Closed Bug 1660307 Opened 4 years ago Closed 4 years ago

WebSocketImpl may clear nsWeakPtr members on different thread where they were created.

Categories

(Core :: Networking: WebSockets, defect, P2)

Product:
Core
Component:
Networking: WebSockets
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
89 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- wontfix
firefox87 --- wontfix
firefox88 --- wontfix
firefox89 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: kershaw)

References

Details

(5 keywords, Whiteboard: [necko-triaged][post-critsmash-triage][adv-main89+r])

Crash Data

Attachments

(1 file, 1 obsolete file)

Bug 1660307 - Get rid off nsSupportsWeakReference for WebSocketImpl, r=baku
48 bytes, text/x-phabricator-request
Details | Review

Filed by: archaeopteryx [at] coole-files.de
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=313298595&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/XAF8UbajRjGXmDND9uYZaQ/runs/0/artifacts/public/logs/live_backing.log

[task 2020-08-18T07:15:23.313Z] 07:15:23 INFO - GECKO(1540) | Hit MOZ_CRASH(nsWeakReference not thread-safe) at /builds/worker/checkouts/gecko/xpcom/base/nsISupportsImpl.cpp:41
[task 2020-08-18T07:15:23.315Z] 07:15:23 INFO - Initializing stack-fixing for the first stack frame, this may take a while...
[task 2020-08-18T07:15:23.317Z] 07:15:23 INFO - fix-stacks error: failed to run /Users/cltbld/tasks/task_1597733797/build/tests/bin/fileid for /Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL
[task 2020-08-18T07:15:23.318Z] 07:15:23 INFO - GECKO(1540) | #01: BeaverTriple_areEqual [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0xc2e58]
[task 2020-08-18T07:15:23.318Z] 07:15:23 INFO - GECKO(1540) | #02: mac_plugin_interposing_child_OnShowCursor [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x41d007b]
[task 2020-08-18T07:15:23.319Z] 07:15:23 INFO - GECKO(1540) | #03: nsXPTCStubBase::Stub249() [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x879366]
[task 2020-08-18T07:15:23.325Z] 07:15:23 INFO - GECKO(1540) | #04: nsXPTCStubBase::Stub249() [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x879124]
[task 2020-08-18T07:15:23.325Z] 07:15:23 INFO - GECKO(1540) | #05: nsXPTCStubBase::Stub249() [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x87944e]
[task 2020-08-18T07:15:23.325Z] 07:15:23 INFO - GECKO(1540) | #06: nsXPTCStubBase::Stub249() [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x8774ad]
[task 2020-08-18T07:15:23.326Z] 07:15:23 INFO - GECKO(1540) | #07: NS_NewLocalFileWithCFURL [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x180d3d]
[task 2020-08-18T07:15:23.326Z] 07:15:23 INFO - GECKO(1540) | #08: NS_NewLocalFileWithCFURL [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x18073b]
[task 2020-08-18T07:15:23.326Z] 07:15:23 INFO - GECKO(1540) | #09: NS_NewLocalFileWithCFURL [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x18aea2]
[task 2020-08-18T07:15:23.326Z] 07:15:23 INFO - GECKO(1540) | #10: NS_NewLocalFileWithCFURL [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x19106c]
[task 2020-08-18T07:15:23.326Z] 07:15:23 INFO - GECKO(1540) | #11: nsXPTCStubBase::Stub249() [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x35c923]
[task 2020-08-18T07:15:23.326Z] 07:15:23 INFO - GECKO(1540) | #12: nsXPTCStubBase::Stub249() [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x35d77d]
[task 2020-08-18T07:15:23.327Z] 07:15:23 INFO - GECKO(1540) | #13: NS_NewLocalFileWithCFURL [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x18aea2]
[task 2020-08-18T07:15:23.327Z] 07:15:23 INFO - GECKO(1540) | #14: NS_NewLocalFileWithCFURL [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x19106c]
[task 2020-08-18T07:15:23.327Z] 07:15:23 INFO - GECKO(1540) | #15: nsXPTCStubBase::Stub249() [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x9fd378]
[task 2020-08-18T07:15:23.327Z] 07:15:23 INFO - GECKO(1540) | #16: nsXPTCStubBase::Stub249() [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x98af1e]
[task 2020-08-18T07:15:23.327Z] 07:15:23 INFO - GECKO(1540) | #17: NS_NewLocalFileWithCFURL [/Users/cltbld/tasks/task_1597733797/build/application/Firefox NightlyDebug.app/Contents/MacOS/XUL + 0x1871ad]
[task 2020-08-18T07:15:23.588Z] 07:15:23 INFO - GECKO(1540) | #18: _pt_root [nsprpub/pr/src/pthreads/ptthread.c:204]
[task 2020-08-18T07:15:23.596Z] 07:15:23 INFO - fix-stacks error: failed to read breakpad symbols dir /Users/cltbld/tasks/task_1597733797/build/symbols/libsystem_pthread.dylib for /usr/lib/system/libsystem_pthread.dylib
