Closed Bug 1446021 Opened 2 years ago Closed 2 years ago

IPC: crash [@mozilla::layers::AsyncPanZoomController::GetCurrentAsyncTransform / __GI___pthread_mutex_lock]

Categories

(Core :: Panning and Zooming, defect, critical)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1446022
Tracking Status
firefox61 --- affected

People

(Reporter: posidron, Assigned: kats)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Attachments

(1 file)

Attached file session.txt
INFO: This is an IPC crash found by the fuzzer faulty - there is no test-case available which leads to an immediate crash for reproduction.

The attached session.txt contains a trace of IPC messages which were sent and received during a session of visiting  https://html5test.com

*** Possible reproduction scenario:

pip install git+https://github.com/mozillasecurity/fuzzfetch
fuzzfetch -a --fuzzing -n firefox -o /tmp

export FAULTY_PROBABILITY=50000
export FAULTY_LARGE_VALUES=1
export FAULTY_PARENT=1
export FAULTY_ENABLE_LOGGING=1
export FAULTY_PICKLE=1
export MOZ_IPC_MESSAGE_LOG=1



==28698==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000208 (pc 0x7f1c82455d44 bp 0x7f1c44140910 sp 0x7f1c44140900 T35)
==28698==The signal is caused by a READ memory access.
==28698==Hint: address points to the zero page.
    #0 0x7f1c82455d43 in __GI___pthread_mutex_lock (/lib/x86_64-linux-gnu/libpthread.so.0+0x9d43)
    #1 0x7f1c61c27638 in mozilla::RecursiveMutex::LockInternal() /builds/worker/workspace/build/src/xpcom/threads/RecursiveMutex.cpp:73:3
    #2 0x7f1c641ad497 in Lock /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RecursiveMutex.h:31:17
    #3 0x7f1c641ad497 in RecursiveMutexAutoLock /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RecursiveMutex.h:85
    #4 0x7f1c641ad497 in mozilla::layers::AsyncPanZoomController::GetCurrentAsyncTransform(mozilla::layers::AsyncPanZoomController::AsyncTransformConsumer) const /builds/worker/workspace/build/src/gfx/layers/apz/src/AsyncPanZoomController.cpp:3579
    #5 0x7f1c641b1aeb in mozilla::layers::APZSampler::GetCurrentAsyncTransform(mozilla::layers::LayerMetricsWrapper const&) /builds/worker/workspace/build/src/gfx/layers/apz/src/APZSampler.cpp:180:28
    #6 0x7f1c643440e8 in mozilla::layers::AsyncCompositionManager::ApplyAsyncContentTransformToTree(mozilla::layers::Layer*, bool*)::$_4::operator()(mozilla::layers::Layer*) const /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:897:26
    #7 0x7f1c64308dd3 in _ZN7mozilla6layersL11ForEachNodeINS0_15ForwardIteratorEPNS0_5LayerEZNS0_23AsyncCompositionManager32ApplyAsyncContentTransformToTreeES4_PbE3$_3ZNS5_32ApplyAsyncContentTransformToTreeES4_S6_E3$_4EENS_8EnableIfIXaasr6IsSameIDTclfp0_fp_EEvEE5valuesr6IsSameIDTclfp1_fp_EEvEE5valueEvE4TypeET0_RKT1_RKT2_ /builds/worker/workspace/build/src/gfx/layers/TreeTraversal.h:145:3
    #8 0x7f1c64308dab in _ZN7mozilla6layersL11ForEachNodeINS0_15ForwardIteratorEPNS0_5LayerEZNS0_23AsyncCompositionManager32ApplyAsyncContentTransformToTreeES4_PbE3$_3ZNS5_32ApplyAsyncContentTransformToTreeES4_S6_E3$_4EENS_8EnableIfIXaasr6IsSameIDTclfp0_fp_EEvEE5valuesr6IsSameIDTclfp1_fp_EEvEE5valueEvE4TypeET0_RKT1_RKT2_ /builds/worker/workspace/build/src/gfx/layers/TreeTraversal.h:142:5
    #9 0x7f1c64308d57 in _ZN7mozilla6layersL11ForEachNodeINS0_15ForwardIteratorEPNS0_5LayerEZNS0_23AsyncCompositionManager32ApplyAsyncContentTransformToTreeES4_PbE3$_3ZNS5_32ApplyAsyncContentTransformToTreeES4_S6_E3$_4EENS_8EnableIfIXaasr6IsSameIDTclfp0_fp_EEvEE5valuesr6IsSameIDTclfp1_fp_EEvEE5valueEvE4TypeET0_RKT1_RKT2_ /builds/worker/workspace/build/src/gfx/layers/TreeTraversal.h:142:5
    #10 0x7f1c64308dab in _ZN7mozilla6layersL11ForEachNodeINS0_15ForwardIteratorEPNS0_5LayerEZNS0_23AsyncCompositionManager32ApplyAsyncContentTransformToTreeES4_PbE3$_3ZNS5_32ApplyAsyncContentTransformToTreeES4_S6_E3$_4EENS_8EnableIfIXaasr6IsSameIDTclfp0_fp_EEvEE5valuesr6IsSameIDTclfp1_fp_EEvEE5valueEvE4TypeET0_RKT1_RKT2_ /builds/worker/workspace/build/src/gfx/layers/TreeTraversal.h:142:5
    #11 0x7f1c643083a3 in mozilla::layers::AsyncCompositionManager::ApplyAsyncContentTransformToTree(mozilla::layers::Layer*, bool*) /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:817:3
    #12 0x7f1c6430a5f6 in mozilla::layers::AsyncCompositionManager::TransformShadowTree(mozilla::TimeStamp, mozilla::BaseTimeDuration<mozilla::TimeDurationValueCalculator>, mozilla::layers::AsyncCompositionManager::TransformsToSkip) /builds/worker/workspace/build/src/gfx/layers/composite/AsyncCompositionManager.cpp:1255:9
    #13 0x7f1c643a4bd5 in mozilla::layers::CompositorBridgeParent::CompositeToTarget(mozilla::gfx::DrawTarget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) /builds/worker/workspace/build/src/gfx/layers/ipc/CompositorBridgeParent.cpp:990:48
    #14 0x7f1c643c7435 in mozilla::layers::CompositorVsyncScheduler::Composite(mozilla::TimeStamp) /builds/worker/workspace/build/src/gfx/layers/ipc/CompositorVsyncScheduler.cpp:243:27
    #15 0x7f1c64416d20 in applyImpl<mozilla::layers::CompositorVsyncScheduler, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp), StoreCopyPassByConstLRef<mozilla::TimeStamp> , 0> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1149:12
    #16 0x7f1c64416d20 in apply<mozilla::layers::CompositorVsyncScheduler, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1155
    #17 0x7f1c64416d20 in mozilla::detail::RunnableMethodImpl<mozilla::layers::CompositorVsyncScheduler*, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp), true, (mozilla::RunnableKind)1, mozilla::TimeStamp>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1200
    #18 0x7f1c62a800e3 in RunTask /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:452:9
    #19 0x7f1c62a800e3 in DeferOrRunPendingTask /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:460
    #20 0x7f1c62a800e3 in MessageLoop::DoWork() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:535
    #21 0x7f1c62a82058 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/chromium/src/base/message_pump_default.cc:36:31
    #22 0x7f1c62a7d6f9 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #23 0x7f1c62a7d6f9 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #24 0x7f1c62a7d6f9 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #25 0x7f1c62a9ca1f in base::Thread::ThreadMain() /builds/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:181:16
    #26 0x7f1c62a8e4dc in ThreadFunc(void*) /builds/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:38:13
    #27 0x7f1c824536b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #28 0x7f1c814dc41c in clone /build/glibc-Cl5G7W/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libpthread.so.0+0x9d43) in __GI___pthread_mutex_lock
Thread T35 (Compositor) created by T0 here:
    #0 0x4b065d in __interceptor_pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:204:3
    #1 0x7f1c62a8be3f in CreateThread /builds/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:135:14
    #2 0x7f1c62a8be3f in PlatformThread::Create(unsigned long, PlatformThread::Delegate*, unsigned long*) /builds/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:146
    #3 0x7f1c62a9c3bf in base::Thread::StartWithOptions(base::Thread::Options const&) /builds/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:99:8
    #4 0x7f1c643b7caa in CreateCompositorThread /builds/worker/workspace/build/src/gfx/layers/ipc/CompositorThread.cpp:102:26
    #5 0x7f1c643b7caa in mozilla::layers::CompositorThreadHolder::CompositorThreadHolder() /builds/worker/workspace/build/src/gfx/layers/ipc/CompositorThread.cpp:52
    #6 0x7f1c643b7ec3 in mozilla::layers::CompositorThreadHolder::Start() /builds/worker/workspace/build/src/gfx/layers/ipc/CompositorThread.cpp:124:33
    #7 0x7f1c644a8a32 in gfxPlatform::InitLayersIPC() /builds/worker/workspace/build/src/gfx/thebes/gfxPlatform.cpp:1035:5
    #8 0x7f1c644a47ce in gfxPlatform::Init() /builds/worker/workspace/build/src/gfx/thebes/gfxPlatform.cpp:779:5
    #9 0x7f1c644a1e2b in gfxPlatform::GetPlatform() /builds/worker/workspace/build/src/gfx/thebes/gfxPlatform.cpp:538:9
    #10 0x7f1c697c7339 in mozilla::widget::GfxInfoBase::GetContentBackend(nsTSubstring<char16_t>&) /builds/worker/workspace/build/src/widget/GfxInfoBase.cpp:1518:25
    #11 0x7f1c61c845e1 in NS_InvokeByIndex /builds/worker/workspace/build/src/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:106
    #12 0x7f1c63585020 in Invoke /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1951:12
    #13 0x7f1c63585020 in Call /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1267
    #14 0x7f1c63585020 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1234
    #15 0x7f1c6358c5c9 in GetAttribute /builds/worker/workspace/build/src/js/xpconnect/src/xpcprivate.h:1636:17
    #16 0x7f1c6358c5c9 in XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:949
    #17 0x7f1c6e029d1e in CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:290:15
    #18 0x7f1c6e029d1e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:467
    #19 0x7f1c6e02ba72 in InternalCall /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:516:12
    #20 0x7f1c6e02ba72 in Call /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535
    #21 0x7f1c6e02ba72 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:650
    #22 0x7f1c6f1cc2ee in CallGetter /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2155:16
    #23 0x7f1c6f1cc2ee in GetExistingProperty<js::AllowGC::CanGC> /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2208
    #24 0x7f1c6f1cc2ee in NativeGetPropertyInline<js::AllowGC::CanGC> /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2410
    #25 0x7f1c6f1cc2ee in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2446
    #26 0x7f1c6e011355 in GetProperty /builds/worker/workspace/build/src/js/src/vm/NativeObject.h:1629:12
    #27 0x7f1c6e011355 in GetObjectElementOperation /builds/worker/workspace/build/src/js/src/vm/Interpreter-inl.h:520
    #28 0x7f1c6e011355 in GetElementOperation /builds/worker/workspace/build/src/js/src/vm/Interpreter-inl.h:626
    #29 0x7f1c6e011355 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2923
    #30 0x7f1c6dff4904 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #31 0x7f1c6e029b17 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #32 0x7f1c6e0126f0 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12
    #33 0x7f1c6e0126f0 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3085
    #34 0x7f1c6dff4904 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #35 0x7f1c6e029b17 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #36 0x7f1c6e0126f0 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12
    #37 0x7f1c6e0126f0 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3085
    #38 0x7f1c6dff4904 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #39 0x7f1c6e029b17 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #40 0x7f1c6e0126f0 in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12
    #41 0x7f1c6e0126f0 in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3085
    #42 0x7f1c6dff4904 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #43 0x7f1c6e029b17 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #44 0x7f1c6e02a883 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10
    #45 0x7f1c6ec85745 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2970:12
    #46 0x7f1c6356bf36 in nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedJSClass.cpp:1257:23
    #47 0x7f1c61c85bbf in PrepareAndDispatch /builds/worker/workspace/build/src/xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:120:28
    #48 0x7f1c61c84b6a in SharedStub (/home/ubuntu/firefox/libxul.so+0x21dbb6a)
    #49 0x7f1c61bfebfd in NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) /builds/worker/workspace/build/src/xpcom/components/nsCategoryManager.cpp:810:19
    #50 0x7f1c6dd3023c in nsXREDirProvider::DoStartup() /builds/worker/workspace/build/src/toolkit/xre/nsXREDirProvider.cpp:1021:11
    #51 0x7f1c6dd0cab8 in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4561:16
    #52 0x7f1c6dd100e8 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4869:8
    #53 0x7f1c6dd117c4 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4961:21
    #54 0x4f6d45 in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:231:22
    #55 0x4f6d45 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:304
    #56 0x7f1c813f582f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291

==28698==ABORTING
Here's another APZ Faulty crash, kats.
Component: Layout → Panning and Zooming
Flags: needinfo?(bugmail)
Thanks!
Assignee: nobody → bugmail
Flags: needinfo?(bugmail)
I'm going to dupe this bug 1446022 since the fix will cover both issues.
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1446022
You need to log in before you can comment on or make changes to this bug.