Closed Bug 1599554 Opened 6 years ago Closed 6 years ago

Intermittent PID 17425 | SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/ipc/chromium/src/chrome/common/ipc_channel_posix.cc:969:10 in IPC::Channel::Unsound_IsClosed() const

Categories

(Core :: IPC, defect, P5)

defect

Tracking

()

RESOLVED DUPLICATE of bug 1493656

People

(Reporter: intermittent-bug-filer, Unassigned)

Details

(Keywords: csectype-uaf, intermittent-failure, sec-high)

Filed by: nbeleuzu [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=278252615&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/IrueEQiyQuSEj8p4RA6ndw/runs/0/artifacts/public/logs/live_backing.log


[task 2019-11-26T17:17:09.278Z] 17:17:09 INFO - TEST-START | /encrypted-media/clearkey-mp4-update-disallowed-input.https.html
[task 2019-11-26T17:17:09.286Z] 17:17:09 INFO - Closing window 93
[task 2019-11-26T17:17:10.505Z] 17:17:10 INFO - PID 17425 | ###!!! [Parent][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost
[task 2019-11-26T17:17:10.506Z] 17:17:10 INFO - PID 17425 | =================================================================
[task 2019-11-26T17:17:10.507Z] 17:17:10 ERROR - PID 17425 | ==19419==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000148170 at pc 0x7ffaffac0ee3 bp 0x7ffc1c8e3a00 sp 0x7ffc1c8e39f8
[task 2019-11-26T17:17:10.508Z] 17:17:10 INFO - PID 17425 | READ of size 8 at 0x602000148170 thread T0 (Web Content)
[task 2019-11-26T17:17:11.048Z] 17:17:11 INFO - PID 17425 | #0 0x7ffaffac0ee2 in IPC::Channel::Unsound_IsClosed() const /builds/worker/workspace/build/src/ipc/chromium/src/chrome/common/ipc_channel_posix.cc:969:10
[task 2019-11-26T17:17:11.064Z] 17:17:11 INFO - PID 17425 | #1 0x7ffaffb4d265 in Unsound_IsClosed /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ipc/MessageChannel.h:310:27
[task 2019-11-26T17:17:11.064Z] 17:17:11 INFO - PID 17425 | #2 0x7ffaffb4d265 in mozilla::ipc::MessageChannel::Clear() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:752:8
[task 2019-11-26T17:17:11.064Z] 17:17:11 INFO - PID 17425 | #3 0x7ffaffb4c228 in mozilla::ipc::MessageChannel::~MessageChannel() /builds/worker/workspace/build/src/ipc/glue/MessageChannel.cpp:647:3
[task 2019-11-26T17:17:11.065Z] 17:17:11 INFO - PID 17425 | #4 0x7ffaffb7296e in mozilla::ipc::IToplevelProtocol::~IToplevelProtocol() /builds/worker/workspace/build/src/ipc/glue/ProtocolUtils.cpp:593:1
[task 2019-11-26T17:17:11.085Z] 17:17:11 INFO - PID 17425 | #5 0x7ffb0546352d in mozilla::gmp::GMPContentParent::~GMPContentParent() /builds/worker/workspace/build/src/dom/media/gmp/GMPContentParent.cpp:35:39
[task 2019-11-26T17:17:11.086Z] 17:17:11 INFO - PID 17425 | #6 0x7ffafe923c5a in operator() /builds/worker/workspace/build/src/xpcom/ds/PLDHashTable.cpp:299:7
[task 2019-11-26T17:17:11.087Z] 17:17:11 INFO - PID 17425 | #7 0x7ffafe923c5a in ForEachSlot<(lambda at /builds/worker/workspace/build/src/xpcom/ds/PLDHashTable.cpp:297:51)> /builds/worker/workspace/build/src/obj-firefox/dist/include/PLDHashTable.h:364:9
[task 2019-11-26T17:17:11.088Z] 17:17:11 INFO - PID 17425 | #8 0x7ffafe923c5a in ForEachSlot<(lambda at /builds/worker/workspace/build/src/xpcom/ds/PLDHashTable.cpp:297:51)> /builds/worker/workspace/build/src/obj-firefox/dist/include/PLDHashTable.h:354:7
[task 2019-11-26T17:17:11.089Z] 17:17:11 INFO - PID 17425 | #9 0x7ffafe923c5a in PLDHashTable::~PLDHashTable() /builds/worker/workspace/build/src/xpcom/ds/PLDHashTable.cpp:297:15
[task 2019-11-26T17:17:11.109Z] 17:17:11 INFO - PID 17425 | #10 0x7ffb054b32be in ~nsTHashtable /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTHashtable.h:382:43
[task 2019-11-26T17:17:11.111Z] 17:17:11 INFO - PID 17425 | #11 0x7ffb054b32be in ~GMPServiceChild /builds/worker/workspace/build/src/dom/media/gmp/GMPServiceChild.cpp:428:38
[task 2019-11-26T17:17:11.111Z] 17:17:11 INFO - PID 17425 | #12 0x7ffb054b32be in mozilla::gmp::GMPServiceChild::~GMPServiceChild() /builds/worker/workspace/build/src/dom/media/gmp/GMPServiceChild.cpp:428:37
[task 2019-11-26T17:17:11.112Z] 17:17:11 INFO - PID 17425 | #13 0x7ffb054b19f4 in operator() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/UniquePtr.h:486:5
[task 2019-11-26T17:17:11.114Z] 17:17:11 INFO - PID 17425 | #14 0x7ffb054b19f4 in reset /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/UniquePtr.h:323:7
[task 2019-11-26T17:17:11.114Z] 17:17:11 INFO - PID 17425 | #15 0x7ffb054b19f4 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/UniquePtr.h:296:5
[task 2019-11-26T17:17:11.115Z] 17:17:11 INFO - PID 17425 | #16 0x7ffb054b19f4 in mozilla::gmp::GeckoMediaPluginServiceChild::Observe(nsISupports*, char const*, char16_t const*) /builds/worker/workspace/build/src/dom/media/gmp/GMPServiceChild.cpp:359:21
[task 2019-11-26T17:17:11.117Z] 17:17:11 INFO - PID 17425 | #17 0x7ffb054b1adc in non-virtual thunk to mozilla::gmp::GeckoMediaPluginServiceChild::Observe(nsISupports*, char const*, char16_t const*) /builds/worker/workspace/build/src/dom/media/gmp/GMPServiceChild.cpp
[task 2019-11-26T17:17:11.117Z] 17:17:11 INFO - PID 17425 | #18 0x7ffafe947b82 in nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) /builds/worker/workspace/build/src/xpcom/ds/nsObserverList.cpp:66:19
[task 2019-11-26T17:17:11.119Z] 17:17:11 INFO - PID 17425 | #19 0x7ffafe94de3d in nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) /builds/worker/workspace/build/src/xpcom/ds/nsObserverService.cpp:291:19
[task 2019-11-26T17:17:11.121Z] 17:17:11 INFO - PID 17425 | #20 0x7ffafeadd95d in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/workspace/build/src/xpcom/build/XPCOMInit.cpp:636:24
[task 2019-11-26T17:17:11.121Z] 17:17:11 INFO - PID 17425 | #21 0x7ffb0a7df9fc in XRE_TermEmbedding() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:223:3
[task 2019-11-26T17:17:11.121Z] 17:17:11 INFO - PID 17425 | #22 0x7ffaffb7403f in mozilla::ipc::ScopedXREEmbed::Stop() /builds/worker/workspace/build/src/ipc/glue/ScopedXREEmbed.cpp:90:5
[task 2019-11-26T17:17:11.123Z] 17:17:11 INFO - PID 17425 | #23 0x7ffb0a7e07d8 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:773:16
[task 2019-11-26T17:17:11.123Z] 17:17:11 INFO - PID 17425 | #24 0x55aa72a4f93a in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
[task 2019-11-26T17:17:11.125Z] 17:17:11 INFO - PID 17425 | #25 0x55aa72a4f93a in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:272:18
[task 2019-11-26T17:17:11.161Z] 17:17:11 INFO - PID 17425 | #26 0x7ffb1fafe82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
[task 2019-11-26T17:17:11.161Z] 17:17:11 INFO - PID 17425 | #27 0x55aa729a4db8 in _start (/builds/worker/workspace/build/application/firefox/firefox+0x50db8)
[task 2019-11-26T17:17:11.161Z] 17:17:11 INFO - PID 17425 | 0x602000148170 is located 0 bytes inside of 8-byte region [0x602000148170,0x602000148178)

Group: dom-core-security
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.