Closed Bug 1678463 Opened 4 years ago Closed 3 years ago

Intermittent netwerk/test/unit/test_ping_aboutnetworking.js | application crashed [@ nsAutoOwningEventTarget::AssertCurrentThreadOwnsMe(char const*) const]

Categories

(Core :: IPC, defect)

defect

Tracking

()

RESOLVED FIXED
86 Branch
Tracking Status
firefox-esr78 --- unaffected
firefox83 --- wontfix
firefox84 --- wontfix
firefox85 --- wontfix
firefox86 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: nika)

Details

(4 keywords, Whiteboard: [post-critsmash-triage][adv-main86+r])

Crash Data

Attachments

(3 files)

Filed by: nbeleuzu [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=322338507&repo=mozilla-beta
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/BnYH_syKT5usKZvgszKVjw/runs/0/artifacts/public/logs/live_backing.log


[task 2020-11-19T19:56:36.182Z] 19:56:36  WARNING -  PROCESS-CRASH | netwerk/test/unit/test_ping_aboutnetworking.js | application crashed [@ nsAutoOwningEventTarget::AssertCurrentThreadOwnsMe(char const*) const]
[task 2020-11-19T19:56:36.183Z] 19:56:36     INFO -  Mozilla crash reason: ActorLifecycleProxy not thread-safe
[task 2020-11-19T19:56:36.184Z] 19:56:36     INFO -  Crash dump filename: /tmp/xpc-other-kzRvBK/0844b875-5b17-f9ca-bd35-b37f7712555f.dmp
[task 2020-11-19T19:56:36.185Z] 19:56:36     INFO -  Operating system: Linux
[task 2020-11-19T19:56:36.186Z] 19:56:36     INFO -                    0.0.0 Linux 4.4.0-1014-aws #14taskcluster1-Ubuntu SMP Tue Apr 3 10:27:00 UTC 2018 x86_64
[task 2020-11-19T19:56:36.187Z] 19:56:36     INFO -  CPU: amd64
[task 2020-11-19T19:56:36.188Z] 19:56:36     INFO -       family 6 model 85 stepping 7
[task 2020-11-19T19:56:36.189Z] 19:56:36     INFO -       2 CPUs
[task 2020-11-19T19:56:36.190Z] 19:56:36     INFO -  GPU: UNKNOWN
[task 2020-11-19T19:56:36.191Z] 19:56:36     INFO -  Crash reason:  SIGSEGV /SEGV_MAPERR
[task 2020-11-19T19:56:36.191Z] 19:56:36     INFO -  Crash address: 0x0
[task 2020-11-19T19:56:36.192Z] 19:56:36     INFO -  Process uptime: not available
[task 2020-11-19T19:56:36.193Z] 19:56:36     INFO -  Thread 2 (crashed)
[task 2020-11-19T19:56:36.194Z] 19:56:36     INFO -   0  libxul.so!nsAutoOwningEventTarget::AssertCurrentThreadOwnsMe(char const*) const [nsISupportsImpl.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 62 + 0x1e]
[task 2020-11-19T19:56:36.195Z] 19:56:36     INFO -      rax = 0x000055d8313b5308   rdx = 0x0000000000000000
[task 2020-11-19T19:56:36.196Z] 19:56:36     INFO -      rcx = 0x0000000000000b40   rbx = 0x00007f0efcb5708e
[task 2020-11-19T19:56:36.197Z] 19:56:36     INFO -      rsi = 0x00007f0efb0448b0   rdi = 0x00007f0efb043680
[task 2020-11-19T19:56:36.198Z] 19:56:36     INFO -      rbp = 0x00007f0ef03bb990   rsp = 0x00007f0ef03bb980
[task 2020-11-19T19:56:36.199Z] 19:56:36     INFO -       r8 = 0x00007f0efb0448b0    r9 = 0x00007f0ef03bd700
[task 2020-11-19T19:56:36.200Z] 19:56:36     INFO -      r10 = 0x0000000000000002   r11 = 0x0000000000000000
[task 2020-11-19T19:56:36.201Z] 19:56:36     INFO -      r12 = 0x00007f0ef0c97100   r13 = 0x0000000000000001
[task 2020-11-19T19:56:36.202Z] 19:56:36     INFO -      r14 = 0x00007f0ef0cf9c50   r15 = 0x000002d7d12c92f2
[task 2020-11-19T19:56:36.204Z] 19:56:36     INFO -      rip = 0x00007f0effc7115a
[task 2020-11-19T19:56:36.204Z] 19:56:36     INFO -      Found by: given as instruction pointer in context
[task 2020-11-19T19:56:36.205Z] 19:56:36     INFO -   1  libxul.so!mozilla::ipc::ActorLifecycleProxy::Release() [ProtocolUtils.h:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 862 + 0x1e]
[task 2020-11-19T19:56:36.206Z] 19:56:36     INFO -      rbx = 0x00007f0ef0c54840   rbp = 0x00007f0ef03bb9b0
[task 2020-11-19T19:56:36.207Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bb9a0   r12 = 0x00007f0ef0c97100
