Closed Bug 1693771 Opened 5 years ago Closed 4 years ago

Intermittent Last test finished | application crashed [@ std::__ndk1::__tree<std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> >, std::__ndk1

Categories

(Core :: WebRTC: Networking, defect, P5)

Product:
Core
Component:
WebRTC: Networking
Type:
defect

Tracking

()

Status:
RESOLVED INCOMPLETE

People

(Reporter: intermittent-bug-filer, Unassigned)

Details

(Keywords: csectype-uaf, intermittent-failure, sec-high)

Filed by: abutkovits [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=330495895&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/XMT9FK8CRF2u4BSnf3Y3JQ/runs/0/artifacts/public/logs/live_backing.log

[task 2021-02-19T11:08:54.477Z] 11:08:54     INFO -  TEST-OK | dom/media/webrtc/tests/mochitests/test_selftest.html | took 430ms
[task 2021-02-19T11:08:54.477Z] 11:08:54     INFO -  TEST-START | Shutdown
[task 2021-02-19T11:08:54.477Z] 11:08:54     INFO -  Passed:  3171
[task 2021-02-19T11:08:54.477Z] 11:08:54     INFO -  Failed:  0
[task 2021-02-19T11:08:54.478Z] 11:08:54     INFO -  Todo:    134
[task 2021-02-19T11:08:54.478Z] 11:08:54     INFO -  Mode:    e10s
[task 2021-02-19T11:08:54.478Z] 11:08:54     INFO -  Slowest: 3138ms - /tests/dom/media/webrtc/tests/mochitests/test_peerConnection_captureStream_canvas_2d_noSSRC.html
[task 2021-02-19T11:08:54.478Z] 11:08:54     INFO -  SimpleTest FINISHED
[task 2021-02-19T11:08:55.710Z] 11:08:55     INFO -  wait for org.mozilla.geckoview.test complete; top activity=com.android.launcher3
[task 2021-02-19T11:08:55.710Z] 11:08:55     INFO -  runtestsremote.py | Application ran for: 0:00:37.373872
[task 2021-02-19T11:08:55.827Z] 11:08:55     INFO -  mozcrash Copy/paste: /builds/worker/fetches/minidump_stackwalk/minidump_stackwalk /tmp/tmpUpg91o/0703ee7f-284b-786f-884b-0b60d562173b.dmp /builds/worker/workspace/build/symbols
[task 2021-02-19T11:08:59.436Z] 11:08:59     INFO -  mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/0703ee7f-284b-786f-884b-0b60d562173b.dmp
[task 2021-02-19T11:08:59.444Z] 11:08:59  WARNING -  PROCESS-CRASH | Last test finished | application crashed [@ std::__ndk1::__tree<std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> >, std::__ndk1::__map_value_compare<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> >, std::__ndk1::less<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > >, true>, std::__ndk1::allocator<std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> > > >::destroy(std::__ndk1::__tree_node<std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> >, void*>*)]
[task 2021-02-19T11:08:59.444Z] 11:08:59     INFO -  Crash dump filename: /tmp/tmpUpg91o/0703ee7f-284b-786f-884b-0b60d562173b.dmp
[task 2021-02-19T11:08:59.444Z] 11:08:59     INFO -  Operating system: Android
[task 2021-02-19T11:08:59.444Z] 11:08:59     INFO -                    0.0.0 Linux 3.10.0+ #260 SMP PREEMPT Fri May 19 12:48:14 PDT 2017 x86_64
[task 2021-02-19T11:08:59.444Z] 11:08:59     INFO -  CPU: amd64
[task 2021-02-19T11:08:59.445Z] 11:08:59     INFO -       family 6 model 6 stepping 3
[task 2021-02-19T11:08:59.445Z] 11:08:59     INFO -       4 CPUs
[task 2021-02-19T11:08:59.445Z] 11:08:59     INFO -  GPU: UNKNOWN
[task 2021-02-19T11:08:59.445Z] 11:08:59     INFO -  Crash reason:  SIGSEGV /0x00000080
[task 2021-02-19T11:08:59.445Z] 11:08:59     INFO -  Crash address: 0x0
[task 2021-02-19T11:08:59.445Z] 11:08:59     INFO -  Process uptime: not available
[task 2021-02-19T11:08:59.445Z] 11:08:59     INFO -  Thread 13 (crashed)
[task 2021-02-19T11:08:59.446Z] 11:08:59     INFO -   0  libxul.so!std::__ndk1::__tree<std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> >, std::__ndk1::__map_value_compare<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> >, std::__ndk1::less<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > >, true>, std::__ndk1::allocator<std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> > > >::destroy(std::__ndk1::__tree_node<std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> >, void*>*) [__tree : 1851 + 0x0]
[task 2021-02-19T11:08:59.446Z] 11:08:59     INFO -      rax = 0x000076250ee878f0   rdx = 0x0000000000000002
[task 2021-02-19T11:08:59.446Z] 11:08:59     INFO -      rcx = 0x0000000000000000   rbx = 0xe5e5e5e5e5e5e5e5
[task 2021-02-19T11:08:59.446Z] 11:08:59     INFO -      rsi = 0xe5e5e5e5e5e5e5e5   rdi = 0x000076250ee87868
[task 2021-02-19T11:08:59.446Z] 11:08:59     INFO -      rbp = 0x0000762527b8fb50   rsp = 0x0000762527b8fb40
[task 2021-02-19T11:08:59.447Z] 11:08:59     INFO -       r8 = 0x0000000000002008    r9 = 0x0000000000000000
[task 2021-02-19T11:08:59.447Z] 11:08:59     INFO -      r10 = 0x0000000000000000   r11 = 0x0000000000000246
[task 2021-02-19T11:08:59.447Z] 11:08:59     INFO -      r12 = 0x0000762527b8fbb0   r13 = 0x0000000000000000
[task 2021-02-19T11:08:59.447Z] 11:08:59     INFO -      r14 = 0x000076250ee87868   r15 = 0x000076250ee87868
[task 2021-02-19T11:08:59.447Z] 11:08:59     INFO -      rip = 0x00007625059ec0cc
[task 2021-02-19T11:08:59.447Z] 11:08:59     INFO -      Found by: given as instruction pointer in context
[task 2021-02-19T11:08:59.448Z] 11:08:59     INFO -   1  libxul.so!std::__ndk1::__tree<std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> >, std::__ndk1::__map_value_compare<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> >, std::__ndk1::less<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > >, true>, std::__ndk1::allocator<std::__ndk1::__value_type<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, RefPtr<mozilla::NrIceMediaStream> > > >::clear() [__tree : 1891 + 0xd]
[task 2021-02-19T11:08:59.448Z] 11:08:59     INFO -      rbp = 0x0000762527b8fb70   rsp = 0x0000762527b8fb60
[task 2021-02-19T11:08:59.448Z] 11:08:59     INFO -      rip = 0x00007625059ecc47
[task 2021-02-19T11:08:59.448Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.448Z] 11:08:59     INFO -   2  libxul.so!mozilla::NrIceCtx::Destroy() [nricectx.cpp:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 721 + 0x8]
[task 2021-02-19T11:08:59.449Z] 11:08:59     INFO -      rbp = 0x0000762527b8fd00   rsp = 0x0000762527b8fb80
[task 2021-02-19T11:08:59.449Z] 11:08:59     INFO -      rip = 0x00007625059ea1b6
[task 2021-02-19T11:08:59.449Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.449Z] 11:08:59     INFO -   3  libxul.so!mozilla::MediaTransportHandlerSTS::Shutdown_s() [MediaTransportHandler.cpp:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 625 + 0x10]
[task 2021-02-19T11:08:59.449Z] 11:08:59     INFO -      rbp = 0x0000762527b8fd30   rsp = 0x0000762527b8fd10
[task 2021-02-19T11:08:59.449Z] 11:08:59     INFO -      rip = 0x0000762507289a1d
[task 2021-02-19T11:08:59.449Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.450Z] 11:08:59     INFO -   4  libxul.so!mozilla::detail::RunnableMethodImpl<mozilla::MediaTransportHandlerSTS*, void (mozilla::MediaTransportHandlerSTS::*)(), false, (mozilla::RunnableKind)0, >::Run() [nsThreadUtils.h:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 1201 + 0x17]
[task 2021-02-19T11:08:59.450Z] 11:08:59     INFO -      rbp = 0x0000762527b8fd40   rsp = 0x0000762527b8fd40
[task 2021-02-19T11:08:59.450Z] 11:08:59     INFO -      rip = 0x00007625072bfdaf
[task 2021-02-19T11:08:59.450Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.450Z] 11:08:59     INFO -   5  libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 1152 + 0x11]
[task 2021-02-19T11:08:59.450Z] 11:08:59     INFO -      rbp = 0x0000762527b8fe80   rsp = 0x0000762527b8fd50
[task 2021-02-19T11:08:59.451Z] 11:08:59     INFO -      rip = 0x0000762504f90e93
[task 2021-02-19T11:08:59.451Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.451Z] 11:08:59     INFO -   6  libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 548 + 0x10]
[task 2021-02-19T11:08:59.451Z] 11:08:59     INFO -      rbp = 0x0000762527b8fec0   rsp = 0x0000762527b8fe90
[task 2021-02-19T11:08:59.451Z] 11:08:59     INFO -      rip = 0x0000762504f9522c
[task 2021-02-19T11:08:59.451Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.451Z] 11:08:59     INFO -   7  libxul.so!mozilla::net::nsSocketTransportService::Run() [nsSocketTransportService2.cpp:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 1199 + 0xc]
[task 2021-02-19T11:08:59.452Z] 11:08:59     INFO -      rbp = 0x0000762527b8ff70   rsp = 0x0000762527b8fed0
[task 2021-02-19T11:08:59.452Z] 11:08:59     INFO -      rip = 0x00007625050f8ef3
[task 2021-02-19T11:08:59.452Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.452Z] 11:08:59     INFO -   8  libxul.so!{virtual override thunk({offset(-32)}, mozilla::net::nsSocketTransportService::Run())} + 0xd
[task 2021-02-19T11:08:59.452Z] 11:08:59     INFO -      rbp = 0x0000762527b8ff80   rsp = 0x0000762527b8ff80
[task 2021-02-19T11:08:59.452Z] 11:08:59     INFO -      rip = 0x00007625050f9755
[task 2021-02-19T11:08:59.452Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.453Z] 11:08:59     INFO -   9  libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 1152 + 0x11]
[task 2021-02-19T11:08:59.453Z] 11:08:59     INFO -      rbp = 0x0000762527b900c0   rsp = 0x0000762527b8ff90
[task 2021-02-19T11:08:59.453Z] 11:08:59     INFO -      rip = 0x0000762504f90e93
[task 2021-02-19T11:08:59.453Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.453Z] 11:08:59     INFO -  10  libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 548 + 0x10]
[task 2021-02-19T11:08:59.453Z] 11:08:59     INFO -      rbp = 0x0000762527b90100   rsp = 0x0000762527b900d0
[task 2021-02-19T11:08:59.454Z] 11:08:59     INFO -      rip = 0x0000762504f9522c
[task 2021-02-19T11:08:59.454Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.454Z] 11:08:59     INFO -  11  libxul.so!mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) [MessagePump.cpp:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 302 + 0xa]
[task 2021-02-19T11:08:59.454Z] 11:08:59     INFO -      rbp = 0x0000762527b90150   rsp = 0x0000762527b90110
[task 2021-02-19T11:08:59.454Z] 11:08:59     INFO -      rip = 0x0000762505589e84
[task 2021-02-19T11:08:59.454Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.454Z] 11:08:59     INFO -  12  libxul.so!MessageLoop::RunInternal() [message_loop.cc:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 335 + 0x17]
[task 2021-02-19T11:08:59.454Z] 11:08:59     INFO -      rbp = 0x0000762527b90190   rsp = 0x0000762527b90160
[task 2021-02-19T11:08:59.455Z] 11:08:59     INFO -      rip = 0x0000762505537a56
[task 2021-02-19T11:08:59.455Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.455Z] 11:08:59     INFO -  13  libxul.so!MessageLoop::Run() [message_loop.cc:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 310 + 0x8]
[task 2021-02-19T11:08:59.455Z] 11:08:59     INFO -      rbp = 0x0000762527b901d0   rsp = 0x0000762527b901a0
[task 2021-02-19T11:08:59.455Z] 11:08:59     INFO -      rip = 0x00007625055379bf
[task 2021-02-19T11:08:59.455Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.455Z] 11:08:59     INFO -  14  libxul.so!nsThread::ThreadFunc(void*) [nsThread.cpp:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 391 + 0x8]
[task 2021-02-19T11:08:59.455Z] 11:08:59     INFO -      rbp = 0x0000762527b903a0   rsp = 0x0000762527b901e0
[task 2021-02-19T11:08:59.456Z] 11:08:59     INFO -      rip = 0x0000762504f8e860
[task 2021-02-19T11:08:59.456Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.456Z] 11:08:59     INFO -  15  libnss3.so!_pt_root [ptthread.c:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 201 + 0x7]
[task 2021-02-19T11:08:59.456Z] 11:08:59     INFO -      rbp = 0x0000762527b903e0   rsp = 0x0000762527b903b0
[task 2021-02-19T11:08:59.456Z] 11:08:59     INFO -      rip = 0x000076250f08b68f
[task 2021-02-19T11:08:59.456Z] 11:08:59     INFO -      Found by: previous frame's frame pointer
[task 2021-02-19T11:08:59.456Z] 11:08:59     INFO -  16  libnss3.so!pt_recvfrom_cont [ptio.c:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 987 + 0x2f]
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -      rbp = 0x0000762527b903e0   rsp = 0x0000762527b903d0
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -      rip = 0x000076250f08b557
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -      Found by: stack scanning
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -  17  libc.so + 0x89772
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -      rsp = 0x0000762527b903f0   rip = 0x000076252b119772
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -      Found by: stack scanning
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -  18  libnss3.so!pt_recvfrom_cont [ptio.c:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 987 + 0x2f]
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -      rsp = 0x0000762527b90428   rip = 0x000076250f08b557
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -      Found by: stack scanning
[task 2021-02-19T11:08:59.457Z] 11:08:59     INFO -  19  libc.so + 0x299ec
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -      rsp = 0x0000762527b90440   rip = 0x000076252b0b99ec
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -      Found by: stack scanning
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -  20  libc.so + 0x896c0
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -      rsp = 0x0000762527b90448   rip = 0x000076252b1196c0
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -      Found by: stack scanning
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -  21  libc.so + 0x1ca66
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -      rsp = 0x0000762527b90450   rip = 0x000076252b0aca66
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -      Found by: stack scanning
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -  22  libnss3.so!pt_recvfrom_cont [ptio.c:5e657efb7e68f12c4206df442eb9cd65aee3d68f : 987 + 0x2f]
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -      rsp = 0x0000762527b904b8   rip = 0x000076250f08b557
[task 2021-02-19T11:08:59.458Z] 11:08:59     INFO -      Found by: stack scanning```

UAF, so I'll mark it sec-high, but I don't know how actionable it is.

Component: WebRTC: Audio/Video → WebRTC: Networking
Keywords: csectype-uaf, sec-high
Keywords: stalled

The severity field for this bug is set to S4. However, the bug is flagged with the sec-high keyword.
:bwc, could you consider increasing the severity of this security bug?

For more information, please visit auto_nag documentation.

Flags: needinfo?(docfaraday)

This has not happened in a long time, and I do not see any occurrences on crash-stats.

Status: NEW → RESOLVED
Closed: 4 years ago
Flags: needinfo?(docfaraday)
Resolution: --- → INCOMPLETE

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit auto_nag documentation.

Keywords: stalled
Group: media-core-security
You need to log in before you can comment on or make changes to this bug.