[task 2020-08-18T07:15:23.596Z] 07:15:23 INFO - fix-stacks note: this is expected and harmless for system libraries on debug automation runs
[task 2020-08-18T07:15:23.596Z] 07:15:23 INFO - GECKO(1540) | #19: _pthread_body [/usr/lib/system/libsystem_pthread.dylib + 0x32eb]
[task 2020-08-18T07:15:23.599Z] 07:15:23 INFO - GECKO(1540) | #20: _pthread_start [/usr/lib/system/libsystem_pthread.dylib + 0x6249]
[task 2020-08-18T07:15:23.602Z] 07:15:23 INFO - GECKO(1540) | Exiting due to channel error.
[task 2020-08-18T07:15:23.602Z] 07:15:23 INFO - GECKO(1540) | Exiting due to channel error.
[task 2020-08-18T07:15:23.603Z] 07:15:23 INFO - GECKO(1540) | Exiting due to channel error.
[task 2020-08-18T07:15:23.603Z] 07:15:23 INFO - GECKO(1540) | Exiting due to channel error.
[task 2020-08-18T07:15:23.603Z] 07:15:23 INFO - GECKO(1540) | Exiting due to channel error.
[task 2020-08-18T07:15:23.669Z] 07:15:23 INFO - TEST-INFO | Main app process: exit 1
[task 2020-08-18T07:15:23.669Z] 07:15:23 INFO - TEST-INFO | Confirming we saw 149 DOCSHELL created and 140 destroyed log strings.
[task 2020-08-18T07:15:23.669Z] 07:15:23 INFO - TEST-INFO | Confirming we saw 507 DOMWINDOW created and 488 destroyed log strings.
[task 2020-08-18T07:15:23.669Z] 07:15:23 INFO - Buffered messages finished
[task 2020-08-18T07:15:23.671Z] 07:15:23 ERROR - TEST-UNEXPECTED-FAIL | Last test finished | application terminated with exit code 1
[task 2020-08-18T07:15:23.671Z] 07:15:23 INFO - runtests.py | Application ran for: 0:02:07.536574
[task 2020-08-18T07:15:23.672Z] 07:15:23 INFO - zombiecheck | Reading PID log: /var/folders/hb/p0xn8jpx1v1_hj7xfw2ncp6h000017/T/tmpKNdhoipidlog
[task 2020-08-18T07:15:23.672Z] 07:15:23 INFO - ==> process 1540 launched child process 1541
[task 2020-08-18T07:15:23.672Z] 07:15:23 INFO - ==> process 1540 launched child process 1542
[task 2020-08-18T07:15:23.672Z] 07:15:23 INFO - ==> process 1540 launched child process 1543
[task 2020-08-18T07:15:23.672Z] 07:15:23 INFO - ==> process 1540 launched child process 1544
[task 2020-08-18T07:15:23.672Z] 07:15:23 INFO - ==> process 1540 launched child process 1545
[task 2020-08-18T07:15:23.672Z] 07:15:23 INFO - ==> process 1540 launched child process 1546
[task 2020-08-18T07:15:23.672Z] 07:15:23 INFO - zombiecheck | Checking for orphan process with PID: 1541
[task 2020-08-18T07:15:23.672Z] 07:15:23 INFO - zombiecheck | Checking for orphan process with PID: 1542
[task 2020-08-18T07:15:23.673Z] 07:15:23 INFO - zombiecheck | Checking for orphan process with PID: 1543
[task 2020-08-18T07:15:23.673Z] 07:15:23 INFO - zombiecheck | Checking for orphan process with PID: 1544
[task 2020-08-18T07:15:23.673Z] 07:15:23 INFO - zombiecheck | Checking for orphan process with PID: 1545
[task 2020-08-18T07:15:23.673Z] 07:15:23 INFO - zombiecheck | Checking for orphan process with PID: 1546
[task 2020-08-18T07:15:23.673Z] 07:15:23 INFO - mozcrash Copy/paste: /Users/cltbld/tasks/task_1597733797/fetches/minidump_stackwalk/minidump_stackwalk /var/folders/hb/p0xn8jpx1v1_hj7xfw2ncp6h000017/T/tmpuvN9x0.mozrunner/minidumps/5990929A-EF8C-4DC4-9174-5F03CE5E2FE4.dmp /Users/cltbld/tasks/task_1597733797/build/symbols
[task 2020-08-18T07:15:29.338Z] 07:15:29 INFO - mozcrash Saved minidump as /Users/cltbld/tasks/task_1597733797/build/blobber_upload_dir/5990929A-EF8C-4DC4-9174-5F03CE5E2FE4.dmp
[task 2020-08-18T07:15:29.338Z] 07:15:29 INFO - mozcrash Saved app info as /Users/cltbld/tasks/task_1597733797/build/blobber_upload_dir/5990929A-EF8C-4DC4-9174-5F03CE5E2FE4.extra
[task 2020-08-18T07:15:29.504Z] 07:15:29 INFO - PROCESS-CRASH | Last test finished | application crashed [@ nsAutoOwningThread::AssertCurrentThreadOwnsMe(char const*) const]
[task 2020-08-18T07:15:29.504Z] 07:15:29 INFO - Mozilla crash reason: nsWeakReference not thread-safe
[task 2020-08-18T07:15:29.504Z] 07:15:29 INFO - Crash dump filename: /var/folders/hb/p0xn8jpx1v1_hj7xfw2ncp6h000017/T/tmpuvN9x0.mozrunner/minidumps/5990929A-EF8C-4DC4-9174-5F03CE5E2FE4.dmp
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - Operating system: Mac OS X
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - 10.14.5 18F132
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - CPU: amd64
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - family 6 model 69 stepping 1
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - 4 CPUs
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO -
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - GPU: UNKNOWN
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO -
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - Crash reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - Crash address: 0x0
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - Process uptime: 127 seconds
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO -
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - Thread 5 (crashed)
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - 0 XUL!nsAutoOwningThread::AssertCurrentThreadOwnsMe(char const*) const [nsISupportsImpl.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 41 + 0x1e]
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - rax = 0x0000000103039500 rdx = 0x0000000000000000
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - rcx = 0x000070000c0060ac rbx = 0x000000010324f250
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - rsi = 0x00000000000120a8 rdi = 0x00007fff9baf9028
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - rbp = 0x000070000c004f40 rsp = 0x000070000c004f30
[task 2020-08-18T07:15:29.505Z] 07:15:29 INFO - r8 = 0x00000000000130a8 r9 = 0x00007fff9baf9048
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - r10 = 0x0000000000000000 r11 = 0x00007fff9baf9040
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - r12 = 0x00000001263b9ad0 r13 = 0x00000001263b9800
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - r14 = 0x000000010f1ec196 r15 = 0x00000001263b9a68
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rip = 0x00000001055060da
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - Found by: given as instruction pointer in context
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - 1 XUL!nsSupportsWeakReference::ClearWeakReferences() [nsWeakReference.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 157 + 0x13]
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rbp = 0x000070000c004f60 rsp = 0x000070000c004f50
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rip = 0x0000000105520e58
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - 2 XUL!mozilla::dom::WebSocketImpl::Release() [WebSocket.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 242 + 0x5b]
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rbp = 0x000070000c004f80 rsp = 0x000070000c004f70
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rip = 0x000000010962e07b
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - 3 XUL!mozilla::net::BaseWebSocketChannel::~BaseWebSocketChannel() [BaseWebSocketChannel.h:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 24 + 0x96]
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rbp = 0x000070000c004fa0 rsp = 0x000070000c004f90
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rip = 0x0000000105cd7366
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - 4 XUL!mozilla::net::WebSocketChannel::~WebSocketChannel() [WebSocketChannel.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 1180 + 0x46e]
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rbp = 0x000070000c004ff0 rsp = 0x000070000c004fb0
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rip = 0x0000000105cd7124
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - 5 XUL!mozilla::net::WebSocketChannel::~WebSocketChannel() [WebSocketChannel.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 1151 + 0xe]
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rbp = 0x000070000c005010 rsp = 0x000070000c005000
[task 2020-08-18T07:15:29.506Z] 07:15:29 INFO - rip = 0x0000000105cd744e
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - 6 XUL!{virtual override thunk({offset(-184)}, mozilla::net::WebSocketChannel::Release())} + 0x6d
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rbp = 0x000070000c005040 rsp = 0x000070000c005020
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rip = 0x0000000105cd54ad
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - 7 XUL!nsTimerImpl::Fire(int) [nsTimerImpl.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 597 + 0x55]
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rbp = 0x000070000c0050e0 rsp = 0x000070000c005050
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rip = 0x00000001055ded3d
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - 8 XUL!nsTimerEvent::Run() [TimerThread.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 251 + 0x15]
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rbp = 0x000070000c005110 rsp = 0x000070000c0050f0
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rip = 0x00000001055de73b
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - 9 XUL!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 1242 + 0x16]
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rbp = 0x000070000c005630 rsp = 0x000070000c005120
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rip = 0x00000001055e8ea2
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - 10 XUL!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 513 + 0xd]
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rbp = 0x000070000c005660 rsp = 0x000070000c005640
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rip = 0x00000001055ef06c
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - 11 XUL!mozilla::net::nsSocketTransportService::Run() [nsSocketTransportService2.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 1195 + 0xe]
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rbp = 0x000070000c005710 rsp = 0x000070000c005670
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - rip = 0x00000001057ba923
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.507Z] 07:15:29 INFO - 12 XUL!{virtual override thunk({offset(-32)}, mozilla::net::nsSocketTransportService::Run())} + 0xd
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rbp = 0x000070000c005720 rsp = 0x000070000c005720
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rip = 0x00000001057bb77d
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - 13 XUL!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 1242 + 0x16]
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rbp = 0x000070000c005c40 rsp = 0x000070000c005730
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rip = 0x00000001055e8ea2
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - 14 XUL!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 513 + 0xd]
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rbp = 0x000070000c005c70 rsp = 0x000070000c005c50
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rip = 0x00000001055ef06c
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - 15 XUL!mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) [MessagePump.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 332 + 0xd]
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rbp = 0x000070000c005cc0 rsp = 0x000070000c005c80
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rip = 0x0000000105e5b378
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - 16 XUL!MessageLoop::Run() [message_loop.cc:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 309 + 0x5]
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rbp = 0x000070000c005cf0 rsp = 0x000070000c005cd0
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rip = 0x0000000105de8f1e
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - 17 XUL!nsThread::ThreadFunc(void*) [nsThread.cpp:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 450 + 0x8]
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rbp = 0x000070000c005ed0 rsp = 0x000070000c005d00
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - rip = 0x00000001055e51ad
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.508Z] 07:15:29 INFO - 18 libnss3.dylib!_pt_root [ptthread.c:483ef87aa6e85cb340d1c17b5b87bb7c217fb3b8 : 201 + 0xa]
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - rbp = 0x000070000c005f10 rsp = 0x000070000c005ee0
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - rip = 0x0000000103484fb1
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - 19 libsystem_pthread.dylib!_pthread_body + 0x7e
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - rbp = 0x000070000c005f30 rsp = 0x000070000c005f20
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - rip = 0x00007fff653852eb
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - 20 libsystem_pthread.dylib!_pthread_start + 0x42
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - rbp = 0x000070000c005f50 rsp = 0x000070000c005f40
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - rip = 0x00007fff65388249
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - 21 libsystem_pthread.dylib!thread_start + 0xd
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - rbp = 0x000070000c005f78 rsp = 0x000070000c005f60
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - rip = 0x00007fff6538440d
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - Found by: previous frame's frame pointer
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - 22 libnss3.dylib + 0x184e80
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - rsp = 0x000070000c006090 rip = 0x0000000103484e80
[task 2020-08-18T07:15:29.509Z] 07:15:29 INFO - Found by: stack scanning

Assignee: nobody → dd.mozilla
Status: NEW → ASSIGNED
See Also: → 1666205
Group: network-core-security
Keywords: csectype-race, csectype-uaf, sec-moderate
Summary: Intermittent Last test finished | application crashed [@ nsAutoOwningThread::AssertCurrentThreadOwnsMe(char const*) const] → WebSocketImpl may clear nsWeakPtr members on different thread where they were created.

bug 1663533 is another instance of this

I noticed this occuring earlier today in a test run. It appears that it's caused by the shared use of NS_DECL_THREADSAFE_ISUPPORTS alongside nsSupportsWeakReference on WebSocketImpl (https://searchfox.org/mozilla-central/rev/927e525f481a93a8f63d27a78ae6201e42b1b1fb/dom/websocket/WebSocket.cpp#86,95)

We should perhaps consider adding a static assertion in MOZ_ASSERT_TYPE_OK_FOR_REFCOUNTING like:

static_assert(!decltype(std::declval<_class>().mRefCnt)::isThreadSafe || !std::is_base_of_v<nsSupportsWeakReference, _class>);

(although I suppose this might not work properly, I can't remember how this will interact with privacy etc.)

Flags: needinfo?(dd.mozilla)
Flags: needinfo?(dd.mozilla) → needinfo?(ytausky)
Assignee: dd.mozilla → ytausky
Flags: needinfo?(ytausky)

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:ytausky, could you have a look please?
For more information, please visit auto_nag documentation.

Flags: needinfo?(ytausky)
Flags: needinfo?(dd.mozilla)
Flags: needinfo?(dd.mozilla)

I've found that bug 1555322 might be also related to this bug.
Fix this bug should be also to fix bug 1555322 as well.

Steal this from Yaron.

Assignee: ytausky → kershaw
Severity: normal → S3
Priority: -- → P2
Whiteboard: [necko-triaged]
Attachment #9202019 - Attachment is obsolete: true

Get rid off nsSupportsWeakReference for WebSocketImpl, r=baku
https://hg.mozilla.org/integration/autoland/rev/e3a7a6111dfe2de8fcf5a3cbedf5ea3e4834ead4
https://hg.mozilla.org/mozilla-central/rev/e3a7a6111dfe

Group: network-core-security → core-security-release
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox89: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 89 Branch

Backout for regression noticed by kershaw:
https://hg.mozilla.org/integration/autoland/rev/2f42ad8d79f43370229d2b907493c60a2a3fea74

Status: RESOLVED → REOPENED
status-firefox89: fixed → ---
Flags: needinfo?(kershaw)
Resolution: FIXED → ---
Target Milestone: 89 Branch → ---
No longer blocks: 1663533

The patch was landed again.

Flags: needinfo?(ytausky)
Flags: needinfo?(kershaw)
Flags: qe-verify-
Whiteboard: [necko-triaged] → [necko-triaged][post-critsmash-triage]
Whiteboard: [necko-triaged][post-critsmash-triage] → [necko-triaged][post-critsmash-triage][adv-main89+r]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: