1739831 - Fail Fast Exception crash with security.sandbox.content.level 20

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, enhancement, P3)

Description

[NN]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0

Steps to reproduce:

security.sandbox.content.level 20
security.sandbox.gpu.level 1

Navigate to https://addons.mozilla.org/

Actual results:

Page crash

Expected results:

Page is opened correctly.

If security.sandbox.content.level is set to 10, everything works fine

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Security: Process Sandboxing' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Bob Owen (:bobowen)]

Thanks for filing this, could you add a link to one of the crashes that you are getting?
Also could you try retesting in the latest Beta or Nightly?
https://www.mozilla.org/firefox/channel/desktop/

Comment 3

[NN]

I am testing FIrefox Developer Edition 95.0b3

Navigating to addons.mozilla.org shows a message box:

---------------------------
Windows - Fail Fast Exception
---------------------------
A fail fast exception occurred. Exception handlers will not be invoked and the process will be terminated immediately. 
---------------------------
OK   
---------------------------

Comment 4

[Chris Peterson [:cpeterson]]

I can reproduce this crash on quite a few websites with security.sandbox.content.level = 20, including cnn.com or running a speed test on speedtest.net. This looks like an audio issue. I'm running Nighty 96 on Windows 11. I don't need to set security.sandbox.gpu.level = 1.

Crash report: https://crash-stats.mozilla.org/report/index/d35ed240-e9d2-4111-a45f-7cb110211110

Reason: ERROR_MOD_NOT_FOUND

Top 10 frames of crashing thread:

0 kernelbase.dll kernelbase.dll@0x13ea32 
1 xul.dll __delayLoadHelper2 /builds/worker/workspace/obj-build/toolkit/library/build/d:/agent/_work/3/s/src/vctools/delayimp/delayhlp.cpp:312
2 xul.dll _tailMerge_avrt.dll 
3 xul.dll audioipc_client::context::impl$3::init::closure$6 third_party/rust/audioipc-client/src/context.rs:236
4 xul.dll std::sys_common::backtrace::__rust_begin_short_backtrace<futures_cpupool::impl$12::create::closure$0, tuple$<> > ../09c42c45858d5f3aedfa670698275303a3d19afa/library/std/src/sys_common/backtrace.rs:125
5 xul.dll core::ops::function::FnOnce::call_once<std::thread::impl$0::spawn_unchecked::closure$0, tuple$<> > ../09c42c45858d5f3aedfa670698275303a3d19afa/library/core/src/ops/function.rs:227
6 xul.dll std::sys::windows::thread::impl$0::new::thread_start ../09c42c45858d5f3aedfa670698275303a3d19afa//library/std/src/sys/windows/thread.rs:58
7 kernel32.dll kernel32.dll@0x16738 
8 ntdll.dll __RtlUserThreadStart 
9 ntdll.dll _RtlUserThreadStart 

Comment 5

[Bob Owen (:bobowen)]

NN - do you have the crash reporter disabled?

cperterson - I wonder if that's a different issue, are you getting a fail fast exception as well?

Comment 6

[NN]

@bobowen.
Hello, for some reason it was not enabled by default.
Anyway I turned it on, however it didn't change anything.
I still get fail fast exception.

My scenario is opening addons page (Ctrl+Alt+A) and then searching for addon.
This opens addons.mozilla.org and the message box.

Navigating to cnn.com first shows the regular Firefox tab crash and then shows the message box.

Comment 7

[Chris Peterson [:cpeterson]]

(In reply to Bob Owen (:bobowen) from comment #5)

cperterson - I wonder if that's a different issue, are you getting a fail fast exception as well?

Looks like there are two different problems:

1. On cnn.com, I see the fail fast exception dialog, but no crash reporter.

2. On youtube.com, I see the tab crash reporter (for the audioipc_client crash), but no fail fast exception dialog.

https://crash-stats.mozilla.org/report/index/02ac5711-ed31-4e65-bfd0-e11ec0211111

Should I file a separate bug for the audioipc_client crash and leave this bug for the fail fast exception?

Comment 8

[Gian-Carlo Pascutto [:gcp]]

The Rust audioipc client library is calling https://docs.microsoft.com/en-us/windows/win32/api/avrt/nf-avrt-avsetmmthreadcharacteristicsa in the content process.

Comment 9

[Bob Owen (:bobowen)]

(In reply to Chris Peterson [:cpeterson] from comment #7)

(In reply to Bob Owen (:bobowen) from comment #5)

cperterson - I wonder if that's a different issue, are you getting a fail fast exception as well?

Looks like there are two different problems:

1. On cnn.com, I see the fail fast exception dialog, but no crash reporter.

2. On youtube.com, I see the tab crash reporter (for the audioipc_client crash), but no fail fast exception dialog.

https://crash-stats.mozilla.org/report/index/02ac5711-ed31-4e65-bfd0-e11ec0211111

Should I file a separate bug for the audioipc_client crash and leave this bug for the fail fast exception?

Yes that would be great, I suspect that they are separate issues.

Comment 10

[Bob Owen (:bobowen)]

Attachment: Bug 1739831: Preload textshaping.dll before sandbox lowering in content processes. r=handyman!

This is used by DirectWrite in some fallback scenarios.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f1affa156c34
Preload textshaping.dll before sandbox lowering in content processes. r=handyman

Comment 12

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/f1affa156c34