[task 2020-11-19T19:56:36.208Z] 19:56:36     INFO -      r13 = 0x0000000000000001   r14 = 0x00007f0ef0cf9c50
[task 2020-11-19T19:56:36.209Z] 19:56:36     INFO -      r15 = 0x000002d7d12c92f2   rip = 0x00007f0f0035b7a8
[task 2020-11-19T19:56:36.210Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.210Z] 19:56:36     INFO -   2  libxul.so!std::_Function_base::_Base_manager<mozilla::net::PSocketProcessChild::OnMessageReceived(IPC::Message const&)::$_4>::_M_manager(std::_Any_data&, std::_Any_data const&, std::_Manager_operation) [std_function.h : 231 + 0x15]
[task 2020-11-19T19:56:36.211Z] 19:56:36     INFO -      rbx = 0x00007f0ef0c02930   rbp = 0x00007f0ef03bb9e0
[task 2020-11-19T19:56:36.213Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bb9c0   r12 = 0x00007f0ef0c97100
[task 2020-11-19T19:56:36.213Z] 19:56:36     INFO -      r13 = 0x0000000000000001   r14 = 0x00007f0ef0cf9c50
[task 2020-11-19T19:56:36.214Z] 19:56:36     INFO -      r15 = 0x000002d7d12c92f2   rip = 0x00007f0f005d6400
[task 2020-11-19T19:56:36.215Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.216Z] 19:56:36     INFO -   3  libxul.so!mozilla::net::(anonymous namespace)::DataResolver<nsTArray<mozilla::net::DNSCacheEntries>, std::function<void (nsTArray<mozilla::net::DNSCacheEntries>&&)> >::~DataResolver() [SocketProcessChild.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 526 + 0x33]
[task 2020-11-19T19:56:36.217Z] 19:56:36     INFO -      rbx = 0x00007f0ef0cf9c40   rbp = 0x00007f0ef03bba00
[task 2020-11-19T19:56:36.218Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bb9f0   r12 = 0x00007f0ef0c97100
[task 2020-11-19T19:56:36.219Z] 19:56:36     INFO -      r13 = 0x0000000000000001   r14 = 0x00007f0ef0cf7b20
[task 2020-11-19T19:56:36.219Z] 19:56:36     INFO -      r15 = 0x000002d7d12c92f2   rip = 0x00007f0f00285d0f
[task 2020-11-19T19:56:36.220Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.221Z] 19:56:36     INFO -   4  libxul.so!mozilla::detail::RunnableFunction<mozilla::net::SocketProcessChild::RecvGetDNSCacheEntries(std::function<void (nsTArray<mozilla::net::DNSCacheEntries>&&)>&&)::$_2>::~RunnableFunction() [nsThreadUtils.h:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 568 + 0x2a]
[task 2020-11-19T19:56:36.222Z] 19:56:36     INFO -      rbx = 0x00007f0ef0cf7b20   rbp = 0x00007f0ef03bba20
[task 2020-11-19T19:56:36.223Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bba10   r12 = 0x00007f0ef0c97100
[task 2020-11-19T19:56:36.223Z] 19:56:36     INFO -      r13 = 0x0000000000000001   r14 = 0x00007f0ef0cf7b20
[task 2020-11-19T19:56:36.224Z] 19:56:36     INFO -      r15 = 0x000002d7d12c92f2   rip = 0x00007f0f00285edc
[task 2020-11-19T19:56:36.225Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.226Z] 19:56:36     INFO -   5  libxul.so!mozilla::Runnable::Release() [nsThreadUtils.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 65 + 0x5c]
[task 2020-11-19T19:56:36.227Z] 19:56:36     INFO -      rbx = 0x0000000000000000   rbp = 0x00007f0ef03bba40
[task 2020-11-19T19:56:36.228Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bba30   r12 = 0x00007f0ef0c97100
[task 2020-11-19T19:56:36.229Z] 19:56:36     INFO -      r13 = 0x0000000000000001   r14 = 0x00007f0ef0cf7b20
[task 2020-11-19T19:56:36.230Z] 19:56:36     INFO -      r15 = 0x000002d7d12c92f2   rip = 0x00007f0effd1ac0a
[task 2020-11-19T19:56:36.231Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.232Z] 19:56:36     INFO -   6  libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 1206 + 0x2f]
[task 2020-11-19T19:56:36.232Z] 19:56:36     INFO -      rbx = 0x00007f0ef0cf7b20   rbp = 0x00007f0ef03bbb40
[task 2020-11-19T19:56:36.233Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bba50   r12 = 0x00007f0ef0c97100
[task 2020-11-19T19:56:36.234Z] 19:56:36     INFO -      r13 = 0x0000000000000001   r14 = 0x00007f0ef0c97030
