Closed Bug 1550133 Opened 5 years ago Closed 4 years ago

Intermittent /webrtc/<randomtest> | application crashed [@ sctp_add_addr_to_vrf]

Categories

(Core :: WebRTC, defect, P1)

Product:
Core
Component:
WebRTC
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla79
Tracking Flags:
Tracking Status
firefox-esr60 --- wontfix
firefox-esr68 79+ fixed
firefox-esr78 79+ fixed
firefox67 --- wontfix
firefox67.0.1 --- wontfix
firefox68 --- wontfix
firefox69 --- wontfix
firefox70 --- wontfix
firefox71 --- wontfix
firefox72 --- wontfix
firefox73 --- wontfix
firefox74 --- wontfix
firefox75 --- wontfix
firefox76 --- wontfix
firefox77 --- wontfix
firefox78 --- wontfix
firefox79 + fixed

People

(Reporter: intermittent-bug-filer, Assigned: bwc)

References

Details

(6 keywords, Whiteboard: [sec-survey][post-critsmash-triage][adv-main79+r][adv-ESR78.1+r][adv-esr68.11+r])

Crash Data

Attachments

(1 file, 1 obsolete file)

Bug 1550133: (Patch from cover bug) Repurpose DataChannelShutdown into DataChannelRegistry (which gives us some weak-pointer-like semantics)
47 bytes, text/x-phabricator-request
dveditz
: sec-approval+
Details | Review

Filed by: apavel [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=245379473&repo=autoland
Full log: https://queue.taskcluster.net/v1/task/Y4GDYZ1ESAC-KPVNxlpIaQ/runs/0/artifacts/public/logs/live_backing.log

[task 2019-05-08T18:00:18.440Z] 18:00:18 INFO - TEST-START | /webrtc/RTCPeerConnection-createDataChannel.html
[task 2019-05-08T18:00:18.443Z] 18:00:18 INFO - Closing window 47244640257
[task 2019-05-08T18:00:18.776Z] 18:00:18 INFO - PID 7775 | [Child 9186: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:330: PeerConnectionImpl: PeerConnectionImpl constructor for
[task 2019-05-08T18:00:18.777Z] 18:00:18 INFO - PID 7775 | (unknown/INFO) insert '' (registry) succeeded:
[task 2019-05-08T18:00:18.777Z] 18:00:18 INFO - PID 7775 | (registry/INFO) Initialized registry

