1560207 - SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:525:3 in emplace<const long &>

Status: RESOLVED FIXED

(Core :: WebRTC, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 19cf79b6f07d.

==13252==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f650e9ed043 bp 0x7fffb0fbce70 sp 0x7fffb0fbce00 T0)
==13252==The signal is caused by a WRITE memory access.
==13252==Hint: address points to the zero page.
    #0 0x7f650e9ed042 in emplace<const long &> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:525:3
    #1 0x7f650e9ed042 in Construct<const long &> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/BindingDeclarations.h:153
    #2 0x7f650e9ed042 in operator() /builds/worker/workspace/build/src/dom/media/webrtc/MediaEngineTabVideoSource.cpp:223
    #3 0x7f650e9ed042 in mozilla::detail::RunnableFunction<mozilla::MediaEngineTabVideoSource::Reconfigure(mozilla::dom::MediaTrackConstraints const&, mozilla::MediaEnginePrefs const&, nsTString<char16_t> const&, char const**)::$_8>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:564
    #4 0x7f6505460b33 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1215:14
    #5 0x7f65054688f4 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
    #6 0x7f6506871b7f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:88:21
    #7 0x7f6506748ace in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #8 0x7f6506748ace in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
    #9 0x7f6506748ace in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
    #10 0x7f650fe5a563 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #11 0x7f6514158b40 in nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:276:30
    #12 0x7f65144987fa in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4639:22
    #13 0x7f651449b064 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4778:8
    #14 0x7f651449ca59 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4859:21
    #15 0x56473a58fb14 in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:213:22
    #16 0x56473a58fb14 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:295
    #17 0x7f652a171b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:525:3 in emplace<const long &>

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 2

[Andreas Pehrson [:pehrsons]]

P3 because we do not ship MediaEngineTabVideoSource.

Comment 3

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1560207 - Add crashtest. r?jib

Comment 4

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1560207 - Give Refcountable assignment operators. r?jib

Depends on D36191

Comment 5

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1560207 - Reset all settings on every settings update, to avoid double-constructing. r?jib

Depends on D36192

Comment 6

[Andreas Pehrson [:pehrsons]]

Test-only: https://treeherder.mozilla.org/#/jobs?repo=try&revision=27c9beaba737f45f687f0f5ece07f1ca393ea4ee
With fix: https://treeherder.mozilla.org/#/jobs?repo=try&revision=f4e39aaa335e1fb4a503aa8c4c66f2bae2f04fb4

These were before I added the skip-if(Android) to crashtests.list, hence the orange on the try run with the fix.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/928298bb94ab
Add crashtest. r=jib
https://hg.mozilla.org/integration/autoland/rev/610512647088
Give Refcountable assignment operators. r=jib
https://hg.mozilla.org/integration/autoland/rev/7b22a378b511
Reset all settings on every settings update, to avoid double-constructing. r=jib

Comment 8

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/928298bb94ab
https://hg.mozilla.org/mozilla-central/rev/610512647088
https://hg.mozilla.org/mozilla-central/rev/7b22a378b511