Closed Bug 1495646 Opened 6 years ago Closed 2 years ago

Intermittent SUMMARY: AddressSanitizer: access-violation z:\build\build\src\mozglue\misc\TimeStamp_windows.cpp:307 in mozilla::TimeStampValue::CheckQPC

Categories

(Core :: WebVR, defect, P2)

defect

Tracking

()

RESOLVED WONTFIX

People

(Reporter: nataliaCs, Unassigned)

References

(Blocks 1 open bug)

Details

(4 keywords, Whiteboard: [sg:dos])

Push with failure: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=2b4331c9d829043af5513f3f1b97f53026928d8c&group_state=expanded&searchStr=windows,10,x64,asan,reftests,with,e10s,test-windows10-64-asan%2Fopt-reftest-e10s-1,r-e10s(r1)&selectedJob=202786704


Task details: https://tools.taskcluster.net/groups/NlbXIIR9SpeYhdaTdConiQ/tasks/bUzYMK0sQVCHIUhXW0SiUA/details

File log: https://treeherder.mozilla.org/logviewer.html#?job_id=202786704&repo=mozilla-inbound&lineNumber=50445

04:14:39     INFO - Unable to read VR Path Registry from C:\Users\task_1538448279\AppData\Local\openvr\openvrpaths.vrpath
04:14:39     INFO - [GPU 596, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [GPU 596, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [GPU 596, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - ###!!! [Parent][MessageChannel] Error: (msgtype=0x8B0015,name=PVRManager::Msg_UpdateDisplayInfo) Channel closing: too late to send/recv, messages will be lost
04:14:39     INFO - [Parent 6184, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [Child 568, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [Child 568, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - JavaScript error: resource://reftest/reftest.jsm, line 1552: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIPropertyBag2.getPropertyAsAString]
04:14:39     INFO - =================================================================
04:14:39    ERROR - ==568==ERROR: AddressSanitizer: access-violation on unknown address 0x0000000000f8 (pc 0x7ff9c358c883 bp 0x005974ffd0e0 sp 0x005974ffcd60 T0)
04:14:39     INFO - ==568==The signal is caused by a READ memory access.
04:14:39     INFO - ==568==Hint: address points to the zero page.
04:14:39     INFO - [Parent 6184, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [Child 2348, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [Child 2348, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - JavaScript error: resource://reftest/reftest.jsm, line 1552: NS_ERROR_NOT_AVAILABLE: Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIPropertyBag2.getPropertyAsAString]
04:14:39     INFO - [GPU 596, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [GPU 596, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [GPU 596, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [Parent 6184, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - 1538453679780	Marionette	DEBUG	Received observer notification xpcom-will-shutdown
04:14:39     INFO - 1538453679780	Marionette	INFO	Stopped listening on port 2828
04:14:39     INFO - 1538453679780	Marionette	DEBUG	Remote service is inactive
04:14:39     INFO - [GPU 596, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - ###!!! [Child][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost
04:14:39     INFO - [Parent 6184, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [Child 568, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [Parent 6184, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [Parent 6184, Gecko_IOThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [Child 568, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - [GPU 596, Chrome_ChildThread] WARNING: pipe error: 109: file z:/build/build/src/ipc/chromium/src/chrome/common/ipc_channel_win.cc, line 346
04:14:39     INFO - ==568==WARNING: Failed to use and restart external symbolizer!
04:14:39     INFO -     #0 0x7ff9c358c882 in mozilla::TimeStampValue::CheckQPC z:\build\build\src\mozglue\misc\TimeStamp_windows.cpp:307
04:14:39     INFO -     #1 0x7ff9813d917d in mozilla::gfx::VRManagerChild::RunFrameRequestCallbacks z:\build\build\src\gfx\vr\ipc\VRManagerChild.cpp:433
04:14:39     INFO -     #2 0x7ff9813d8615 in mozilla::gfx::VRDisplayClient::FireEvents z:\build\build\src\gfx\vr\VRDisplayClient.cpp:139
04:14:39     INFO -     #3 0x7ff9813fa8f4 in mozilla::gfx::VRManagerChild::UpdateDisplayInfo z:\build\build\src\gfx\vr\ipc\VRManagerChild.cpp:217
04:14:39     INFO -     #4 0x7ff9813fc420 in mozilla::gfx::VRManagerChild::RecvUpdateDisplayInfo z:\build\build\src\gfx\vr\ipc\VRManagerChild.cpp:246
04:14:39     INFO -     #5 0x7ff97f81a213 in mozilla::gfx::PVRManagerChild::OnMessageReceived z:\build\build\src\obj-firefox\ipc\ipdl\PVRManagerChild.cpp:663
04:14:39     INFO -     #6 0x7ff97f141fb2 in mozilla::ipc::MessageChannel::DispatchAsyncMessage z:\build\build\src\ipc\glue\MessageChannel.cpp:2248
04:14:39     INFO -     #7 0x7ff97f13ea20 in mozilla::ipc::MessageChannel::DispatchMessageW z:\build\build\src\ipc\glue\MessageChannel.cpp:2175
04:14:39     INFO -     #8 0x7ff97f14066f in mozilla::ipc::MessageChannel::RunMessage z:\build\build\src\ipc\glue\MessageChannel.cpp:2012
04:14:39     INFO -     #9 0x7ff97f140e55 in mozilla::ipc::MessageChannel::MessageTask::Run z:\build\build\src\ipc\glue\MessageChannel.cpp:2045
04:14:39     INFO -     #10 0x7ff97e0d6064 in nsThread::ProcessNextEvent z:\build\build\src\xpcom\threads\nsThread.cpp:1231
04:14:39     INFO -     #11 0x7ff97e0de538 in NS_ProcessNextEvent z:\build\build\src\xpcom\threads\nsThreadUtils.cpp:530
04:14:39     INFO -     #12 0x7ff980fde3c7 in mozilla::layers::CompositorBridgeChild::ShutDown z:\build\build\src\gfx\layers\ipc\CompositorBridgeChild.cpp:224
04:14:39     INFO -     #13 0x7ff98100ac60 in mozilla::layers::CompositorManagerChild::Shutdown z:\build\build\src\gfx\layers\ipc\CompositorManagerChild.cpp:77
04:14:39     INFO -     #14 0x7ff98110b382 in gfxPlatform::ShutdownLayersIPC z:\build\build\src\gfx\thebes\gfxPlatform.cpp:1189
04:14:39     INFO -     #15 0x7ff97e15c96a in mozilla::ShutdownXPCOM z:\build\build\src\xpcom\build\XPCOMInit.cpp:908
04:14:39     INFO -     #16 0x7ff98c31c700 in XRE_TermEmbedding z:\build\build\src\toolkit\xre\nsEmbedFunctions.cpp:227
04:14:39     INFO -     #17 0x7ff97f1571c8 in mozilla::ipc::ScopedXREEmbed::Stop z:\build\build\src\ipc\glue\ScopedXREEmbed.cpp:108
04:14:39     INFO -     #18 0x7ff98c31d982 in XRE_InitChildProcess z:\build\build\src\toolkit\xre\nsEmbedFunctions.cpp:769
04:14:39     INFO -     #19 0x7ff64fea2038 in Ordinal0+0x2038 (C:\Users\task_1538448279\build\application\firefox\firefox.exe+0x140002038)
04:14:39     INFO -     #20 0x7ff64fea14a1 in Ordinal0+0x14a1 (C:\Users\task_1538448279\build\application\firefox\firefox.exe+0x1400014a1)
04:14:39     INFO -     #21 0x7ff64ff78fab in TargetNtUnmapViewOfSection+0x28cdb (C:\Users\task_1538448279\build\application\firefox\firefox.exe+0x1400d8fab)
04:14:39     INFO -     #22 0x7ff9d2062773 in BaseThreadInitThunk+0x13 (C:\windows\System32\KERNEL32.DLL+0x180012773)
04:14:39     INFO -     #23 0x7ff9d2a50d60 in RtlUserThreadStart+0x20 (C:\windows\SYSTEM32\ntdll.dll+0x180070d60)
04:14:39     INFO - AddressSanitizer can not provide additional info.
04:14:39     INFO - SUMMARY: AddressSanitizer: access-violation z:\build\build\src\mozglue\misc\TimeStamp_windows.cpp:307 in mozilla::TimeStampValue::CheckQPC
04:14:39     INFO - ==568==ABORTING
Looks like the issue is in VR code.
Group: core-security → gfx-core-security
Component: mozglue → WebVR
Flags: needinfo?(kgilbert)
(In reply to Ryan VanderMeulen [:RyanVM] from comment #1)
> Looks like the issue is in VR code.

Thanks, I'll take this and investigate further.
Assignee: nobody → kgilbert
Flags: needinfo?(kgilbert)
Looks like a simple null ptr deref that doesn't need to be hidden.
Group: gfx-core-security
Whiteboard: [sg:dos]

Will revisit once refactoring in Bug 1466702 lands.

Depends on: 1466702
Priority: -- → P2

The bug assignee didn't login in Bugzilla in the last 7 months.
:jimm, could you have a look please?
For more information, please visit auto_nag documentation.

Assignee: kearwood → nobody
Flags: needinfo?(jmathies)
Status: NEW → RESOLVED
Closed: 2 years ago
Flags: needinfo?(jmathies)
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.