[task 2019-05-08T18:00:29.070Z] 18:00:29 INFO - PROCESS-CRASH | /webrtc/RTCPeerConnection-createDataChannel.html | application crashed [@ sctp_add_addr_to_vrf]
[task 2019-05-08T18:00:29.070Z] 18:00:29 INFO - Crash dump filename: /tmp/tmpvwdw9t.mozrunner/minidumps/3cba321f-e9d8-bff0-c008-7602925f5746.dmp
[task 2019-05-08T18:00:29.070Z] 18:00:29 INFO - Operating system: Linux
[task 2019-05-08T18:00:29.071Z] 18:00:29 INFO - 0.0.0 Linux 4.4.0-1014-aws #14taskcluster1-Ubuntu SMP Tue Apr 3 10:27:00 UTC 2018 x86_64
[task 2019-05-08T18:00:29.071Z] 18:00:29 INFO - CPU: x86
[task 2019-05-08T18:00:29.071Z] 18:00:29 INFO - GenuineIntel family 6 model 62 stepping 4
[task 2019-05-08T18:00:29.072Z] 18:00:29 INFO - 4 CPUs
[task 2019-05-08T18:00:29.072Z] 18:00:29 INFO -
[task 2019-05-08T18:00:29.072Z] 18:00:29 INFO - GPU: UNKNOWN
[task 2019-05-08T18:00:29.072Z] 18:00:29 INFO -
[task 2019-05-08T18:00:29.073Z] 18:00:29 INFO - Crash reason: SIGSEGV /SEGV_MAPERR
[task 2019-05-08T18:00:29.073Z] 18:00:29 INFO - Crash address: 0x786d6c69
[task 2019-05-08T18:00:29.073Z] 18:00:29 INFO - Process uptime: not available
[task 2019-05-08T18:00:29.073Z] 18:00:29 INFO -
[task 2019-05-08T18:00:29.073Z] 18:00:29 INFO - Thread 0 (crashed)
[task 2019-05-08T18:00:29.074Z] 18:00:29 INFO - 0 libxul.so!sctp_add_addr_to_vrf [sctp_pcb.c:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 768 + 0x3]
[task 2019-05-08T18:00:29.074Z] 18:00:29 INFO - eip = 0xee0ede72 esp = 0xff9ed970 ebp = 0xff9ed998 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.074Z] 18:00:29 INFO - esi = 0xe5d072b0 edi = 0xe5de6240 eax = 0x786d6c69 ecx = 0xe5e5e5e5
[task 2019-05-08T18:00:29.075Z] 18:00:29 INFO - edx = 0xe4a1e1a1 efl = 0x00210282
[task 2019-05-08T18:00:29.075Z] 18:00:29 INFO - Found by: given as instruction pointer in context
[task 2019-05-08T18:00:29.075Z] 18:00:29 INFO - 1 libxul.so!usrsctp_register_address [user_socket.c:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 3328 + 0x21]
[task 2019-05-08T18:00:29.075Z] 18:00:29 INFO - eip = 0xee10ea7b esp = 0xff9ed9a0 ebp = 0xff9ed9e8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.076Z] 18:00:29 INFO - esi = 0xe6a31700 edi = 0xe6a31800
[task 2019-05-08T18:00:29.076Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.076Z] 18:00:29 INFO - 2 libxul.so!mozilla::DataChannelConnection::Init(unsigned short, unsigned short, bool, unsigned long long) [DataChannel.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 594 + 0x9]
[task 2019-05-08T18:00:29.076Z] 18:00:29 INFO - eip = 0xee110cb9 esp = 0xff9ed9f0 ebp = 0xff9eda58 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.076Z] 18:00:29 INFO - esi = 0xe6a31700 edi = 0xe6a31800
[task 2019-05-08T18:00:29.077Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.077Z] 18:00:29 INFO - 3 libxul.so!mozilla::PeerConnectionImpl::EnsureDataConnection(unsigned short, unsigned short, unsigned int, bool) [PeerConnectionImpl.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 860 + 0x1f]
[task 2019-05-08T18:00:29.077Z] 18:00:29 INFO - eip = 0xee5aa6b8 esp = 0xff9eda60 ebp = 0xff9edaa8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.077Z] 18:00:29 INFO - esi = 0xe6a31700 edi = 0xe6a3ea60
[task 2019-05-08T18:00:29.078Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.079Z] 18:00:29 INFO - 4 libxul.so!mozilla::PeerConnectionImpl::CreateDataChannel(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, unsigned short, bool, unsigned short, unsigned short, bool, unsigned short, nsDOMDataChannel**) [PeerConnectionImpl.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 1087 + 0x1b]
[task 2019-05-08T18:00:29.080Z] 18:00:29 INFO - eip = 0xee5ab571 esp = 0xff9edab0 ebp = 0xff9edb98 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.080Z] 18:00:29 INFO - esi = 0xe6a3ea60 edi = 0xff9edbd0
[task 2019-05-08T18:00:29.080Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.081Z] 18:00:29 INFO - 5 libxul.so!mozilla::PeerConnectionImpl::CreateDataChannel(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, unsigned short, bool, unsigned short, unsigned short, bool, unsigned short, mozilla::ErrorResult&) [PeerConnectionImpl.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 1065 + 0x23]
[task 2019-05-08T18:00:29.082Z] 18:00:29 INFO - eip = 0xee5ab4ed esp = 0xff9edba0 ebp = 0xff9edbe8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.082Z] 18:00:29 INFO - esi = 0x00000000 edi = 0xff9edbd0
[task 2019-05-08T18:00:29.083Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.083Z] 18:00:29 INFO - 6 libxul.so!mozilla::dom::PeerConnectionImpl_Binding::createDataChannel(JSContext*, JS::Handle<JSObject*>, mozilla::PeerConnectionImpl*, JSJitMethodCallArgs const&) [PeerConnectionImplBinding.cpp: : 1864 + 0x61]
[task 2019-05-08T18:00:29.083Z] 18:00:29 INFO - eip = 0xeedc4cad esp = 0xff9edbf0 ebp = 0xff9edda8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.084Z] 18:00:29 INFO - esi = 0x00000001 edi = 0x00000000
[task 2019-05-08T18:00:29.084Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.084Z] 18:00:29 INFO - 7 libxul.so!bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) [BindingUtils.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 3153 + 0x18]
[task 2019-05-08T18:00:29.085Z] 18:00:29 INFO - eip = 0xf1369e7b esp = 0xff9eddb0 ebp = 0xff9ede38 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.086Z] 18:00:29 INFO - esi = 0xff9ede08 edi = 0xe900d800
[task 2019-05-08T18:00:29.086Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.087Z] 18:00:29 INFO - 8 0x32121212
[task 2019-05-08T18:00:29.087Z] 18:00:29 INFO - eip = 0x32121212 esp = 0xff9ede40 ebp = 0xff9edeb8 ebx = 0xe75f7e80
[task 2019-05-08T18:00:29.088Z] 18:00:29 INFO - esi = 0xff9ede68 edi = 0xe5f49db8
[task 2019-05-08T18:00:29.088Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.089Z] 18:00:29 INFO - 9 0xe5f49db8
[task 2019-05-08T18:00:29.089Z] 18:00:29 INFO - eip = 0xe5f49db8 esp = 0xff9edec0 ebp = 0xff9edfac
[task 2019-05-08T18:00:29.089Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.090Z] 18:00:29 INFO - 10 0x3211a6ab
[task 2019-05-08T18:00:29.091Z] 18:00:29 INFO - eip = 0x3211a6ab esp = 0xff9edfb4 ebp = 0xff9edfe8
[task 2019-05-08T18:00:29.091Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.091Z] 18:00:29 INFO - 11 libxul.so!js::jit::MaybeEnterJit(JSContext*, js::RunState&) [Jit.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 195 + 0x33b]
[task 2019-05-08T18:00:29.091Z] 18:00:29 INFO - eip = 0xf16221f2 esp = 0xff9edff0 ebp = 0xff9ee228
[task 2019-05-08T18:00:29.092Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.092Z] 18:00:29 INFO - 12 libxul.so!js::RunScript(JSContext*, js::RunState&) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 408 + 0xd]
[task 2019-05-08T18:00:29.093Z] 18:00:29 INFO - eip = 0xf143550e esp = 0xff9ee230 ebp = 0xff9ee268 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.094Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xff9ee298
[task 2019-05-08T18:00:29.094Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.095Z] 18:00:29 INFO - 13 libxul.so!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 563 + 0xd]
[task 2019-05-08T18:00:29.095Z] 18:00:29 INFO - eip = 0xf1448aea esp = 0xff9ee270 ebp = 0xff9ee318 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.096Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xe9054c00
[task 2019-05-08T18:00:29.097Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.097Z] 18:00:29 INFO - 14 libxul.so!JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) [jsapi.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 2647 + 0xac]
[task 2019-05-08T18:00:29.097Z] 18:00:29 INFO - eip = 0xf14f4620 esp = 0xff9ee320 ebp = 0xff9ee3c8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.097Z] 18:00:29 INFO - esi = 0xf528b470 edi = 0xff9ee458
[task 2019-05-08T18:00:29.097Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.097Z] 18:00:29 INFO - 15 libxul.so!mozilla::dom::RTCPeerConnectionJSImpl::CreateDataChannel(nsTSubstring<char16_t> const&, mozilla::dom::RTCDataChannelInit const&, mozilla::ErrorResult&, JS::Realm*) [RTCPeerConnectionBinding.cpp: : 8644 + 0x25]
[task 2019-05-08T18:00:29.098Z] 18:00:29 INFO - eip = 0xeee367c5 esp = 0xff9ee3d0 ebp = 0xff9ee668 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.098Z] 18:00:29 INFO - esi = 0xff9ee508 edi = 0xe900d800
[task 2019-05-08T18:00:29.099Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.100Z] 18:00:29 INFO - 16 libxul.so!mozilla::dom::RTCPeerConnection_Binding::createDataChannel(JSContext*, JS::Handle<JSObject*>, mozilla::dom::RTCPeerConnection*, JSJitMethodCallArgs const&) [RTCPeerConnectionBinding.cpp: : 5567 + 0x30]
[task 2019-05-08T18:00:29.100Z] 18:00:29 INFO - eip = 0xeee827bb esp = 0xff9ee670 ebp = 0xff9ee848 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.100Z] 18:00:29 INFO - esi = 0xe900d848 edi = 0xff9ee810
[task 2019-05-08T18:00:29.100Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.101Z] 18:00:29 INFO - 17 libxul.so!bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) [BindingUtils.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 3153 + 0x18]
[task 2019-05-08T18:00:29.101Z] 18:00:29 INFO - eip = 0xf1369e7b esp = 0xff9ee850 ebp = 0xff9ee8d8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.102Z] 18:00:29 INFO - esi = 0xff9ee8a8 edi = 0xe900d800
[task 2019-05-08T18:00:29.102Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.103Z] 18:00:29 INFO - 18 libxul.so!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 535 + 0x12f]
[task 2019-05-08T18:00:29.103Z] 18:00:29 INFO - eip = 0xf144899a esp = 0xff9ee8e0 ebp = 0xff9ee988 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.104Z] 18:00:29 INFO - esi = 0xff9ef198 edi = 0xe900d800
[task 2019-05-08T18:00:29.104Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.104Z] 18:00:29 INFO - 19 libxul.so!Interpret(JSContext*, js::RunState&) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 590 + 0x17]
[task 2019-05-08T18:00:29.104Z] 18:00:29 INFO - eip = 0xf1442e5a esp = 0xff9ee990 ebp = 0xff9ef268 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.105Z] 18:00:29 INFO - esi = 0xf528b470 edi = 0xe83ed178
[task 2019-05-08T18:00:29.105Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.105Z] 18:00:29 INFO - 20 libxul.so!js::RunScript(JSContext*, js::RunState&) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 423 + 0x9]
[task 2019-05-08T18:00:29.106Z] 18:00:29 INFO - eip = 0xf1435592 esp = 0xff9ef270 ebp = 0xff9ef298 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.106Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xff9ef2c8
[task 2019-05-08T18:00:29.107Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.107Z] 18:00:29 INFO - 21 libxul.so!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 563 + 0xd]
[task 2019-05-08T18:00:29.108Z] 18:00:29 INFO - eip = 0xf1448aea esp = 0xff9ef2a0 ebp = 0xff9ef348 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.109Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xe76ebc00
[task 2019-05-08T18:00:29.109Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.110Z] 18:00:29 INFO - 22 libxul.so!js::fun_call(JSContext*, unsigned int, JS::Value*) [JSFunction.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 1115 + 0xa1]
[task 2019-05-08T18:00:29.111Z] 18:00:29 INFO - eip = 0xf262d0c7 esp = 0xff9ef350 ebp = 0xff9ef408 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.112Z] 18:00:29 INFO - esi = 0xff9ef720 edi = 0xf528b470
[task 2019-05-08T18:00:29.112Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.112Z] 18:00:29 INFO - 23 libxul.so!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 535 + 0x12f]
[task 2019-05-08T18:00:29.113Z] 18:00:29 INFO - eip = 0xf144899a esp = 0xff9ef410 ebp = 0xff9ef4b8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.113Z] 18:00:29 INFO - esi = 0xff9ef560 edi = 0xe900d800
[task 2019-05-08T18:00:29.113Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.113Z] 18:00:29 INFO - 24 libxul.so!js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) [BaselineIC.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 3763 + 0x87]
[task 2019-05-08T18:00:29.114Z] 18:00:29 INFO - eip = 0xf1587376 esp = 0xff9ef4c0 ebp = 0xff9ef6c8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.114Z] 18:00:29 INFO - esi = 0xf52c7000 edi = 0x00000000
[task 2019-05-08T18:00:29.114Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.114Z] 18:00:29 INFO - 25 0x3211c1fd
[task 2019-05-08T18:00:29.115Z] 18:00:29 INFO - eip = 0x3211c1fd esp = 0xff9ef6d0 ebp = 0xff9ef738 ebx = 0xff9ef6fc
[task 2019-05-08T18:00:29.115Z] 18:00:29 INFO - esi = 0xe6f0b780 edi = 0xe5fa30b0
[task 2019-05-08T18:00:29.115Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.115Z] 18:00:29 INFO - 26 0xe5fa30b0
[task 2019-05-08T18:00:29.116Z] 18:00:29 INFO - eip = 0xe5fa30b0 esp = 0xff9ef740 ebp = 0xff9ef7cc
[task 2019-05-08T18:00:29.116Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.116Z] 18:00:29 INFO - 27 0x3211a565
[task 2019-05-08T18:00:29.116Z] 18:00:29 INFO - eip = 0x3211a565 esp = 0xff9ef7d4 ebp = 0xff9ef80c
[task 2019-05-08T18:00:29.117Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.117Z] 18:00:29 INFO - 28 0x3211a6ab
[task 2019-05-08T18:00:29.117Z] 18:00:29 INFO - eip = 0x3211a6ab esp = 0xff9ef814 ebp = 0xff9ef848
[task 2019-05-08T18:00:29.117Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.118Z] 18:00:29 INFO - 29 libxul.so!js::jit::MaybeEnterJit(JSContext*, js::RunState&) [Jit.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 195 + 0x33b]
[task 2019-05-08T18:00:29.118Z] 18:00:29 INFO - eip = 0xf16221f2 esp = 0xff9ef850 ebp = 0xff9efa88
[task 2019-05-08T18:00:29.118Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.118Z] 18:00:29 INFO - 30 libxul.so!Interpret(JSContext*, js::RunState&) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 3129 + 0x7]
[task 2019-05-08T18:00:29.119Z] 18:00:29 INFO - eip = 0xf1442816 esp = 0xff9efa90 ebp = 0xff9f0368 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.119Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xf52c7000
[task 2019-05-08T18:00:29.119Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.119Z] 18:00:29 INFO - 31 libxul.so!js::RunScript(JSContext*, js::RunState&) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 423 + 0x9]
[task 2019-05-08T18:00:29.120Z] 18:00:29 INFO - eip = 0xf1435592 esp = 0xff9f0370 ebp = 0xff9f0398 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.120Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xff9f03c8
[task 2019-05-08T18:00:29.120Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.120Z] 18:00:29 INFO - 32 libxul.so!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 563 + 0xd]
[task 2019-05-08T18:00:29.121Z] 18:00:29 INFO - eip = 0xf1448aea esp = 0xff9f03a0 ebp = 0xff9f0448 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.121Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xe76ebc00
[task 2019-05-08T18:00:29.121Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.121Z] 18:00:29 INFO - 33 libxul.so!js::fun_apply(JSContext*, unsigned int, JS::Value*) [JSFunction.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 1184 + 0xb4]
[task 2019-05-08T18:00:29.122Z] 18:00:29 INFO - eip = 0xf262d56c esp = 0xff9f0450 ebp = 0xff9f06f8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.122Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xff9f06a8
[task 2019-05-08T18:00:29.122Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.122Z] 18:00:29 INFO - 34 libxul.so!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 535 + 0x12f]
[task 2019-05-08T18:00:29.123Z] 18:00:29 INFO - eip = 0xf144899a esp = 0xff9f0700 ebp = 0xff9f07a8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.123Z] 18:00:29 INFO - esi = 0xff9f0850 edi = 0xe900d800
[task 2019-05-08T18:00:29.123Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.124Z] 18:00:29 INFO - 35 libxul.so!js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) [BaselineIC.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 3763 + 0x87]
[task 2019-05-08T18:00:29.124Z] 18:00:29 INFO - eip = 0xf1587376 esp = 0xff9f07b0 ebp = 0xff9f09b8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.124Z] 18:00:29 INFO - esi = 0xf52c7000 edi = 0x00000000
[task 2019-05-08T18:00:29.125Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.125Z] 18:00:29 INFO - 36 0x3211c1fd
[task 2019-05-08T18:00:29.125Z] 18:00:29 INFO - eip = 0x3211c1fd esp = 0xff9f09c0 ebp = 0xff9f0a30 ebx = 0xff9f09ec
[task 2019-05-08T18:00:29.125Z] 18:00:29 INFO - esi = 0xe865e528 edi = 0xe6f93490
[task 2019-05-08T18:00:29.126Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.126Z] 18:00:29 INFO - 37 0xe6f93490
[task 2019-05-08T18:00:29.126Z] 18:00:29 INFO - eip = 0xe6f93490 esp = 0xff9f0a38 ebp = 0xff9f0abc
[task 2019-05-08T18:00:29.127Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.127Z] 18:00:29 INFO - 38 0x3213bf29
[task 2019-05-08T18:00:29.127Z] 18:00:29 INFO - eip = 0x3213bf29 esp = 0xff9f0ac4 ebp = 0xff9f0af8
[task 2019-05-08T18:00:29.128Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.128Z] 18:00:29 INFO - 39 0xe5f1a550
[task 2019-05-08T18:00:29.128Z] 18:00:29 INFO - eip = 0xe5f1a550 esp = 0xff9f0b00 ebp = 0xff9f0b8c
[task 2019-05-08T18:00:29.129Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.129Z] 18:00:29 INFO - 40 0x3211a565
[task 2019-05-08T18:00:29.129Z] 18:00:29 INFO - eip = 0x3211a565 esp = 0xff9f0b94 ebp = 0xff9f0bcc
[task 2019-05-08T18:00:29.130Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.130Z] 18:00:29 INFO - 41 0x3211a6ab
[task 2019-05-08T18:00:29.130Z] 18:00:29 INFO - eip = 0x3211a6ab esp = 0xff9f0bd4 ebp = 0xff9f0c08
[task 2019-05-08T18:00:29.131Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.131Z] 18:00:29 INFO - 42 libxul.so!js::jit::MaybeEnterJit(JSContext*, js::RunState&) [Jit.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 195 + 0x33b]
[task 2019-05-08T18:00:29.131Z] 18:00:29 INFO - eip = 0xf16221f2 esp = 0xff9f0c10 ebp = 0xff9f0e48
[task 2019-05-08T18:00:29.132Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.132Z] 18:00:29 INFO - 43 libxul.so!js::RunScript(JSContext*, js::RunState&) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 408 + 0xd]
[task 2019-05-08T18:00:29.132Z] 18:00:29 INFO - eip = 0xf143550e esp = 0xff9f0e50 ebp = 0xff9f0e88 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.133Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xff9f0eb8
[task 2019-05-08T18:00:29.133Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.134Z] 18:00:29 INFO - 44 libxul.so!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 563 + 0xd]
[task 2019-05-08T18:00:29.134Z] 18:00:29 INFO - eip = 0xf1448aea esp = 0xff9f0e90 ebp = 0xff9f0f38 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.134Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xe76ebc00
[task 2019-05-08T18:00:29.134Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.135Z] 18:00:29 INFO - 45 libxul.so!js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) [BaselineIC.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 3763 + 0x87]
[task 2019-05-08T18:00:29.135Z] 18:00:29 INFO - eip = 0xf1587376 esp = 0xff9f0f40 ebp = 0xff9f1148 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.135Z] 18:00:29 INFO - esi = 0xff9f1164 edi = 0xe900d800
[task 2019-05-08T18:00:29.136Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.136Z] 18:00:29 INFO - 46 0x3211c1fd
[task 2019-05-08T18:00:29.136Z] 18:00:29 INFO - eip = 0x3211c1fd esp = 0xff9f1150 ebp = 0xff9f11c0 ebx = 0xff9f117c
[task 2019-05-08T18:00:29.137Z] 18:00:29 INFO - esi = 0x32168039 edi = 0xe5f9acf0
[task 2019-05-08T18:00:29.137Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.137Z] 18:00:29 INFO - 47 0xe5f9acf0
[task 2019-05-08T18:00:29.138Z] 18:00:29 INFO - eip = 0xe5f9acf0 esp = 0xff9f11c8 ebp = 0xff9f122c
[task 2019-05-08T18:00:29.138Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.138Z] 18:00:29 INFO - 48 0x3211a6ab
[task 2019-05-08T18:00:29.138Z] 18:00:29 INFO - eip = 0x3211a6ab esp = 0xff9f1234 ebp = 0xff9f1258
[task 2019-05-08T18:00:29.139Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.139Z] 18:00:29 INFO - 49 libxul.so!js::jit::EnterBaselineAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*) [BaselineJIT.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 195 + 0xe6]
[task 2019-05-08T18:00:29.139Z] 18:00:29 INFO - eip = 0xf159ce2e esp = 0xff9f1260 ebp = 0xff9f13a8
[task 2019-05-08T18:00:29.139Z] 18:00:29 INFO - Found by: previous frame's frame pointer
[task 2019-05-08T18:00:29.140Z] 18:00:29 INFO - 50 libxul.so!Interpret(JSContext*, js::RunState&) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 1989 + 0x14]
[task 2019-05-08T18:00:29.140Z] 18:00:29 INFO - eip = 0xf1436969 esp = 0xff9f13b0 ebp = 0xff9f1c88 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.140Z] 18:00:29 INFO - esi = 0x00000000 edi = 0xffffff83
[task 2019-05-08T18:00:29.141Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.141Z] 18:00:29 INFO - 51 libxul.so!js::RunScript(JSContext*, js::RunState&) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 423 + 0x9]
[task 2019-05-08T18:00:29.141Z] 18:00:29 INFO - eip = 0xf1435592 esp = 0xff9f1c90 ebp = 0xff9f1cb8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.141Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xff9f1cd0
[task 2019-05-08T18:00:29.142Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.142Z] 18:00:29 INFO - 52 libxul.so!js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 782 + 0xd]
[task 2019-05-08T18:00:29.142Z] 18:00:29 INFO - eip = 0xf259bd23 esp = 0xff9f1cc0 ebp = 0xff9f1d18 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.142Z] 18:00:29 INFO - esi = 0x00000000 edi = 0xff9f1cf0
[task 2019-05-08T18:00:29.143Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.143Z] 18:00:29 INFO - 53 libxul.so!js::Execute(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value*) [Interpreter.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 815 + 0x19]