[task 2020-11-19T19:56:36.235Z] 19:56:36     INFO -      r15 = 0x000002d7d12c92f2   rip = 0x00007f0effd22ab7
[task 2020-11-19T19:56:36.236Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.238Z] 19:56:36     INFO -   7  libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 513 + 0xc]
[task 2020-11-19T19:56:36.239Z] 19:56:36     INFO -      rbx = 0x0000000000000001   rbp = 0x00007f0ef03bbb70
[task 2020-11-19T19:56:36.240Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bbb50   r12 = 0x00007f0ef03bbbb8
[task 2020-11-19T19:56:36.241Z] 19:56:36     INFO -      r13 = 0xaaaaaaaaaaaaaaaa   r14 = 0x00007f0ef03bbb57
[task 2020-11-19T19:56:36.242Z] 19:56:36     INFO -      r15 = 0x00007f0ef03bbbe8   rip = 0x00007f0effd26aeb
[task 2020-11-19T19:56:36.243Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.244Z] 19:56:36     INFO -   8  libxul.so!mozilla::net::nsSocketTransportService::Run() [nsSocketTransportService2.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 1195 + 0xe]
[task 2020-11-19T19:56:36.245Z] 19:56:36     INFO -      rbx = 0x00007f0ef0c97760   rbp = 0x00007f0ef03bbc20
[task 2020-11-19T19:56:36.245Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bbb80   r12 = 0x00007f0ef03bbbb8
[task 2020-11-19T19:56:36.246Z] 19:56:36     INFO -      r13 = 0xaaaaaaaaaaaaaaaa   r14 = 0x00007f0ef03bbbcf
[task 2020-11-19T19:56:36.247Z] 19:56:36     INFO -      r15 = 0x00007f0ef03bbbe8   rip = 0x00007f0effe8b283
[task 2020-11-19T19:56:36.248Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.250Z] 19:56:36     INFO -   9  libxul.so!{virtual override thunk({offset(-32)}, mozilla::net::nsSocketTransportService::Run())} + 0xd
[task 2020-11-19T19:56:36.251Z] 19:56:36     INFO -      rbx = 0x00007f0ef03bbc88   rbp = 0x00007f0ef03bbc30
[task 2020-11-19T19:56:36.252Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bbc30   r12 = 0x00007f0ef0c97100
[task 2020-11-19T19:56:36.252Z] 19:56:36     INFO -      r13 = 0x0000000000000000   r14 = 0x00007f0ef0c97030
[task 2020-11-19T19:56:36.253Z] 19:56:36     INFO -      r15 = 0x000002d7cef77128   rip = 0x00007f0effe8bba7
[task 2020-11-19T19:56:36.254Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.255Z] 19:56:36     INFO -  10  libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 1197 + 0xe]
[task 2020-11-19T19:56:36.256Z] 19:56:36     INFO -      rbx = 0x00007f0ef03bbc88   rbp = 0x00007f0ef03bbd30
[task 2020-11-19T19:56:36.257Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bbc40   r12 = 0x00007f0ef0c97100
[task 2020-11-19T19:56:36.258Z] 19:56:36     INFO -      r13 = 0x0000000000000000   r14 = 0x00007f0ef0c97030
[task 2020-11-19T19:56:36.259Z] 19:56:36     INFO -      r15 = 0x000002d7cef77128   rip = 0x00007f0effd22a71
[task 2020-11-19T19:56:36.260Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.260Z] 19:56:36     INFO -  11  libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 513 + 0xc]
[task 2020-11-19T19:56:36.261Z] 19:56:36     INFO -      rbx = 0x0000000000000000   rbp = 0x00007f0ef03bbd60
[task 2020-11-19T19:56:36.262Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bbd40   r12 = 0x00007f0ef03bbd78
[task 2020-11-19T19:56:36.263Z] 19:56:36     INFO -      r13 = 0x00007f0ef0cf93a0   r14 = 0x00007f0ef03bbd47
[task 2020-11-19T19:56:36.264Z] 19:56:36     INFO -      r15 = 0x00007f0ef0c97030   rip = 0x00007f0effd26aeb
[task 2020-11-19T19:56:36.265Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.266Z] 19:56:36     INFO -  12  libxul.so!mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) [MessagePump.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 302 + 0xa]
[task 2020-11-19T19:56:36.267Z] 19:56:36     INFO -      rbx = 0x00007f0ef03bbe68   rbp = 0x00007f0ef03bbdb0
[task 2020-11-19T19:56:36.268Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bbd70   r12 = 0x00007f0ef03bbd78
[task 2020-11-19T19:56:36.269Z] 19:56:36     INFO -      r13 = 0x00007f0ef0cf93a0   r14 = 0x00007f0ef0cf9380
[task 2020-11-19T19:56:36.270Z] 19:56:36     INFO -      r15 = 0x00007f0ef0c97030   rip = 0x00007f0f00359652
[task 2020-11-19T19:56:36.271Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.272Z] 19:56:36     INFO -  13  libxul.so!MessageLoop::RunInternal() [message_loop.cc:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 334 + 0x17]
[task 2020-11-19T19:56:36.273Z] 19:56:36     INFO -      rbx = 0x00007f0ef03bbe68   rbp = 0x00007f0ef03bbdf0
[task 2020-11-19T19:56:36.274Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bbdc0   r12 = 0x00007f0ef03bbe68
[task 2020-11-19T19:56:36.275Z] 19:56:36     INFO -      r13 = 0x00007f0ef03bbe60   r14 = 0x00007f0ef03bbe00
[task 2020-11-19T19:56:36.276Z] 19:56:36     INFO -      r15 = 0x00007f0ef0c97078   rip = 0x00007f0f00305abd
[task 2020-11-19T19:56:36.277Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.278Z] 19:56:36     INFO -  14  libxul.so!MessageLoop::Run() [message_loop.cc:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 309 + 0x8]
[task 2020-11-19T19:56:36.279Z] 19:56:36     INFO -      rbx = 0x00007f0ef03bbe68   rbp = 0x00007f0ef03bbe30
[task 2020-11-19T19:56:36.280Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bbe00   r12 = 0x00007f0ef03bbe68
[task 2020-11-19T19:56:36.281Z] 19:56:36     INFO -      r13 = 0x00007f0ef03bbe60   r14 = 0x00007f0ef03bbe00
[task 2020-11-19T19:56:36.282Z] 19:56:36     INFO -      r15 = 0x00007f0ef0c97078   rip = 0x00007f0f00305a17
[task 2020-11-19T19:56:36.283Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.284Z] 19:56:36     INFO -  15  libxul.so!nsThread::ThreadFunc(void*) [nsThread.cpp:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 442 + 0x8]
[task 2020-11-19T19:56:36.285Z] 19:56:36     INFO -      rbx = 0x00007f0f062e0a60   rbp = 0x00007f0ef03bc060
[task 2020-11-19T19:56:36.285Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bbe40   r12 = 0x00007f0ef03bbe68
[task 2020-11-19T19:56:36.286Z] 19:56:36     INFO -      r13 = 0x00007f0ef03bbe60   r14 = 0x00007f0ef0c97030
[task 2020-11-19T19:56:36.287Z] 19:56:36     INFO -      r15 = 0x00007f0ef0c97078   rip = 0x00007f0effd202ff
[task 2020-11-19T19:56:36.288Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.289Z] 19:56:36     INFO -  16  libnspr4.so!_pt_root [ptthread.c:2ffa4440e59ec56fe0f76ffdc6343b7b399f2d88 : 201 + 0x7]
[task 2020-11-19T19:56:36.290Z] 19:56:36     INFO -      rbx = 0x00007f0ef0c6f3a0   rbp = 0x00007f0ef03bc0b0
[task 2020-11-19T19:56:36.291Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bc070   r12 = 0x00007f0ef03bcb80
[task 2020-11-19T19:56:36.292Z] 19:56:36     INFO -      r13 = 0x0000000000000002   r14 = 0x00000000000049ac
[task 2020-11-19T19:56:36.293Z] 19:56:36     INFO -      r15 = 0x00007f0ef03bd700   rip = 0x00007f0f06d38436
[task 2020-11-19T19:56:36.294Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.295Z] 19:56:36     INFO -  17  libpthread.so.0 + 0x76db
[task 2020-11-19T19:56:36.296Z] 19:56:36     INFO -      rbx = 0x0000000000000000   rbp = 0x0000000000000000
[task 2020-11-19T19:56:36.297Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bc0c0   r12 = 0x00007f0ef03bc180
[task 2020-11-19T19:56:36.298Z] 19:56:36     INFO -      r13 = 0x0000000000000000   r14 = 0x00007f0ef0c6f3a0
[task 2020-11-19T19:56:36.299Z] 19:56:36     INFO -      r15 = 0x00007fff67b82a20   rip = 0x00007f0f069226db
[task 2020-11-19T19:56:36.300Z] 19:56:36     INFO -      Found by: call frame info
[task 2020-11-19T19:56:36.301Z] 19:56:36     INFO -  18  libc.so.6 + 0x121a3f
[task 2020-11-19T19:56:36.301Z] 19:56:36     INFO -      rsp = 0x00007f0ef03bc180   rip = 0x00007f0efad78a3f
[task 2020-11-19T19:56:36.302Z] 19:56:36     INFO -      Found by: stack scanning```

"ActorLifecycleProxy not thread-safe"

Nika, is this a regression from your recent patch to change how the lifecycle proxy works?

Group: dom-core-security
Component: XPCOM → IPC
Flags: needinfo?(nika)

Unfortunately, I don't think this is a new regression, so much as it is revealing an existing bug in the code. It appears as though the WeakRef type used by SupportsWeakPtr doesn't include threadsafety assertions despite using a non-atomic refcount due to using mozilla::RefCounted instead of NS_INLINE_DECL_REFCOUNTING, meaning that we used to be doing racy non-threadsafe refcounting here, but didn't catch it due to there being no assertions, while now we do catch the assertion.

It's still a bug which needs to be fix, but it is a pre-existing bug which my changes just revealed as existing.

This also migrates all existing users of _WITH_MAIN_THREAD_DESTRUCTION to the
new macro in nsISupportsImpl.

Assignee: nobody → nika
Status: NEW → ASSIGNED

These new macros provide a standard way to delegate delete to the main thread,
and can be used to avoid using bespoke _WITH_DESTROY implementations.

The resolver object held by DataResolver must be destroyed on the actor's worker
thread, as it holds non-threadsafe references.

Flags: needinfo?(nika)

How far back does this issue go? Do these patches need backport consideration?

Flags: needinfo?(nika)

It looks like this issue was first introduced in bug 1527256, which appears to be in Firefox 80. I suppose we could potentially uplift part of this patch. The only part which would need uplift is the xpcom/ part of P1, and all of P3, as the rest is clean-up.

Not sure what the real-world impact is here, but feel free to nominate if you think it's worth it.

Flags: qe-verify-
Whiteboard: [post-critsmash-triage]
Flags: needinfo?(nika)
Whiteboard: [post-critsmash-triage] → [post-critsmash-triage][adv-main86+r]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: