start (/builds/worker/workspace/build/application/firefox/firefox+0x420f48) [task 2018-02-08T05:39:28.570Z] 05:39:28 INFO - 0x603006f1db08 is located 8 bytes inside of 32-byte region [0x603006f1db00,0x603006f1db20) [task 2018-02-08T05:39:28.571Z] 05:39:28 INFO - freed by thread T4 (Socket Thread) here: [task 2018-02-08T05:39:28.571Z] 05:39:28 INFO - #0 0x4c1952 in __interceptor_free /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:68:3 [task 2018-02-08T05:39:28.571Z] 05:39:28 INFO - #1 0x7f45090b990f in sigslot::_signal_base4<mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::slot_disconnect(sigslot::has_slots_interface*) /builds/worker/workspace/build/src/media/mtransport/sigslot.h:1210:6 [task 2018-02-08T05:39:28.571Z] 05:39:28 INFO - #2 0x7f45090e4114 in disconnect_all /builds/worker/workspace/build/src/media/mtransport/sigslot.h:522:12 [task 2018-02-08T05:39:28.572Z] 05:39:28 INFO - #3 0x7f45090e4114 in ~has_slots /builds/worker/workspace/build/src/media/mtransport/sigslot.h:511 [task 2018-02-08T05:39:28.572Z] 05:39:28 INFO - #4 0x7f45090e4114 in mozilla::TransportLayer::~TransportLayer() /builds/worker/workspace/build/src/media/mtransport/transportlayer.h:48 [task 2018-02-08T05:39:28.572Z] 05:39:28 INFO - #5 0x7f4509135abf in ~TransportLayerIce /builds/worker/workspace/build/src/media/mtransport/transportlayerice.cpp:96:1 [task 2018-02-08T05:39:28.572Z] 05:39:28 INFO - #6 0x7f4509135abf in mozilla::TransportLayerIce::~TransportLayerIce() /builds/worker/workspace/build/src/media/mtransport/transportlayerice.cpp:94 [task 2018-02-08T05:39:28.574Z] 05:39:28 INFO - #7 0x7f45090d8a4c in ClearLayers /builds/worker/workspace/build/src/media/mtransport/transportflow.cpp:59:5 [task 2018-02-08T05:39:28.574Z] 05:39:28 INFO - #8 0x7f45090d8a4c in mozilla::TransportFlow::DestroyFinal(nsAutoPtr<std::deque<mozilla::TransportLayer*, std::allocator<mozilla::TransportLayer*> > >) /builds/worker/workspace/build/src/media/mtransport/transportflow.cpp:47 [task 2018-02-08T05:39:28.574Z] 05:39:28 INFO - #9 0x7f45090e12fc in apply<void (*)(nsAutoPtr<std::deque<mozilla::TransportLayer *, std::allocator<mozilla::TransportLayer *> > >), nsAutoPtr<std::deque<mozilla::TransportLayer *, std::allocator<mozilla::TransportLayer *> > > , 0> /builds/worker/workspace/build/src/media/mtransport/runnable_utils.h:62:5 [task 2018-02-08T05:39:28.575Z] 05:39:28 INFO - #10 0x7f45090e12fc in mozilla::runnable_args_func<void (*)(nsAutoPtr<std::deque<mozilla::TransportLayer*, std::allocator<mozilla::TransportLayer*> > >), nsAutoPtr<std::deque<mozilla::TransportLayer*, std::allocator<mozilla::TransportLayer*> > > >::Run() /builds/worker/workspace/build/src/media/mtransport/runnable_utils.h:102 [task 2018-02-08T05:39:28.591Z] 05:39:28 INFO - #11 0x7f450720d1db in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1040:14 [task 2018-02-08T05:39:28.591Z] 05:39:28 INFO - #12 0x7f4507229700 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:517:10 [task 2018-02-08T05:39:28.607Z] 05:39:28 INFO - #13 0x7f4507453b84 in mozilla::net::nsSocketTransportService::Run() /builds/worker/workspace/build/src/netwerk/base/nsSocketTransportService2.cpp:965:21 [task 2018-02-08T05:39:28.607Z] 05:39:28 INFO - #14 0x7f4507455e8c in non-virtual thunk to mozilla::net::nsSocketTransportService::Run() /builds/worker/workspace/build/src/netwerk/base/nsSocketTransportService2.cpp [task 2018-02-08T05:39:28.607Z] 