[task 2019-05-08T18:00:29.143Z] 18:00:29 INFO - eip = 0xf259be7f esp = 0xff9f1d20 ebp = 0xff9f1d98 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.143Z] 18:00:29 INFO - esi = 0xff9f1df0 edi = 0xff9f1d68
[task 2019-05-08T18:00:29.144Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.144Z] 18:00:29 INFO - 54 libxul.so!ExecuteScript(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSScript*>, JS::Value*) [CompilationAndEvaluation.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 435 + 0x13]
[task 2019-05-08T18:00:29.144Z] 18:00:29 INFO - eip = 0xf25f67b1 esp = 0xff9f1da0 ebp = 0xff9f1dc8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.144Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xff9f1e28
[task 2019-05-08T18:00:29.145Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.145Z] 18:00:29 INFO - 55 libxul.so!ExecuteScript(JSContext*, JS::Handle<JS::StackGCVector<JSObject*, js::TempAllocPolicy> >, JS::Handle<JSScript*>, JS::Value*) [CompilationAndEvaluation.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 455 + 0x13]
[task 2019-05-08T18:00:29.145Z] 18:00:29 INFO - eip = 0xf25f692d esp = 0xff9f1dd0 ebp = 0xff9f1e48 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.146Z] 18:00:29 INFO - esi = 0xe900d800 edi = 0xff9f1e28
[task 2019-05-08T18:00:29.146Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.146Z] 18:00:29 INFO - 56 libxul.so!JS_ExecuteScript(JSContext*, JS::Handle<JS::StackGCVector<JSObject*, js::TempAllocPolicy> >, JS::Handle<JSScript*>) [CompilationAndEvaluation.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 479 + 0x1c]
[task 2019-05-08T18:00:29.146Z] 18:00:29 INFO - eip = 0xf25f69e4 esp = 0xff9f1e50 ebp = 0xff9f1e68 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.147Z] 18:00:29 INFO - esi = 0xff9f1fe0 edi = 0xe81a01d0
[task 2019-05-08T18:00:29.147Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.147Z] 18:00:29 INFO - 57 libxul.so!mozilla::dom::ExecuteCompiledScript(JSContext*, mozilla::dom::ScriptLoadRequest*, nsJSUtils::ExecutionContext&) [ScriptLoader.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 2498 + 0x29]
[task 2019-05-08T18:00:29.147Z] 18:00:29 INFO - eip = 0xf20df60b esp = 0xff9f1e70 ebp = 0xff9f1eb8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.148Z] 18:00:29 INFO - esi = 0xff9f1fe0 edi = 0xe81a01d0
[task 2019-05-08T18:00:29.148Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.148Z] 18:00:29 INFO - 58 libxul.so!mozilla::dom::ScriptLoader::EvaluateScript(mozilla::dom::ScriptLoadRequest*) [ScriptLoader.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 2718 + 0x17]
[task 2019-05-08T18:00:29.149Z] 18:00:29 INFO - eip = 0xf20de81f esp = 0xff9f1ec0 ebp = 0xff9f2148 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.149Z] 18:00:29 INFO - esi = 0xe7e0a900 edi = 0xe8f3b910
[task 2019-05-08T18:00:29.149Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.149Z] 18:00:29 INFO - 59 libxul.so!mozilla::dom::ScriptLoader::ProcessRequest(mozilla::dom::ScriptLoadRequest*) [ScriptLoader.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 2225 + 0x7]
[task 2019-05-08T18:00:29.150Z] 18:00:29 INFO - eip = 0xf20dc4e6 esp = 0xff9f2150 ebp = 0xff9f2198 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.150Z] 18:00:29 INFO - esi = 0x00000000 edi = 0xe816c1c0
[task 2019-05-08T18:00:29.150Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.150Z] 18:00:29 INFO - 60 libxul.so!mozilla::dom::ScriptLoader::ProcessScriptElement(nsIScriptElement*) [ScriptLoader.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 1529 + 0x246]
[task 2019-05-08T18:00:29.151Z] 18:00:29 INFO - eip = 0xf20d16d4 esp = 0xff9f21a0 ebp = 0xff9f2478 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.151Z] 18:00:29 INFO - esi = 0xe7e0a900 edi = 0xe8fe9450
[task 2019-05-08T18:00:29.151Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.151Z] 18:00:29 INFO - 61 libxul.so!mozilla::dom::ScriptElement::MaybeProcessScript() [ScriptElement.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 118 + 0x9]
[task 2019-05-08T18:00:29.152Z] 18:00:29 INFO - eip = 0xf20d0025 esp = 0xff9f2480 ebp = 0xff9f24b8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.153Z] 18:00:29 INFO - esi = 0xe7d49448 edi = 0xe816c1c0
[task 2019-05-08T18:00:29.153Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.153Z] 18:00:29 INFO - 62 libxul.so!nsHtml5TreeOpExecutor::RunScript(nsIContent*) [nsHtml5TreeOpExecutor.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 727 + 0xc]
[task 2019-05-08T18:00:29.154Z] 18:00:29 INFO - eip = 0xf1a59458 esp = 0xff9f24c0 ebp = 0xff9f24f8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.154Z] 18:00:29 INFO - esi = 0xe816a8b4 edi = 0xe7d49448
[task 2019-05-08T18:00:29.154Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.155Z] 18:00:29 INFO - 63 libxul.so!nsHtml5TreeOpExecutor::RunFlushLoop() [nsHtml5TreeOpExecutor.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 530 + 0x7]
[task 2019-05-08T18:00:29.155Z] 18:00:29 INFO - eip = 0xf131c5e6 esp = 0xff9f2500 ebp = 0xff9f2568 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.155Z] 18:00:29 INFO - esi = 0xe81585f0 edi = 0xff9f2538
[task 2019-05-08T18:00:29.156Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.156Z] 18:00:29 INFO - 64 libxul.so!nsHtml5ExecutorReflusher::Run() [nsHtml5TreeOpExecutor.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 68 + 0x8]
[task 2019-05-08T18:00:29.156Z] 18:00:29 INFO - eip = 0xf1a5be12 esp = 0xff9f2570 ebp = 0xff9f2598 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.156Z] 18:00:29 INFO - esi = 0xe81a0040 edi = 0xe7d23800
[task 2019-05-08T18:00:29.156Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.156Z] 18:00:29 INFO - 65 libxul.so!mozilla::SchedulerGroup::Runnable::Run() [SchedulerGroup.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 295 + 0xb]
[task 2019-05-08T18:00:29.157Z] 18:00:29 INFO - eip = 0xedd27917 esp = 0xff9f25a0 ebp = 0xff9f25b8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.157Z] 18:00:29 INFO - esi = 0xf7062e00 edi = 0xe81a0180
[task 2019-05-08T18:00:29.157Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.157Z] 18:00:29 INFO - 66 libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 1180 + 0x8]
[task 2019-05-08T18:00:29.158Z] 18:00:29 INFO - eip = 0xf12e6905 esp = 0xff9f25c0 ebp = 0xff9f2aa8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.158Z] 18:00:29 INFO - esi = 0xf7062e00 edi = 0x00000000
[task 2019-05-08T18:00:29.158Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.159Z] 18:00:29 INFO - 67 libxul.so!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [MessagePump.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 88 + 0x17]
[task 2019-05-08T18:00:29.159Z] 18:00:29 INFO - eip = 0xf18a6409 esp = 0xff9f2ab0 ebp = 0xff9f2af8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.159Z] 18:00:29 INFO - esi = 0xf7062e00 edi = 0xf70ceb01
[task 2019-05-08T18:00:29.160Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.160Z] 18:00:29 INFO - 68 libxul.so!mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) [MessagePump.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 271 + 0xf]
