1671787 - SEGV in mozilla::css::StreamLoader::~StreamLoader() (StreamLoader.cpp:27:3)

Status: RESOLVED FIXED

(Core :: Networking, defect, P2)

Description

[Hanno Boeck]

Attachment: asan-segv-css-streamloader.txt

I got a SEGV with asan builds in mozilla::css::StreamLoader::~StreamLoader(). Unfortunately doesn't seem to be reproducible.

The code looks like this is triggered by an assert, however only enabled in nightly builds:
https://searchfox.org/mozilla-central/source/layout/style/StreamLoader.cpp#27

So this might have further consequences if it happens in a non-nightly build.

Stack trace attacked.

Comment 1

[Emilio Cobos Álvarez [:emilio]]

The assert means that Necko didn't notify us properly. We have wallpapers in place for this so it's not a security issue, but is a correctness issue.

Hanno, do you have some add-ons installed? (I believe service workers or add-ons are what cause InterceptedHttpChannel). If you could share the list that may help reproducing.

Thanks for filing!

Comment 2

[Hanno Boeck]

No addons, just a plain asan build.

Comment 3

[Kershaw Chang [:kershaw]]

Looking at the stack trace, I think we can't call ReleaseListeners() if rv is an error.
In the case that rv is an error, the mListener is not assigned to the redirected channel and calling ReleaseListeners() will cause this bug.

Comment 4

[Emilio Cobos Álvarez [:emilio]]

What notifies the listeners of the error then? That's the last reference to the stream loader, and it hasn't been notified by then which is sketchy.

Comment 5

[Kershaw Chang [:kershaw]]

The listener is notified when Cancel() is called, but it's called asynchronously here.

Comment 6

[Kershaw Chang [:kershaw]]

Attachment: Bug 1671787 - Don't release the listeners if the redirected cahnnel is not opened sucesfully

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fb689a88ea88
Don't release the listeners if the redirected cahnnel is not opened sucesfully r=necko-reviewers,dragana

Comment 8

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/fb689a88ea88

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:kershaw, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Comment 10

[Kershaw Chang [:kershaw]]

I think this is no need to uplift, since this assertion is nightly only.