1699112 - SIGSEGV on read of response body in onExternalResponse

Status: RESOLVED INVALID

(GeckoView :: General, defect, P3)

Description

[Wicher Minnaard]

Attachment: tombstone_07

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

This is with GeckoView 87.0.20210315170302 on the Android emulator (API 26, x86_64, no Play services).

I have an onExternalResponse handler, simplified demo case (Kotlin):

fun onExternalResponse(session: GeckoSession, response: WebResponse) {
        val responsebytes = response.body?.use {
            it.readBytes()
        }

This is the crash demo case; of course I do not intend to read the whole response body into memory, and in production code processing the response body would happen on a separate thread.

I'm testing this with a 8809232 byte response body. About halfway into reading in this response (varies from test run to test run) my application segfaults.

Actual results:

Crash report from logcat below, tombstone is attached to this bug.

--------- beginning of crash
03-17 13:15:10.739  9377  9377 F libc    : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x0 in tid 9377 (AndroidUI)
03-17 13:15:10.784  9530  9530 I crash_dump64: obtaining output fd from tombstoned
03-17 13:15:10.785  1509  1509 I /system/bin/tombstoned: received crash request for pid 9377
03-17 13:15:10.785  9530  9530 I crash_dump64: performing dump of process 9377 (target tid = 9377)
03-17 13:15:10.786  9530  9530 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
03-17 13:15:10.787  9530  9530 F DEBUG   : Build fingerprint: 'Android/sdk_phone_x86_64/generic_x86_64:8.0.0/OSR1.180418.004/4931640:userdebug/test-keys'
03-17 13:15:10.787  9530  9530 F DEBUG   : Revision: '0'
03-17 13:15:10.787  9530  9530 F DEBUG   : ABI: 'x86_64'
03-17 13:15:10.787  9530  9530 F DEBUG   : pid: 9377, tid: 9377, name: AndroidUI  >>> something.something.something <<<
03-17 13:15:10.787  9530  9530 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
03-17 13:15:10.787  9530  9530 F DEBUG   : Cause: null pointer dereference
03-17 13:15:10.787  9530  9530 F DEBUG   :     rax 0000000000000000  rbx 00007c99978aed70  rcx ffffffffffffffff  rdx 000000000000000b
03-17 13:15:10.787  9530  9530 F DEBUG   :     rsi 00000000000024a1  rdi 00000000000024a1
03-17 13:15:10.787  9530  9530 F DEBUG   :     r8  00007c9997a02c60  r9  00007c9997a02c60  r10 00007c99978aed70  r11 0000000000000246
03-17 13:15:10.787  9530  9530 F DEBUG   :     r12 0000000000000016  r13 00007c99978aed70  r14 00007c99979f9ab0  r15 000000000000000b
03-17 13:15:10.787  9530  9530 F DEBUG   :     cs  0000000000000033  ss  000000000000002b
03-17 13:15:10.787  9530  9530 F DEBUG   :     rip 00007c9997966ed8  rbp 00000000000024a1  rsp 00007c99978ae998  eflags 0000000000000246
03-17 13:15:10.787  9530  9530 F DEBUG   : 
03-17 13:15:10.787  9530  9530 F DEBUG   : backtrace:
03-17 13:15:10.787  9530  9530 F DEBUG   :     #00 pc 00000000000b1ed8  /system/bin/linker64 (__dl_syscall+24)
03-17 13:15:10.787  9530  9530 F DEBUG   :     #01 pc 000000000002e6f8  /system/bin/linker64 (__dl__ZL13resend_signalP7siginfob+80)
03-17 13:15:10.787  9530  9530 F DEBUG   :     #02 pc 000000000002e589  /system/bin/linker64 (__dl__ZL24debuggerd_signal_handleriP7siginfoPv+1231)
03-17 13:15:10.787  9530  9530 F DEBUG   :     #03 pc 0000000002666443  /data/app/somedomain.somecorp.someproduct.somebuildvariant-ZwUGG-ZjPfaTvXRnAtTHpA==/lib/x86_64/libxul.so (offset 0x171000)
03-17 13:15:11.341  1509  1509 E /system/bin/tombstoned: Tombstone written to: /data/tombstones//tombstone_07

Expected results:

The response body should have been read without segfaulting. And if there is something going on making that impossible, it should throw an exception.

Note that the crash also happens when spooling the body to disk using a 4KB transfer buffer.
Note that the crash happens much sooner (after about 32K read) when I wrap the response reading in a thread, but still, some data is read before crashing.

Comment 1

[[ex-Mozilla] Agi Sferro | :agi]

Could you provide a minimal testcase app with the latest nightly geckoview build that reproduces this problem?

Comment 2

[Wicher Minnaard]

(In reply to Agi Sferro | :agi | ni? for questions | ⏰ PST | he/him from comment #1)

Could you provide a minimal testcase app with the latest nightly geckoview build that reproduces this problem?

Sure. I suppose then that Geckoview should not take offense at the way I'm trying to read the response body?

Comment 3

[Wicher Minnaard]

With Geckoview v89, this problem does not occur anymore (for me).