[task 2019-05-08T18:00:29.160Z] 18:00:29 INFO - eip = 0xee14c06b esp = 0xff9f2b00 ebp = 0xff9f2b28 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.160Z] 18:00:29 INFO - esi = 0xff9f2bf8 edi = 0xff9f2bf8
[task 2019-05-08T18:00:29.161Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.161Z] 18:00:29 INFO - 69 libxul.so!MessageLoop::Run() [message_loop.cc:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 290 + 0xc]
[task 2019-05-08T18:00:29.162Z] 18:00:29 INFO - eip = 0xf1892bc1 esp = 0xff9f2b30 ebp = 0xff9f2b58 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.162Z] 18:00:29 INFO - esi = 0xf7062e00 edi = 0xf70ceb50
[task 2019-05-08T18:00:29.162Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.163Z] 18:00:29 INFO - 70 libxul.so!nsBaseAppShell::Run() [nsBaseAppShell.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 137 + 0xd]
[task 2019-05-08T18:00:29.163Z] 18:00:29 INFO - eip = 0xeff716e6 esp = 0xff9f2b60 ebp = 0xff9f2b78 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.163Z] 18:00:29 INFO - esi = 0xf7062e00 edi = 0xf70ceb50
[task 2019-05-08T18:00:29.163Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.164Z] 18:00:29 INFO - 71 libxul.so!XRE_RunAppShell() [nsEmbedFunctions.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 919 + 0x8]
[task 2019-05-08T18:00:29.164Z] 18:00:29 INFO - eip = 0xf0e910c7 esp = 0xff9f2b80 ebp = 0xff9f2b98 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.164Z] 18:00:29 INFO - esi = 0xf7089800 edi = 0xf7089800
[task 2019-05-08T18:00:29.165Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.165Z] 18:00:29 INFO - 72 libxul.so!MessageLoop::Run() [message_loop.cc:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 290 + 0xc]
[task 2019-05-08T18:00:29.165Z] 18:00:29 INFO - eip = 0xf1892bc1 esp = 0xff9f2ba0 ebp = 0xff9f2bc8 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.166Z] 18:00:29 INFO - esi = 0xf7089800 edi = 0xf7089800
[task 2019-05-08T18:00:29.166Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.166Z] 18:00:29 INFO - 73 libxul.so!XRE_InitChildProcess(int, char**, XREChildData const*) [nsEmbedFunctions.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 757 + 0xe]
[task 2019-05-08T18:00:29.167Z] 18:00:29 INFO - eip = 0xf0e90e88 esp = 0xff9f2bd0 ebp = 0xff9f2d38 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.167Z] 18:00:29 INFO - esi = 0xf7089800 edi = 0xf7089800
[task 2019-05-08T18:00:29.167Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.168Z] 18:00:29 INFO - 74 libxul.so!mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) [Bootstrap.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 67 + 0x11]
[task 2019-05-08T18:00:29.168Z] 18:00:29 INFO - eip = 0xf0e96032 esp = 0xff9f2d40 ebp = 0xff9f2d58 ebx = 0xf52c7000
[task 2019-05-08T18:00:29.168Z] 18:00:29 INFO - esi = 0xf7012388 edi = 0x00000013
[task 2019-05-08T18:00:29.168Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.169Z] 18:00:29 INFO - 75 firefox-bin!content_process_main(mozilla::Bootstrap*, int, char**) [plugin-container.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 56 + 0xe]
[task 2019-05-08T18:00:29.169Z] 18:00:29 INFO - eip = 0x566387d8 esp = 0xff9f2d60 ebp = 0xff9f2d88 ebx = 0x5666e000
[task 2019-05-08T18:00:29.169Z] 18:00:29 INFO - esi = 0xf7012388 edi = 0x00000013
[task 2019-05-08T18:00:29.169Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.170Z] 18:00:29 INFO - 76 firefox-bin!main [nsBrowserApp.cpp:616fc2abbbec6c4e8d0bcf00ee682745c24674bb : 263 + 0x10]
[task 2019-05-08T18:00:29.170Z] 18:00:29 INFO - eip = 0x56638990 esp = 0xff9f2d90 ebp = 0xff9f2dc8 ebx = 0x5666e000
[task 2019-05-08T18:00:29.170Z] 18:00:29 INFO - esi = 0x00000014 edi = 0xff9f2e64
[task 2019-05-08T18:00:29.170Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.170Z] 18:00:29 INFO - 77 libc-2.23.so + 0x18637
[task 2019-05-08T18:00:29.171Z] 18:00:29 INFO - eip = 0xf72f4637 esp = 0xff9f2dd0 ebp = 0x00000000 ebx = 0x00000000
[task 2019-05-08T18:00:29.171Z] 18:00:29 INFO - esi = 0xf748e000 edi = 0xf748e000
[task 2019-05-08T18:00:29.171Z] 18:00:29 INFO - Found by: call frame info
[task 2019-05-08T18:00:29.171Z] 18:00:29 INFO - 78 libc-2.23.so + 0x1b2000
[task 2019-05-08T18:00:29.171Z] 18:00:29 INFO - eip = 0xf748e000 esp = 0xff9f2dec ebp = 0x00000000
[task 2019-05-08T18:00:29.171Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.172Z] 18:00:29 INFO - 79 ld-2.23.so + 0x24c04
[task 2019-05-08T18:00:29.172Z] 18:00:29 INFO - eip = 0xf7715c04 esp = 0xff9f2df0 ebp = 0x00000000
[task 2019-05-08T18:00:29.172Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.172Z] 18:00:29 INFO - 80 ld-2.23.so + 0x24000
[task 2019-05-08T18:00:29.172Z] 18:00:29 INFO - eip = 0xf7715000 esp = 0xff9f2df4 ebp = 0x00000000
[task 2019-05-08T18:00:29.173Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.173Z] 18:00:29 INFO - 81 libc-2.23.so + 0x1b2000
[task 2019-05-08T18:00:29.173Z] 18:00:29 INFO - eip = 0xf748e000 esp = 0xff9f2dfc ebp = 0x00000000
[task 2019-05-08T18:00:29.173Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.174Z] 18:00:29 INFO - 82 libc-2.23.so + 0x1b2000
[task 2019-05-08T18:00:29.174Z] 18:00:29 INFO - eip = 0xf748e000 esp = 0xff9f2e00 ebp = 0x00000000
[task 2019-05-08T18:00:29.174Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.175Z] 18:00:29 INFO - 83 firefox-bin + 0x1f61c
[task 2019-05-08T18:00:29.175Z] 18:00:29 INFO - eip = 0x5665161c esp = 0xff9f2e20 ebp = 0x00000000
[task 2019-05-08T18:00:29.175Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.175Z] 18:00:29 INFO - 84 ld-2.23.so + 0x15010
[task 2019-05-08T18:00:29.175Z] 18:00:29 INFO - eip = 0xf7706010 esp = 0xff9f2e28 ebp = 0x00000000
[task 2019-05-08T18:00:29.176Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.176Z] 18:00:29 INFO - 85 ld-2.23.so + 0xf880
[task 2019-05-08T18:00:29.176Z] 18:00:29 INFO - eip = 0xf7700880 esp = 0xff9f2e2c ebp = 0x00000000
[task 2019-05-08T18:00:29.176Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.176Z] 18:00:29 INFO - 86 firefox-bin!_fini + 0xa6bc
[task 2019-05-08T18:00:29.177Z] 18:00:29 INFO - eip = 0x5666e000 esp = 0xff9f2e30 ebp = 0x00000000
[task 2019-05-08T18:00:29.177Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.177Z] 18:00:29 INFO - 87 firefox-bin + 0x1f61c
[task 2019-05-08T18:00:29.177Z] 18:00:29 INFO - eip = 0x5665161c esp = 0xff9f2e38 ebp = 0x00000000
[task 2019-05-08T18:00:29.178Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.178Z] 18:00:29 INFO - 88 firefox-bin!_start + 0x31
[task 2019-05-08T18:00:29.178Z] 18:00:29 INFO - eip = 0x5665164d esp = 0xff9f2e40 ebp = 0x00000000
[task 2019-05-08T18:00:29.178Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.178Z] 18:00:29 INFO - 89 firefox-bin + 0x6850
[task 2019-05-08T18:00:29.178Z] 18:00:29 INFO - eip = 0x56638850 esp = 0xff9f2e44 ebp = 0x00000000
[task 2019-05-08T18:00:29.179Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.179Z] 18:00:29 INFO - 90 firefox-bin!__libc_csu_fini + 0x10
[task 2019-05-08T18:00:29.179Z] 18:00:29 INFO - eip = 0x566638b0 esp = 0xff9f2e50 ebp = 0xff9f2e64
[task 2019-05-08T18:00:29.179Z] 18:00:29 INFO - Found by: stack scanning
[task 2019-05-08T18:00:29.180Z] 18:00:29 INFO - 91 0xff9f3e2f
[task 2019-05-08T18:00:29.180Z] 18:00:29 INFO - eip = 0xff9f3e2f esp = 0xff9f2e6c ebp = 0xff9f3df0
[task 2019-05-08T18:00:29.180Z] 18:00:29 INFO - Found by: previous frame's frame pointer

The priority flag is not set for this bug.
:drno, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(drno)

Sec bug; note the crash address, and also if you look at the (few) crashes in the last 6 months, most appear to be spurious memory reads or writes; generally at the same address fingered here (LIST_INSERT_HEAD(hash_addr_head, sctp_ifap, next_bucket);) while initializing a DataChannelConnection (usrsctp_register_address()). Very low volume.

Interesting and useful that we've had multiple failures recently here in automation. Perhaps related to SCTP timer changes? (quite possibly not, but that's the thing that has changed most here recently IIRC)

The older 59 crashes are linker artifacts; the real crashes are in 63-66.

Group: media-core-security
status-firefox67: --- → affected
status-firefox67.0.1: --- → affected
status-firefox68: --- → affected
status-firefox69: --- → affected
status-firefox-esr60: --- → ?
Keywords: csectype-wildptr, sec-high

Nico, can you please take a look at this?

Assignee: nobody → na-g
Flags: needinfo?(drno) → needinfo?(na-g)
Priority: -- → P1

The two failures last week were on shippable Linux builds, on different machines, about 15 minutes apart.

Flags: needinfo?(na-g)

Nico, anything we can do here to get an idea what could cause this?
If not we should mark it 'stalled' for now.

Flags: needinfo?(na-g)

Nils, I'll take another look before marking it stalled.

Nico, can you take a look at this again? There are some new crash reports in.

Looking at the call stack here reminds me that we have another bug report where we appear to call PeerConnectionImpl::EnsureDataConnection multiple times which leads to hangs. Which makes me wonder if these multiple calls could in this case result in crashes instead.

Nils, thanks for that info. I haven't had much luck getting it to reproduce so far. That is an avenue I can explore.

Crash Signature: [@ sctp_add_addr_to_vrf] → [@ sctp_add_addr_to_vrf] [@ memchr]

The memchr crash signature looks to me more like a nICEr related crash, e.g. https://crash-stats.mozilla.org/report/index/6cf77f6f-4f45-453e-8cff-958a80190921#tab-details
Byron does that nICEr related crash look like fallout from the socket process related work?

Crash Signature: [@ sctp_add_addr_to_vrf] [@ memchr] → [@ sctp_add_addr_to_vrf] [@ memchr]
Flags: needinfo?(docfaraday)

Possibly. This might be bug 1577719. This crash happened on beta before that bug was uplifted. Let's see if the frequency changes any.

Flags: needinfo?(docfaraday)

Beta 11 and 12 look good so far, but let's wait a bit to close this to make sure.

Summary: Intermittent /webrtc/RTCPeerConnection-createDataChannel.html | application crashed [@ sctp_add_addr_to_vrf] → Intermittent /webrtc/<randomtest> | application crashed [@ sctp_add_addr_to_vrf]

[Tracking Requested - why for this release]:

I'm not seeing any recent Desktop crashes (a 71 Nightly this month, but it was an early September build), but there's a whole bunch of UAF Fennec 68.1.1 crashes like bp-7ed9f281-9c39-4fdd-a3b2-f6f040191018

status-firefox-esr68: --- → affected
tracking-firefox-esr68: --- → ?
Keywords: csectype-uaf

If comment 25 is correct, we shouldn't see any reports from 68.2.0, however. So far, so good, AFAICT.

status-firefox70: ? → affected
status-firefox71: ? → affected
status-firefox-esr60: ? → wontfix

Too late for a fix in 70 at this point.

status-firefox70: affected → wontfix
status-firefox72: --- → ?

There are still UAF-looking crashes in 68.2.1 and 68.3. And some in desktop 68.3 / 71 as well, though nothing yet in 72 beta.

There's still definitely a UAF race condition here. Appears to be easier to hit on Android from the bug reports (timing I assume).

Crash is on LIST_INSERT at https://hg.mozilla.org/releases/mozilla-esr68/annotate/fd17b62d5247816244c319271800ef1df2697c82/netwerk/sctp/src/netinet/sctp_pcb.c#l768

Dan, can you help find someone to investigate?

status-firefox72: ? → wontfix
status-firefox73: --- → affected
status-firefox74: --- → affected
Flags: needinfo?(dminor)

None of the memchr crashes for the last three months were related to data channels, so I'm going to remove that from the crash signature. I'm not sure I'll have any more luck with this than Nico, but maybe a fresh pair of eyes will help.

Assignee: na-g → dminor
Crash Signature: [@ sctp_add_addr_to_vrf] [@ memchr] → [@ sctp_add_addr_to_vrf]
Flags: needinfo?(na-g)
Flags: needinfo?(dminor)

Dan have you been able to find any new leads on this, or is time to mark this stale?

Flags: needinfo?(dminor)

I spent some time this afternoon. Like Randell mentioned above, it looks like we're running into trouble inserting the address into a linked list. Perhaps that list is being corrupted by a previous use of a DataChannel? I don't see any obvious candidates for a timing problem that would otherwise explain the use-after-free. The function is enormous which makes it difficult to reason about. I've checked against upstream and there appear to be no relevant changes to file. I'm going to mark this stalled and try some rr runs overnight. If those turn anything up, I'll comment here. Otherwise, I don't have any new ideas on this one.

Flags: needinfo?(dminor)
Keywords: stalled

lgrahl, tuexen: Thoughts on any possible race conditions that might impact this> See comment 41 and comment 35 and comment 4. Thanks!

Flags: needinfo?(tuexen)
Flags: needinfo?(lennart.grahl)

(In reply to Randell Jesup [:jesup] (needinfo me) from comment #43)

lgrahl, tuexen: Thoughts on any possible race conditions that might impact this> See comment 41 and comment 35 and comment 4. Thanks!

Sorry, not really. Hoping that Michael has some insights.

Flags: needinfo?(lennart.grahl)

I can double check if we always own the mutex we are supposed to own by looking at the code. Will do and report.

Flags: needinfo?(tuexen)

(In reply to Michael Tüxen from comment #45)

I can double check if we always own the mutex we are supposed to own by looking at the code. Will do and report.

Any update on this?

Flags: needinfo?(tuexen)

We're calling usrsctp_deregister_address on STS, but usrsctp_register_address on main. I'm guessing that's not something we ought to be doing...

Assignee: dminor → docfaraday

We may need to move more of these usrsctp calls to STS. Might be able to spin this as a threading cleanup in a cover bug.

I think I see a way to fix both this bug and bug 1642792, and make it look like code cleanup. It will take a little time to get it right though, but we've needed to clean up this code for a long time.

(In reply to Byron Campen [:bwc] from comment #48)

(In reply to Michael Tüxen from comment #45)

I can double check if we always own the mutex we are supposed to own by looking at the code. Will do and report.

Any update on this?

Some places look suspicious. I'll add asserts to make sure I catch missing ones or that there are none missing.

Flags: needinfo?(tuexen)
Depends on: 1645219

Filed cover bug 1645219.

Comment on attachment 9156314 [details]
Bug 1550133: (Patch from cover bug) Repurpose DataChannelShutdown into DataChannelRegistry (which gives us some weak-pointer-like semantics)

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: Probably pretty difficult. Looks like cleanup, but someone with an eagle-eye might note the threading change in how usrsctp_register_address is called, and guess that there's a sec bug that is being fixed.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which older supported branches are affected by this flaw?: all
  • If not all supported branches, which bug introduced the flaw?: None
  • Do you have backports for the affected branches?: No
  • If not, how different, hard to create, and risky will they be?: I'm not sure if the patch will apply cleanly, but if not I don't think it will be too difficult to create backports.
  • How likely is this patch to cause regressions; how much testing does it need?: This code is still pretty fragile/crufty, so we may want to be cautious.
Attachment #9156314 - Flags: sec-approval?
Attachment #9154308 - Attachment is obsolete: true

Comment on attachment 9156314 [details]
Bug 1550133: (Patch from cover bug) Repurpose DataChannelShutdown into DataChannelRegistry (which gives us some weak-pointer-like semantics)

sec-approval+

Attachment #9156314 - Flags: sec-approval? → sec-approval+

I suspect we do not want to uplift this to Fx78 given the size of the patch and potential fragility vs the infrequency of the crash. We will want to uplift to ESR-78, but maybe Fx78.1 is a safer target.

https://hg.mozilla.org/integration/autoland/rev/cc9bea1151d389e78bd61afeb53bf929e5e235c4

Agreed that letting this ride 79/78.1esr seems reasonable, though that's cutting it really close on the disclosure deadline for bug 1642792. Do we have any flexibility there? The patch does graft cleanly to Beta78, but it'll need a rebased patch for ESR68.

status-firefox78: affected → wontfix
tracking-firefox79: --- → +
tracking-firefox-esr78: --- → 79+
Keywords: stalled

https://hg.mozilla.org/mozilla-central/rev/5048d0cf94c7

Status: NEW → RESOLVED
Closed: 4 years ago
status-firefox79: affected → fixed
status-firefox-esr68: fix-optional → affected
tracking-firefox-esr68: ? → 79+
Resolution: --- → FIXED
Target Milestone: --- → mozilla79

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

Flags: needinfo?(docfaraday)
Whiteboard: [sec-survey]
Flags: needinfo?(docfaraday)
Group: media-core-security → core-security-release
Flags: qe-verify-
Whiteboard: [sec-survey] → [sec-survey][post-critsmash-triage]

Is bug 1645219 ready for an ESR78 approval request? Also, we'll need a rebased patch for ESR68 assuming this is something we wanted to fix there too.

Flags: needinfo?(docfaraday)
Flags: needinfo?(docfaraday)

Some additional asserts have been added in https://github.com/sctplab/usrsctp/commit/2c5953eef4ec6c05f4765d100c38582dd13026e1 and I also rearranged the addition of address such that the lock is not given up during checking/adding.
During testing none of the asserts were firing...

Whiteboard: [sec-survey][post-critsmash-triage] → [sec-survey][post-critsmash-triage][adv-main79+r]
Whiteboard: [sec-survey][post-critsmash-triage][adv-main79+r] → [sec-survey][post-critsmash-triage][adv-main79+r][adv-ESR78.1+r]
Whiteboard: [sec-survey][post-critsmash-triage][adv-main79+r][adv-ESR78.1+r] → [sec-survey][post-critsmash-triage][adv-main79+r][adv-ESR78.1+r][adv-esr68.11+r]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: