Closed Bug 1711282 Opened 3 years ago Closed 2 years ago

Intermittent [tier2] startup_about_home_paint_realworld_webextensions | application crashed [@ nsThreadManager::Shutdown] | Found crashes after test run, terminating test

Categories

(Core :: XPCOM, defect)

Product:
Core
Component:
XPCOM
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: intermittent-bug-filer, Unassigned)

References

Details

(4 keywords, Whiteboard: [tbird crash])

Crash Data

Filed by: dluca [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=339742650&repo=mozilla-central
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/W3mE_c1kSreses7xctw8Kg/runs/0/artifacts/public/logs/live_backing.log

INFO -  TEST-INFO | 6172: exit 1
[task 2021-05-14T18:22:36.981Z] 18:22:36     INFO -  mozcrash checking C:\Users\task_1621014571\AppData\Local\Temp\tmpesmfdny0\profile\minidumps for minidumps...
[task 2021-05-14T18:22:36.981Z] 18:22:36     INFO -  mozcrash Downloading symbols from: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/BCtXvfuMS6WL2t2pfRG6Qg/artifacts/public/build/target.crashreporter-symbols.zip
[task 2021-05-14T18:22:38.607Z] 18:22:38     INFO -  mozcrash Copy/paste: C:/Users/task_1621014571/fetches\minidump_stackwalk\minidump_stackwalk.exe C:\Users\task_1621014571\AppData\Local\Temp\tmpesmfdny0\profile\minidumps\73f84ff5-7c0c-4960-ae80-27b102f381f9.dmp C:\Users\task_1621014571\AppData\Local\Temp\tmps2xgqad3
[task 2021-05-14T18:22:42.695Z] 18:22:42     INFO -  mozcrash Saved minidump as C:\Users\task_1621014571\build\blobber_upload_dir\73f84ff5-7c0c-4960-ae80-27b102f381f9.dmp
[task 2021-05-14T18:22:42.695Z] 18:22:42     INFO -  mozcrash Saved app info as C:\Users\task_1621014571\build\blobber_upload_dir\73f84ff5-7c0c-4960-ae80-27b102f381f9.extra
[task 2021-05-14T18:22:42.696Z] 18:22:42     INFO -  PROCESS-CRASH | startup_about_home_paint_realworld_webextensions | application crashed [@ nsThreadManager::Shutdown()]
[task 2021-05-14T18:22:42.697Z] 18:22:42     INFO -  Crash dump filename: C:\Users\task_1621014571\AppData\Local\Temp\tmpesmfdny0\profile\minidumps\73f84ff5-7c0c-4960-ae80-27b102f381f9.dmp
[task 2021-05-14T18:22:42.697Z] 18:22:42     INFO -  Operating system: Windows NT
[task 2021-05-14T18:22:42.697Z] 18:22:42     INFO -                    10.0.17134
[task 2021-05-14T18:22:42.698Z] 18:22:42     INFO -  CPU: amd64
[task 2021-05-14T18:22:42.698Z] 18:22:42     INFO -       family 6 model 94 stepping 3
[task 2021-05-14T18:22:42.698Z] 18:22:42     INFO -       8 CPUs
[task 2021-05-14T18:22:42.698Z] 18:22:42     INFO -  GPU: UNKNOWN
[task 2021-05-14T18:22:42.699Z] 18:22:42     INFO -  Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
[task 2021-05-14T18:22:42.699Z] 18:22:42     INFO -  Crash address: 0xffffffff
[task 2021-05-14T18:22:42.699Z] 18:22:42     INFO -  Process uptime: 6 seconds
[task 2021-05-14T18:22:42.700Z] 18:22:42     INFO -  Thread 0 (crashed)
[task 2021-05-14T18:22:42.700Z] 18:22:42     INFO -   0  xul.dll!nsThreadManager::Shutdown() [nsThreadManager.cpp:01f5d81f0afe7c1958a225d981bac39f52ae93fe : 451 + 0x24]
[task 2021-05-14T18:22:42.700Z] 18:22:42     INFO -      rax = 0xe5e5e5e5e5e5e5e5   rdx = 0x0000000094003844
[task 2021-05-14T18:22:42.701Z] 18:22:42     INFO -      rcx = 0x000002128be3b720   rbx = 0x00000000000000c8
[task 2021-05-14T18:22:42.701Z] 18:22:42     INFO -      rsi = 0x000002128b9b9f00   rdi = 0x00000000000000d8
[task 2021-05-14T18:22:42.701Z] 18:22:42     INFO -      rbp = 0x000002128be3dc80   rsp = 0x000000f8c83ff5f0
[task 2021-05-14T18:22:42.702Z] 18:22:42     INFO -       r8 = 0x00000000000001a0    r9 = 0xe5e5e5e5e5e5e5e5
[task 2021-05-14T18:22:42.702Z] 18:22:42     INFO -      r10 = 0x00000fff3de77d2e   r11 = 0x0000021293be55c0
[task 2021-05-14T18:22:42.702Z] 18:22:42     INFO -      r12 = 0x00007ff9f52a2c50   r13 = 0x00007ff9f440ee38
[task 2021-05-14T18:22:42.702Z] 18:22:42     INFO -      r14 = 0x00007ff9f52a2c88   r15 = 0x000000f8c83ff628
[task 2021-05-14T18:22:42.702Z] 18:22:42     INFO -      rip = 0x00007ff9efc55a70
[task 2021-05-14T18:22:42.703Z] 18:22:42     INFO -      Found by: given as instruction pointer in context
[task 2021-05-14T18:22:42.703Z] 18:22:42     INFO -   1  xul.dll!mozilla::ShutdownXPCOM(nsIServiceManager*) [XPCOMInit.cpp:01f5d81f0afe7c1958a225d981bac39f52ae93fe : 655 + 0xd]
[task 2021-05-14T18:22:42.703Z] 18:22:42     INFO -      rbx = 0x00000000000000c8   rbp = 0x000002128be3dc80
[task 2021-05-14T18:22:42.703Z] 18:22:42     INFO -      rsp = 0x000000f8c83ff680   r12 = 0x00007ff9f52a2c50
[task 2021-05-14T18:22:42.704Z] 18:22:42     INFO -      r13 = 0x00007ff9f440ee38   r14 = 0x00007ff9f52a2c88
[task 2021-05-14T18:22:42.704Z] 18:22:42     INFO -      r15 = 0x000000f8c83ff628   rip = 0x00007ff9ef51546a
[task 2021-05-14T18:22:42.704Z] 18:22:42     INFO -      Found by: call frame info
[task 2021-05-14T18:22:42.704Z] 18:22:42     INFO -   2  xul.dll!ScopedXPCOMStartup::~ScopedXPCOMStartup() [nsAppRunner.cpp:01f5d81f0afe7c1958a225d981bac39f52ae93fe : 1674 + 0x8]
[task 2021-05-14T18:22:42.705Z] 18:22:42     INFO -      rbx = 0x00000000000000c8   rbp = 0x000002128be3dc80
[task 2021-05-14T18:22:42.705Z] 18:22:42     INFO -      rsp = 0x000000f8c83ff770   r12 = 0x00007ff9f52a2c50
[task 2021-05-14T18:22:42.705Z] 18:22:42     INFO -      r13 = 0x00007ff9f440ee38   r14 = 0x00007ff9f52a2c88
[task 2021-05-14T18:22:42.705Z] 18:22:42     INFO -      r15 = 0x000000f8c83ff628   rip = 0x00007ff9f35ed8f4
[task 2021-05-14T18:22:42.705Z] 18:22:42     INFO -      Found by: call frame info
[task 2021-05-14T18:22:42.706Z] 18:22:42     INFO -   3  xul.dll!XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) [nsAppRunner.cpp:01f5d81f0afe7c1958a225d981bac39f52ae93fe : 5582 + 0x19]
[task 2021-05-14T18:22:42.706Z] 18:22:42     INFO -      rbx = 0x00000000000000c8   rbp = 0x000002128be3dc80
[task 2021-05-14T18:22:42.706Z] 18:22:42     INFO -      rsp = 0x000000f8c83ff860   r12 = 0x00007ff9f52a2c50
[task 2021-05-14T18:22:42.706Z] 18:22:42     INFO -      r13 = 0x00007ff9f440ee38   r14 = 0x00007ff9f52a2c88
[task 2021-05-14T18:22:42.707Z] 18:22:42     INFO -      r15 = 0x000000f8c83ff628   rip = 0x00007ff9f35f37db
[task 2021-05-14T18:22:42.707Z] 18:22:42     INFO -      Found by: call frame info
[task 2021-05-14T18:22:42.707Z] 18:22:42     INFO -   4  xul.dll!XRE_main(int, char**, mozilla::BootstrapConfig const&) [nsAppRunner.cpp:01f5d81f0afe7c1958a225d981bac39f52ae93fe : 5624 + 0x10]
[task 2021-05-14T18:22:42.707Z] 18:22:42     INFO -      rbx = 0x00000000000000c8   rbp = 0x000002128be3dc80
[task 2021-05-14T18:22:42.708Z] 18:22:42     INFO -      rsp = 0x000000f8c83ff920   r12 = 0x00007ff9f52a2c50
[task 2021-05-14T18:22:42.708Z] 18:22:42     INFO -      r13 = 0x00007ff9f440ee38   r14 = 0x00007ff9f52a2c88
[task 2021-05-14T18:22:42.708Z] 18:22:42     INFO -      r15 = 0x000000f8c83ff628   rip = 0x00007ff9f117b4b3
[task 2021-05-14T18:22:42.708Z] 18:22:42     INFO -      Found by: call frame info
[task 2021-05-14T18:22:42.709Z] 18:22:42     INFO -   5  firefox.exe!wmain(int, wchar_t**) [nsWindowsWMain.cpp:01f5d81f0afe7c1958a225d981bac39f52ae93fe : 138 + 0x1da]
[task 2021-05-14T18:22:42.709Z] 18:22:42     INFO -      rbx = 0x00000000000000c8   rbp = 0x000002128be3dc80
[task 2021-05-14T18:22:42.709Z] 18:22:42     INFO -      rsp = 0x000000f8c83ffa70   r12 = 0x00007ff9f52a2c50
[task 2021-05-14T18:22:42.709Z] 18:22:42     INFO -      r13 = 0x00007ff9f440ee38   r14 = 0x00007ff9f52a2c88
[task 2021-05-14T18:22:42.709Z] 18:22:42     INFO -      r15 = 0x000000f8c83ff628   rip = 0x00007ff71abda1a1
[task 2021-05-14T18:22:42.710Z] 18:22:42     INFO -      Found by: call frame info
[task 2021-05-14T18:22:42.710Z] 18:22:42     INFO -   6  firefox.exe!__scrt_common_main_seh() [exe_common.inl : 288 + 0x22]
[task 2021-05-14T18:22:42.710Z] 18:22:42     INFO -      rbx = 0x00000000000000c8   rbp = 0x000002128be3dc80
[task 2021-05-14T18:22:42.710Z] 18:22:42     INFO -      rsp = 0x000000f8c83ffc90   r12 = 0x00007ff9f52a2c50
[task 2021-05-14T18:22:42.710Z] 18:22:42     INFO -      r13 = 0x00007ff9f440ee38   r14 = 0x00007ff9f52a2c88
[task 2021-05-14T18:22:42.711Z] 18:22:42     INFO -      r15 = 0x000000f8c83ff628   rip = 0x00007ff71abed6a8
[task 2021-05-14T18:22:42.711Z] 18:22:42     INFO -      Found by: call frame info
[task 2021-05-14T18:22:42.711Z] 18:22:42     INFO -   7  kernel32.dll!BaseThreadInitThunk + 0x14
[task 2021-05-14T18:22:42.711Z] 18:22:42     INFO -      rbx = 0x00000000000000c8   rbp = 0x000002128be3dc80
[task 2021-05-14T18:22:42.711Z] 18:22:42     INFO -      rsp = 0x000000f8c83ffcd0   r12 = 0x00007ff9f52a2c50
[task 2021-05-14T18:22:42.712Z] 18:22:42     INFO -      r13 = 0x00007ff9f440ee38   r14 = 0x00007ff9f52a2c88
[task 2021-05-14T18:22:42.712Z] 18:22:42     INFO -      r15 = 0x000000f8c83ff628   rip = 0x00007ffa2e0d3034
[task 2021-05-14T18:22:42.712Z] 18:22:42     INFO -      Found by: call frame info
[task 2021-05-14T18:22:42.712Z] 18:22:42     INFO -   8  ntdll.dll!SdbpCheckMatchingFiles + 0x81
[task 2021-05-14T18:22:42.712Z] 18:22:42     INFO -      rbx = 0x00000000000000c8   rbp = 0x000002128be3dc80
[task 2021-05-14T18:22:42.713Z] 18:22:42     INFO -      rsp = 0x000000f8c83ffd00   r12 = 0x00007ff9f52a2c50
[task 2021-05-14T18:22:42.713Z] 18:22:42     INFO -      r13 = 0x00007ff9f440ee38   r14 = 0x00007ff9f52a2c88
[task 2021-05-14T18:22:42.713Z] 18:22:42     INFO -      r15 = 0x000000f8c83ff628   rip = 0x00007ffa305b1461
[task 2021-05-14T18:22:42.713Z] 18:22:42     INFO -      Found by: call frame info
[task 2021-05-14T18:22:42.713Z] 18:22:42     INFO -  Thread 1```
Group: core-security → dom-core-security
Component: General → XPCOM
Product: Firefox → Core

Probably the same basic issue as the other thread manager shutdown UAFs we've seen.

Keywords: csectype-uaf, sec-moderate
See Also: → 1704391
Crash Signature: [@ nsThreadManager::Shutdown()] → [@ nsThreadManager::Shutdown]
Crash Signature: [@ nsThreadManager::Shutdown] → [@ nsThreadManager::Shutdown] [@ nsThreadManager::Shutdown()]
Crash Signature: [@ nsThreadManager::Shutdown] [@ nsThreadManager::Shutdown()] → [@ nsThreadManager::Shutdown]
Crash Signature: [@ nsThreadManager::Shutdown] → [@ nsThreadManager::Shutdown] [@ nsThreadManager::Shutdown()]
Crash Signature: [@ nsThreadManager::Shutdown] [@ nsThreadManager::Shutdown()] → [@ nsThreadManager::Shutdown] [@ nsThreadManager::Shutdown()]
Summary: Intermittent [tier2] startup_about_home_paint_realworld_webextensions | application crashed [@ nsThreadManager::Shutdown()] | Found crashes after test run, terminating test → Intermittent [tier2] startup_about_home_paint_realworld_webextensions | application crashed [@ nsThreadManager::Shutdown] | Found crashes after test run, terminating test
Crash Signature: [@ nsThreadManager::Shutdown] [@ nsThreadManager::Shutdown()] → [@ nsThreadManager::Shutdown]

This looks like it might be related to bug 1615123.

See Also: → 1615123
Whiteboard: [tbird crash]

Nika says thread manager has changed a lot in the last few years so it is hard to say if this is still around. Also this intermittent failure hasn't shown up again.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.