05:39:28 INFO - #15 0x7f450720d1db in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1040:14 [task 2018-02-08T05:39:28.608Z] 05:39:28 INFO - #16 0x7f4507229700 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:517:10 [task 2018-02-08T05:39:28.611Z] 05:39:28 INFO - #17 0x7f45080bf910 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:334:20 [task 2018-02-08T05:39:28.619Z] 05:39:28 INFO - #18 0x7f4508012c69 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2018-02-08T05:39:28.619Z] 05:39:28 INFO - #19 0x7f4508012c69 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2018-02-08T05:39:28.620Z] 05:39:28 INFO - #20 0x7f4508012c69 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2018-02-08T05:39:28.620Z] 05:39:28 INFO - #21 0x7f4507207e2e in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:423:11 [task 2018-02-08T05:39:28.621Z] 05:39:28 INFO - #22 0x7f4525c7b47e in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:201:5 [task 2018-02-08T05:39:28.621Z] 05:39:28 INFO - #23 0x7f45292756b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) [task 2018-02-08T05:39:28.622Z] 05:39:28 INFO - previously allocated by thread T0 here: [task 2018-02-08T05:39:28.623Z] 05:39:28 INFO - #0 0x4c1c93 in malloc /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88:3 [task 2018-02-08T05:39:28.623Z] 05:39:28 INFO - #1 0x4f26fd in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:70:17 [task 2018-02-08T05:39:28.624Z] 05:39:28 INFO - #2 0x7f4509136f36 in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:159:12 [task 2018-02-08T05:39:28.624Z] 05:39:28 INFO - #3 0x7f4509136f36 in connect<mozilla::TransportLayerIce> /builds/worker/workspace/build/src/media/mtransport/sigslot.h:2519 [task 2018-02-08T05:39:28.625Z] 05:39:28 INFO - #4 0x7f4509136f36 in mozilla::TransportLayerIce::PostSetup() /builds/worker/workspace/build/src/media/mtransport/transportlayerice.cpp:131 [task 2018-02-08T05:39:28.626Z] 05:39:28 INFO - #5 0x7f4509136777 in mozilla::TransportLayerIce::SetParameters(RefPtr<mozilla::NrIceMediaStream>, int) /builds/worker/workspace/build/src/media/mtransport/transportlayerice.cpp:125:3 [task 2018-02-08T05:39:28.626Z] 05:39:28 INFO - #6 0x7f45149ace56 in (anonymous namespace)::TransportTestPeer::InitIce() /builds/worker/workspace/build/src/media/mtransport/test/transport_unittests.cpp:618:11 [task 2018-02-08T05:39:28.626Z] 05:39:28 INFO - #7 0x7f45149ab08f in (anonymous namespace)::TransportTest::ConnectIce() /builds/worker/workspace/build/src/media/mtransport/test/transport_unittests.cpp:926:10 [task 2018-02-08T05:39:28.627Z] 05:39:28 INFO - #8 0x7f45149b444e in (anonymous namespace)::TransportTest_TestTransferIceMultiple_Test::TestBody() /builds/worker/workspace/build/src/media/mtransport/test/transport_unittests.cpp:1222:3 [task 2018-02-08T05:39:28.627Z] 05:39:28 INFO - #9 0x7f4513af11fc in testing::Test::Run() /builds/worker/workspace/build/src/testing/gtest/gtest/src/gtest-internal-inl.h [task 2018-02-08T05:39:28.628Z] 05:39:28 INFO - #10 0x7f4513af3714 in testing::TestInfo::Run() /builds/worker/workspace/build/src/testing/gtest/gtest/src/gtest.cc:2658:11 [task 2018-02-08T05:39:28.628Z] 05:39:28 INFO - #11 0x7f4513af4766 in testing::TestCase::Run() /builds/worker/workspace/build/src/testing/gtest/gtest/src/gtest.cc:2776:28 [task 2018-02-08T05:39:28.629Z] 05:39:28 INFO - #12 0x7f4513b0b5f6 in testing::internal::UnitTestImpl::RunAllTests() /builds/worker/workspace/build/src/testing/gtest/gtest/src/gtest.cc:4651:43 [task 2018-02-08T05:39:28.629Z] 05:39:28 INFO - #13 0x7f4513b0ab8a in testing::UnitTest::Run() /builds/worker/workspace/build/src/testing/gtest/gtest/src/gtest.cc [task 2018-02-08T05:39:28.629Z] 05:39:28 INFO - #14 0x7f4513b3c691 in RUN_ALL_TESTS /builds/worker/workspace/build/src/obj-firefox/dist/include/gtest/gtest.h:2233:46 [task 2018-02-08T05:39:28.630Z] 05:39:28 INFO - #15 0x7f4513b3c691 in mozilla::RunGTestFunc(int*, char**) /builds/worker/workspace/build/src/testing/gtest/mozilla/GTestRunner.cpp:113 [task 2018-02-08T05:39:28.630Z] 05:39:28 INFO - #16 0x7f4512977738 in XREMain::XRE_mainStartup(bool*) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:3878:16 [task 2018-02-08T05:39:28.630Z] 05:39:28 INFO - #17 0x7f4512987edc in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4796:12 [task 2018-02-08T05:39:28.631Z] 05:39:28 INFO - #18 0x7f4512989784 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4903:21 [task 2018-02-08T05:39:28.631Z] 05:39:28 INFO - #19 0x4f168b in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:231:22 [task 2018-02-08T05:39:28.632Z] 05:39:28 INFO - #20 0x4f168b in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:304 [task 2018-02-08T05:39:28.632Z] 05:39:28 INFO - #21 0x7f452821782f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 [task 2018-02-08T05:39:28.632Z] 05:39:28 INFO - Thread T4 (Socket Thread) created by T0 here: [task 2018-02-08T05:39:28.640Z] 05:39:28 INFO - #0 0x4aafed in __interceptor_pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:204:3 [task 2018-02-08T05:39:28.641Z] 05:39:28 INFO - #1 0x7f4525c781cf in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:433:14 [task 2018-02-08T05:39:28.641Z] 05:39:28 INFO - #2 0x7f4525c77dbe in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:518:12 [task 2018-02-08T05:39:28.642Z] 05:39:28 INFO - #3 0x7f4507209c53 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:594:8 [task 2018-02-08T05:39:28.642Z] 05:39:28 INFO - #4 0x7f45072129ea in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:471:22 [task 2018-02-08T05:39:28.643Z] 05:39:28 INFO - #5 0x7f4507226f5b in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:143:45 [task 2018-02-08T05:39:28.643Z] 05:39:28 INFO - #6 0x7f4507450908 in NS_NewNamedThread<14> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:72:10 [task 2018-02-08T05:39:28.644Z] 05:39:28 INFO - #7 0x7f4507450908 in mozilla::net::nsSocketTransportService::Init() /builds/worker/workspace/build/src/netwerk/base/nsSocketTransportService2.cpp:548 [task 2018-02-08T05:39:28.644Z] 05:39:28 INFO - #8 0x7f4507fec25c in nsSocketTransportServiceConstructor(nsISupports*, nsID const&, void**) /builds/worker/workspace/build/src/netwerk/build/nsNetModule.cpp:76:1 [task 2018-02-08T05:39:28.651Z] 05:39:28 INFO - #9 0x7f45071bfc65 in nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsISupports*, nsID const&, void**) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1086:19 [task 2018-02-08T05:39:28.652Z] 05:39:28 INFO - #10 0x7f45071b66fd in nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1446:10 [task 2018-02-08T05:39:28.652Z] 05:39:28 INFO - #11 0x7f45071c5cc5 in CallGetService /builds/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:67:43 [task 2018-02-08T05:39:28.652Z] 05:39:28 INFO - #12 0x7f45071c5cc5 in nsGetServiceByContractIDWithError::operator()(nsID const&, void**) const /builds/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:292 [task 2018-02-08T05:39:28.653Z] 05:39:28 INFO - #13 0x7f450708214a in nsCOMPtr_base::assign_from_gs_contractid_with_error(nsGetServiceByContractIDWithError const&, nsID const&) /builds/worker/workspace/build/src/xpcom/base/nsCOMPtr.cpp:106:7 [task 2018-02-08T05:39:28.673Z] 05:39:28 INFO - #14 0x7f45073ae6c7 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:697:5 [task 2018-02-08T05:39:28.673Z] 05:39:28 INFO - #15 0x7f45073ae6c7 in InitializeSocketTransportService /builds/worker/workspace/build/src/netwerk/base/nsIOService.cpp:306 [task 2018-02-08T05:39:28.674Z] 05:39:28 INFO - #16 0x7f45073ae6c7 in mozilla::net::nsIOService::SetOffline(bool) /builds/worker/workspace/build/src/netwerk/base/nsIOService.cpp:1153 [task 2018-02-08T05:39:28.675Z] 05:39:28 INFO - #17 0x7f45073ad756 in mozilla::net::nsIOService::Init() /builds/worker/workspace/build/src/netwerk/base/nsIOService.cpp:270:5 [task 2018-02-08T05:39:28.675Z] 05:39:28 INFO - #18 0x7f45073afe92 in mozilla::net::nsIOService::GetInstance() /builds/worker/workspace/build/src/netwerk/base/nsIOService.cpp:367:13 [task 2018-02-08T05:39:28.675Z] 05:39:28 INFO - #19 0x7f4507febf9f in nsIOServiceConstructor(nsISupports*, nsID const&, void**) /builds/worker/workspace/build/src/netwerk/build/nsNetModule.cpp:58:1 [task 2018-02-08T05:39:28.676Z] 05:39:28 INFO - #20 0x7f45071bfc65 in nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsISupports*, nsID const&, void**) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1086:19 [task 2018-02-08T05:39:28.676Z] 05:39:28 INFO - #21 0x7f45071b66fd in nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:1446:10 [task 2018-02-08T05:39:28.677Z] 05:39:28 INFO - #22 0x7f45071c5c2c in CallGetService /builds/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:67:43 [task 2018-02-08T05:39:28.677Z] 05:39:28 INFO - #23 0x7f45071c5c2c in nsGetServiceByContractID::operator()(nsID const&, void**) const /builds/worker/workspace/build/src/xpcom/components/nsComponentManagerUtils.cpp:280 [task 2018-02-08T05:39:28.678Z] 05:39:28 INFO - #24 0x7f4507081f69 in nsCOMPtr_base::assign_from_gs_contractid(nsGetServiceByContractID, nsID const&) /builds/worker/workspace/build/src/xpcom/base/nsCOMPtr.cpp:95:7 [task 2018-02-08T05:39:28.679Z] 05:39:28 INFO - #25 0x7f4507258eca in nsCOMPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/nsCOMPtr.h:577:5 [task 2018-02-08T05:39:28.679Z] 05:39:28 INFO - #26 0x7f4507258eca in XPCOMService_GetIOService /builds/worker/workspace/build/src/obj-firefox/xpcom/build/Services.cpp:132 [task 2018-02-08T05:39:28.680Z] 05:39:28 INFO - #27 0x7f450739bc1e in GetIOService /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Services.h:128:41 [task 2018-02-08T05:39:28.680Z] 05:39:28 INFO - #28 0x7f450739bc1e in do_GetIOService /builds/worker/workspace/build/src/netwerk/base/nsNetUtil.cpp:98 [task 2018-02-08T05:39:28.680Z] 05:39:28 INFO - #29 0x7f450739bc1e in net_EnsureIOService /builds/worker/workspace/build/src/netwerk/base/nsNetUtil.cpp:145 [task 2018-02-08T05:39:28.681Z] 05:39:28 INFO - #30 0x7f450739bc1e in NS_NewURI(nsIURI**, nsTSubstring<char> const&, char const*, nsIURI*, nsIIOService*) /builds/worker/workspace/build/src/netwerk/base/nsNetUtil.cpp:1903 [task 2018-02-08T05:39:28.681Z] 05:39:28 INFO - #31 0x7f450724d864 in GetManifestURI /builds/worker/workspace/build/src/chrome/nsChromeRegistryChrome.cpp:616:5 [task 2018-02-08T05:39:28.682Z] 05:39:28 INFO - #32 0x7f450724d864 in nsChromeRegistry::ManifestProcessingContext::ResolveURI(char const*) /builds/worker/workspace/build/src/chrome/nsChromeRegistryChrome.cpp:624 [task 2018-02-08T05:39:28.683Z] 05:39:28 INFO - #33 0x7f450724dc8b in nsChromeRegistryChrome::ManifestContent(nsChromeRegistry::ManifestProcessingContext&, int, char* const*, int) /builds/worker/workspace/build/src/chrome/nsChromeRegistryChrome.cpp:668:34 [task 2018-02-08T05:39:28.683Z] 05:39:28 INFO - #34 0x7f45071aaa20 in ParseManifest(NSLocationType, mozilla::FileLocation&, char*, bool, bool) /builds/worker/workspace/build/src/xpcom/components/ManifestParser.cpp:760:7 [task 2018-02-08T05:39:28.683Z] 05:39:28 INFO - #35 0x7f45071bae3c in DoRegisterManifest /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:547:5 [task 2018-02-08T05:39:28.684Z] 05:39:28 INFO - #36 0x7f45071bae3c in nsComponentManagerImpl::RegisterManifest(NSLocationType, mozilla::FileLocation&, bool) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:560 [task 2018-02-08T05:39:28.684Z] 05:39:28 INFO - #37 0x7f45071bb0f7 in nsComponentManagerImpl::ManifestManifest(nsComponentManagerImpl::ManifestProcessingContext&, int, char* const*) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:569:3 [task 2018-02-08T05:39:28.684Z] 05:39:28 INFO - #38 0x7f45071aad2e in ParseManifest(NSLocationType, mozilla::FileLocation&, char*, bool, bool) /builds/worker/workspace/build/src/xpcom/components/ManifestParser.cpp:769:9 [task 2018-02-08T05:39:28.684Z] 05:39:28 INFO - #39 0x7f45071bae3c in DoRegisterManifest /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:547:5 [task 2018-02-08T05:39:28.685Z] 05:39:28 INFO - #40 0x7f45071bae3c in nsComponentManagerImpl::RegisterManifest(NSLocationType, mozilla::FileLocation&, bool) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:560 [task 2018-02-08T05:39:28.685Z] 05:39:28 INFO - #41 0x7f45071b9966 in nsComponentManagerImpl::RereadChromeManifests(bool) /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:721:5 [task 2018-02-08T05:39:28.685Z] 05:39:28 INFO - #42 0x7f45071b8189 in nsComponentManagerImpl::Init() /builds/worker/workspace/build/src/xpcom/components/nsComponentManager.cpp:352:5 [task 2018-02-08T05:39:28.686Z] 05:39:28 INFO - #43 0x7f4507267ae2 in NS_InitXPCOM2 /builds/worker/workspace/build/src/xpcom/build/XPCOMInit.cpp:672:51 [task 2018-02-08T05:39:28.686Z] 05:39:28 INFO - #44 0x7f4513b3c29a in ScopedXPCOM /builds/worker/workspace/build/src/obj-firefox/dist/include/testing/TestHarness.h:89:21 [task 2018-02-08T05:39:28.687Z] 05:39:28 INFO - #45 0x7f4513b3c29a in mozilla::RunGTestFunc(int*, char**) /builds/worker/workspace/build/src/testing/gtest/mozilla/GTestRunner.cpp:87 [task 2018-02-08T05:39:28.688Z] 05:39:28 INFO - #46 0x7f4512977738 in XREMain::XRE_mainStartup(bool*) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:3878:16 [task 2018-02-08T05:39:28.688Z] 05:39:28 INFO - #47 0x7f4512987edc in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4796:12 [task 2018-02-08T05:39:28.688Z] 05:39:28 INFO - #48 0x7f4512989784 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4903:21 [task 2018-02-08T05:39:28.689Z] 05:39:28 INFO - #49 0x4f168b in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:231:22 [task 2018-02-08T05:39:28.689Z] 05:39:28 INFO - #50 0x4f168b in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:304 [task 2018-02-08T05:39:28.689Z] 05:39:28 INFO - #51 0x7f452821782f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 [task 2018-02-08T05:39:28.690Z] 05:39:28 INFO - SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/media/mtransport/sigslot.h:2007:11 in sigslot::_connection4<mozilla::TransportLayerIce, mozilla::NrIceMediaStream*, int, unsigned char const*, int, sigslot::single_threaded>::getdest() const [task 2018-02-08T05:39:28.690Z] 05:39:28 INFO - Shadow bytes around the buggy address: [task 2018-02-08T05:39:28.690Z] 05:39:28 INFO - 0x0c0680ddbb10: fa fa fd fd fd fd fa fa fd fd fd fa fa fa 00 00 [task 2018-02-08T05:39:28.691Z] 05:39:28 INFO - 0x0c0680ddbb20: 00 00 fa fa fd fd fd fa fa fa 00 00 00 05 fa fa [task 2018-02-08T05:39:28.691Z] 05:39:28 INFO - 0x0c0680ddbb30: 00 00 00 00 fa fa 00 00 00 fa fa fa 00 00 00 03 [task 2018-02-08T05:39:28.691Z] 05:39:28 INFO - 0x0c0680ddbb40: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd [task 2018-02-08T05:39:28.691Z] 05:39:28 INFO - 0x0c0680ddbb50: fd fd fa fa fd fd fd fa fa fa fd fd fd fd fa fa [task 2018-02-08T05:39:28.692Z] 05:39:28 INFO - =>0x0c0680ddbb60: fd[fd]fd fd fa fa fd fd fd fd fa fa 00 00 00 00 [task 2018-02-08T05:39:28.692Z] 05:39:28 INFO - 0x0c0680ddbb70: fa fa 00 00 00 06 fa fa fd fd fd fd fa fa 00 00 [task 2018-02-08T05:39:28.692Z] 05:39:28 INFO - 0x0c0680ddbb80: 00 fa fa fa fd fd fd fd fa fa 00 00 00 00 fa fa [task 2018-02-08T05:39:28.693Z] 05:39:28 INFO - 0x0c0680ddbb90: 00 00 00 00 fa fa fd fd fd fd fa fa fd fd fd fd [task 2018-02-08T05:39:28.693Z] 05:39:28 INFO - 0x0c0680ddbba0: fa fa fd fd fd fd fa fa 00 00 00 fa fa fa 00 00 [task 2018-02-08T05:39:28.693Z] 05:39:28 INFO - 0x0c0680ddbbb0: 00 00 fa fa fd fd fd fa fa fa fd fd fd fd fa fa [task 2018-02-08T05:39:28.693Z] 05:39:28 INFO - Shadow byte legend (one shadow byte represents 8 application bytes): [task 2018-02-08T05:39:28.694Z] 05:39:28 INFO - Addressable: 00 [task 2018-02-08T05:39:28.694Z] 05:39:28 INFO - Partially addressable: 01 02 03 04 05 06 07 [task 2018-02-08T05:39:28.694Z] 05:39:28 INFO - Heap left redzone: fa [task 2018-02-08T05:39:28.695Z] 05:39:28 INFO - Freed heap region: fd [task 2018-02-08T05:39:28.695Z] 05:39:28 INFO - Stack left redzone: f1 [task 2018-02-08T05:39:28.695Z] 05:39:28 INFO - Stack mid redzone: f2 [task 2018-02-08T05:39:28.695Z] 05:39:28 INFO - Stack right redzone: f3 [task 2018-02-08T05:39:28.696Z] 05:39:28 INFO - Stack after return: f5 [task 2018-02-08T05:39:28.696Z] 05:39:28 INFO - Stack use after scope: f8 [task 2018-02-08T05:39:28.696Z] 05:39:28 INFO - Global redzone: f9 [task 2018-02-08T05:39:28.697Z] 05:39:28 INFO - Global init order: f6 [task 2018-02-08T05:39:28.697Z] 05:39:28 INFO - Poisoned by user: f7 [task 2018-02-08T05:39:28.697Z] 05:39:28 INFO - Container overflow: fc [task 2018-02-08T05:39:28.698Z] 05:39:28 INFO - Array cookie: ac [task 2018-02-08T05:39:28.698Z] 05:39:28 INFO - Intra object redzone: bb [task 2018-02-08T05:39:28.698Z] 05:39:28 INFO - ASan internal: fe [task 2018-02-08T05:39:28.698Z] 05:39:28 INFO - Left alloca redzone: ca [task 2018-02-08T05:39:28.699Z] 05:39:28 INFO - Right alloca redzone: cb [task 2018-02-08T05:39:28.699Z] 05:39:28 INFO - ==953==ABORTING [task 2018-02-08T05:39:28.989Z] 05:39:28 ERROR - gtest TEST-UNEXPECTED-FAIL | gtest | test failed with return code 1

Andrew McCreight [:mccr8]

Updated

•

7 years ago

Keywords: sec-high

Michael Froman [:mjf]

Assignee

Comment 1

•

7 years ago

I can repo this at random intervals in rr, so I'll look into it.

Michael Froman [:mjf]

Assignee

Updated

•

7 years ago

Assignee: nobody → mfroman

Michael Froman [:mjf]

Assignee

Comment 2

•

7 years ago

Attached patch Release NrIceMediaStreams on sts thread — Details — Splinter Review

The NrIceMediaStreams going away on the main thread was causing sigslot contention when the TransportLayers were going away on the sts thread.

Attachment #8950465 - Flags: review?(docfaraday)

Byron Campen [:bwc]

Comment 3

•

7 years ago

If this is just a bug in the test-case, we probably want to un-mark this as security. Is there any evidence that this is happening in the browser?

Flags: needinfo?(mfroman)

Byron Campen [:bwc]

Updated

•

7 years ago

Attachment #8950465 - Flags: review?(docfaraday) → review+

Michael Froman [:mjf]

Assignee

Comment 4

•

7 years ago

(In reply to Byron Campen [:bwc] from comment #3) > If this is just a bug in the test-case, we probably want to un-mark this as > security. Is there any evidence that this is happening in the browser? I haven't seen any evidence that this is something happening in the browser. If it did, it would be a clear indication of poor thread hygiene which I haven't seen. I originally jumped on this bug because I thought it looked like a possible queue jumping issue, but the only issue I could find was the test code releasing NrIceMediaStreams on the main thread at the same time connected signals were being disconnected on the sts thread which is not allowed based on the documentation in sigslot.h here[1]. [1] https://dxr.mozilla.org/mozilla-central/rev/6d8f470b2579e7570f14e3db557264dc075dd654/media/mtransport/sigslot.h#82-85

Flags: needinfo?(mfroman)

Michael Froman [:mjf]

Assignee

Comment 5

•

7 years ago

@Randell, after investigating and fixing this appears to be a test-only issue. Should the security flag be removed?

Flags: needinfo?(rjesup)

Nils Ohlmeier [:drno]

Updated

•

7 years ago

Rank: 15

Priority: -- → P2

Randell Jesup [:jesup] (needinfo me)

Comment 6

•

7 years ago

Yes, I think so

Group: media-core-security

Flags: needinfo?(rjesup)

Not accessible to reporter

Randell Jesup [:jesup] (needinfo me)

Updated

•

7 years ago

Keywords: sec-high → sec-low

Comment hidden (mozreview-request)

Byron Campen [:bwc]

Comment 8

•

7 years ago

mozreview-review

Comment on attachment 8951051 [details] Bug 1436759 - Release NrIceMediaStreams on sts thread in transport_unittests.cpp. https://reviewboard.mozilla.org/r/220314/#review226246

Attachment #8951051 - Flags: review?(docfaraday) → review+

Pulsebot

Comment 9

•

7 years ago

Pushed by mfroman@nostrum.com: https://hg.mozilla.org/integration/autoland/rev/6d4e050bc406 Release NrIceMediaStreams on sts thread in transport_unittests.cpp. r=bwc

Andreea Pavel [:apavel]

Comment 10

•

7 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/6d4e050bc406

Status: NEW → RESOLVED

Closed: 7 years ago

status-firefox60: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla60

Ryan VanderMeulen [:RyanVM]

Updated

•

7 years ago

status-firefox58: --- → wontfix

status-firefox59: --- → wontfix

status-firefox-esr52: --- → wontfix

Al Billings [:abillings - ex-MoCo]

Updated

•

7 years ago

Whiteboard: [adv-main60+]

Sylvestre Ledru [:Sylvestre]

Updated

•

5 years ago

Blocks: asan-maintenance

Release NrIceMediaStreams on sts thread 7 years ago Michael Froman [:mjf] 392 bytes, patch	bwc : review+	Details \| Diff \| Splinter Review
Bug 1436759 - Release NrIceMediaStreams on sts thread in transport_unittests.cpp. 7 years ago Michael Froman [:mjf] 59 bytes, text/x-review-board-request	bwc : review+	Details