1540378 - Perma (tier2) PID 21718 | SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h in get

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P1)

Description

[Treeherder Bug Filer]

#[markdown(off)]
Filed by: aciure [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=237083071&repo=autoland

https://queue.taskcluster.net/v1/task/WvUH-ZlrT8ef4RBSh2GQow/runs/0/artifacts/public/logs/live_backing.log

[task 2019-03-30T04:59:38.108Z] 04:59:38 INFO - TEST-START | /webauthn/createcredential-badargs-challenge.https.html
[task 2019-03-30T04:59:38.115Z] 04:59:38 INFO - Closing window 8589934593
[task 2019-03-30T04:59:38.233Z] 04:59:38 INFO - PID 21718 | JavaScript warning: resource://gre/modules/PopupNotifications.jsm, line 1439: Array.forEach is deprecated; use Array.prototype.forEach instead
[task 2019-03-30T04:59:38.276Z] 04:59:38 INFO - PID 21718 | ###!!! [Parent][MessageChannel] Error: (msgtype=0xA10009,name=PWebAuthnTransaction::Msg_Abort) Closed channel: cannot send/recv
[task 2019-03-30T04:59:38.354Z] 04:59:38 INFO - PID 21718 | AddressSanitizer:DEADLYSIGNAL
[task 2019-03-30T04:59:38.354Z] 04:59:38 INFO - PID 21718 | =================================================================
[task 2019-03-30T04:59:38.354Z] 04:59:38 ERROR - PID 21718 | ==21887==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000020 (pc 0x7efce0b009ec bp 0x7ffe593d66f0 sp 0x7ffe593d6500 T0)
[task 2019-03-30T04:59:38.355Z] 04:59:38 INFO - PID 21718 | ==21887==The signal is caused by a READ memory access.
[task 2019-03-30T04:59:38.355Z] 04:59:38 INFO - PID 21718 | ==21887==Hint: address points to the zero page.
[task 2019-03-30T04:59:39.256Z] 04:59:39 INFO - PID 21718 | #0 0x7efce0b009eb in get /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h
[task 2019-03-30T04:59:39.256Z] 04:59:39 INFO - PID 21718 | #1 0x7efce0b009eb in operator nsIGlobalObject * /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:280
[task 2019-03-30T04:59:39.257Z] 04:59:39 INFO - PID 21718 | #2 0x7efce0b009eb in MaybeSomething<nsresult &> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Promise.h:245
[task 2019-03-30T04:59:39.258Z] 04:59:39 INFO - PID 21718 | #3 0x7efce0b009eb in MaybeReject /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/Promise.h:94
[task 2019-03-30T04:59:39.259Z] 04:59:39 INFO - PID 21718 | #4 0x7efce0b009eb in mozilla::dom::WebAuthnManager::RejectTransaction(nsresult const&) /builds/worker/workspace/build/src/dom/webauthn/WebAuthnManager.cpp:169
[task 2019-03-30T04:59:39.260Z] 04:59:39 INFO - PID 21718 | #5 0x7efce0b00d3d in mozilla::dom::WebAuthnManager::~WebAuthnManager() /builds/worker/workspace/build/src/dom/webauthn/WebAuthnManager.cpp:193:5
[task 2019-03-30T04:59:39.261Z] 04:59:39 INFO - PID 21718 | #6 0x7efce0b0138d in mozilla::dom::WebAuthnManager::~WebAuthnManager() /builds/worker/workspace/build/src/dom/webauthn/WebAuthnManager.cpp:189:37
[task 2019-03-30T04:59:39.269Z] 04:59:39 INFO - PID 21718 | #7 0x7efcd8d6dcf6 in SnowWhiteKiller::~SnowWhiteKiller() /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2416:7
[task 2019-03-30T04:59:39.269Z] 04:59:39 INFO - PID 21718 | #8 0x7efcd8d6c9fe in nsCycleCollector::FreeSnowWhite(bool) /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2607:3
[task 2019-03-30T04:59:39.270Z] 04:59:39 INFO - PID 21718 | #9 0x7efcd8d760d0 in nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:3578:3
[task 2019-03-30T04:59:39.270Z] 04:59:39 INFO - PID 21718 | #10 0x7efcd8d75690 in nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:3407:9
[task 2019-03-30T04:59:39.270Z] 04:59:39 INFO - PID 21718 | #11 0x7efcd8d75294 in nsCycleCollector::ShutdownCollect() /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:3351:10
[task 2019-03-30T04:59:39.271Z] 04:59:39 INFO - PID 21718 | #12 0x7efcd8d79c65 in Shutdown /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:3639:5
[task 2019-03-30T04:59:39.271Z] 04:59:39 INFO - PID 21718 | #13 0x7efcd8d79c65 in nsCycleCollector_shutdown(bool) /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:3993
[task 2019-03-30T04:59:39.274Z] 04:59:39 INFO - PID 21718 | #14 0x7efcd8f86ed8 in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/workspace/build/src/xpcom/build/XPCOMInit.cpp:728:3
[task 2019-03-30T04:59:39.275Z] 04:59:39 INFO - PID 21718 | #15 0x7efce4e8be1c in XRE_TermEmbedding() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:222:3
[task 2019-03-30T04:59:39.292Z] 04:59:39 INFO - PID 21718 | #16 0x7efcd9f0fee2 in mozilla::ipc::ScopedXREEmbed::Stop() /builds/worker/workspace/build/src/ipc/glue/ScopedXREEmbed.cpp:90:5
[task 2019-03-30T04:59:39.293Z] 04:59:39 INFO - PID 21718 | #17 0x7efce4e8c8bd in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:766:16
[task 2019-03-30T04:59:39.293Z] 04:59:39 INFO - PID 21718 | #18 0x556a6839e404 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
[task 2019-03-30T04:59:39.294Z] 04:59:39 INFO - PID 21718 | #19 0x556a6839e404 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:263
[task 2019-03-30T04:59:39.331Z] 04:59:39 INFO - PID 21718 | JavaScript warning: resource:///actors/PageStyleChild.jsm, line 30: Array.slice is deprecated; use Array.prototype.slice instead
[task 2019-03-30T04:59:39.331Z] 04:59:39 INFO - PID 21718 | JavaScript warning: resource:///actors/PageStyleChild.jsm, line 31: Array.map is deprecated; use Array.prototype.map instead
[task 2019-03-30T04:59:39.361Z] 04:59:39 INFO - PID 21718 | #20 0x7efcf926d82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
[task 2019-03-30T04:59:39.361Z] 04:59:39 INFO - PID 21718 | #21 0x556a682c3ad8 in _start (/builds/worker/workspace/build/application/firefox/firefox+0x2aad8)
[task 2019-03-30T04:59:39.361Z] 04:59:39 INFO - PID 21718 | AddressSanitizer can not provide additional info.
[task 2019-03-30T04:59:39.361Z] 04:59:39 INFO - PID 21718 | SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h in get
[task 2019-03-30T04:59:39.361Z] 04:59:39 INFO - PID 21718 | ==21887==ABORTING
[task 2019-03-30T04:59:39.383Z] 04:59:39 INFO - .....
[task 2019-03-30T04:59:39.383Z] 04:59:39 INFO - TEST-OK | /webauthn/createcredential-badargs-challenge.https.html | took 1276ms

Comment 1

[Intermittent Failures Robot]

15 failures in 184 pushes (0.082 failures/push) were associated with this bug yesterday.

Repository breakdown:

• autoland: 1
• mozilla-inbound: 12
• mozilla-central: 2

Platform breakdown:

• linux64: 15

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1540378&startday=2019-03-30&endday=2019-03-30&tree=all

Comment 2

[Bogdan Tara[:bogdan_tara | bogdant]]

Started retriggers:
https://treeherder.mozilla.org/#/jobs?repo=autoland&searchStr=linux%2Cx64%2Casan%2Cweb%2Cplatform%2Ctests%2Cwith%2Ce10s%2Ctest-linux64-asan%2Fopt-web-platform-tests-e10s-11%2Cw-e10s%28wpt11%29&tochange=176f099593fe4d4def8d9fd2404ad106e0eb3438&fromchange=66501cf7b6a4794d13b7dedac539dd9625801188

Comment 3

[Intermittent Failures Robot]

37 failures in 3910 pushes (0.009 failures/push) were associated with this bug in the last 7 days.

** This failure happened more than 30 times this week! Resolving this bug is a high priority. **

** Try to resolve this bug as soon as possible. If unresolved for 2 weeks, the affected test(s) may be disabled. **

Repository breakdown:

• autoland: 4
• mozilla-inbound: 14
• mozilla-central: 15
• try: 4

Platform breakdown:

• linux64: 37

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1540378&startday=2019-03-25&endday=2019-03-31&tree=all

Comment 4

[J.C. Jones [:jcj] (he/they)]

On it.

Comment 5

[J.C. Jones [:jcj] (he/they)]

Pretty sure this is the same as Bug 1540346, but I won't dupe that one until I know for sure.

Comment 6

[J.C. Jones [:jcj] (he/they)]

Pretty sure this is a cycle collection bug that has been disguised for a long time due to how we handled visibility events and their interactions with tab closures.

Bug 1448408 ("Don't listen to visibility events") changed that, which I believe has brought these to the surface. I have a potential patch being tested on ASAN try builds right now: https://treeherder.mozilla.org/#/jobs?repo=try&revision=2cccd36b67d1ddbac53a2faa62795371799bc357

Comment 7

[J.C. Jones [:jcj] (he/they)]

I think all of these are the same issue. Try run with a potential fix is running and looks promising on Linux: https://treeherder.mozilla.org/#/jobs?repo=try&revision=2cccd36b67d1ddbac53a2faa62795371799bc357

Comment 8

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1540378 - Web Authentication: Fix teardown during cycle collection

In Bug 1448408 ("Don't listen to visibility events"), it became possible to
close a tab without a visibility event to cause transactions to cancel. This
is a longstanding bug that was covered up by the visibility events. This patch
updates the cycle collection code to ensure that transactions get cleared out
safely, and we don't proceed to RejectTransaction (and subsequent code) on
already-cycle-collected objects.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d28545793e92
Web Authentication: Fix teardown during cycle collection r=keeler,mccr8

Comment 10

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/d28545793e92