Closed
Bug 1743456
Opened 1 year ago
Closed 7 months ago
Hit MOZ_CRASH(DocumentChannel::SetLoadFlags: Don't set flags after creation) at /netwerk/ipc/DocumentChannel.cpp:299
Categories
(Core :: Networking, defect, P2)
Tracking
()
RESOLVED
DUPLICATE
of bug 1694904
People
(Reporter: jkratzer, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: testcase, Whiteboard: [bugmon:confirm][necko-triage])
Attachments
(1 file)
4.00 KB,
application/octet-stream
|
Details |
Testcase found while fuzzing mozilla-central rev d03f87555639 (built with: --enable-address-sanitizer --enable-fuzzing).
Testcase can be reproduced using the following commands:
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build d03f87555639 --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip --repeat 20 --no-harness
Hit MOZ_CRASH(DocumentChannel::SetLoadFlags: Don't set flags after creation) at /netwerk/ipc/DocumentChannel.cpp:299
=================================================================
==3558750==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f4fee6c5d9b bp 0x7ffdf49a1330 sp 0x7ffdf49a1260 T0)
==3558750==The signal is caused by a WRITE memory access.
==3558750==Hint: address points to the zero page.
#0 0x7f4fee6c5d9b in mozilla::net::DocumentChannel::SetLoadFlags(unsigned int) /netwerk/ipc/DocumentChannel.cpp:299:3
#1 0x7f4fed8e74e3 in mozilla::net::nsLoadGroup::MergeLoadFlags(nsIRequest*, unsigned int&) /netwerk/base/nsLoadGroup.cpp:1028:20
#2 0x7f4fed8e6726 in mozilla::net::nsLoadGroup::AddRequest(nsIRequest*, nsISupports*) /netwerk/base/nsLoadGroup.cpp:440:10
#3 0x7f4fee6c7faf in mozilla::net::DocumentChannelChild::AsyncOpen(nsIStreamListener*) /netwerk/ipc/DocumentChannelChild.cpp:84:17
#4 0x7f4fefb9e28c in nsURILoader::OpenURI(nsIChannel*, unsigned int, nsIInterfaceRequestor*) /uriloader/base/nsURILoader.cpp:731:17
#5 0x7f4ff9441d31 in nsDocShell::OpenInitializedChannel(nsIChannel*, nsIURILoader*, unsigned int) /docshell/base/nsDocShell.cpp:10574:20
#6 0x7f4ff943a2c8 in nsDocShell::DoURILoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>, nsIRequest**) /docshell/base/nsDocShell.cpp:10443:10
#7 0x7f4ff938c43d in nsDocShell::InternalLoad(nsDocShellLoadState*, mozilla::Maybe<unsigned int>) /docshell/base/nsDocShell.cpp:9536:8
#8 0x7f4ff9409b75 in nsDocShell::LoadHistoryEntry(nsDocShellLoadState*, unsigned int, bool) /docshell/base/nsDocShell.cpp:11906:10
#9 0x7f4ff94d480a in operator() /docshell/base/nsDocShell.cpp:4006:25
#10 0x7f4ff94d480a in std::_Function_handler<void (mozilla::Tuple<bool, mozilla::Maybe<RefPtr<nsDocShellLoadState> >, mozilla::Maybe<bool> >&&), nsDocShell::Reload(unsigned int)::$_71>::_M_invoke(std::_Any_data const&, mozilla::Tuple<bool, mozilla::Maybe<RefPtr<nsDocShellLoadState> >, mozilla::Maybe<bool> >&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:316:2
#11 0x7f4feed099be in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:14060:27
#12 0x7f4feea85ad9 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:2043:25
#13 0x7f4feea829d8 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /ipc/glue/MessageChannel.cpp:1968:9
#14 0x7f4feea841f2 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1827:3
#15 0x7f4feea84c07 in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1855:14
#16 0x7f4fed5a55e2 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:468:16
#17 0x7f4fed56aabd in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:771:26
#18 0x7f4fed568018 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:607:15
#19 0x7f4fed568729 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:391:36
#20 0x7f4fed5aec21 in operator() /xpcom/threads/TaskController.cpp:124:37
#21 0x7f4fed5aec21 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:531:5
#22 0x7f4fed58aea7 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1183:16
#23 0x7f4fed59639c in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:467:10
#24 0x7f4feea8e46f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
#25 0x7f4fee90d801 in RunInternal /ipc/chromium/src/base/message_loop.cc:331:10
#26 0x7f4fee90d801 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#27 0x7f4fee90d801 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#28 0x7f4ff5597a17 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
#29 0x7f4ffa05fc6f in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:864:20
#30 0x7f4fee90d801 in RunInternal /ipc/chromium/src/base/message_loop.cc:331:10
#31 0x7f4fee90d801 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
#32 0x7f4fee90d801 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
#33 0x7f4ffa05eea2 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:701:34
#34 0x55ba8c74bdfd in content_process_main(mozilla::Bootstrap*, int, char**) /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#35 0x55ba8c74c228 in main /browser/app/nsBrowserApp.cpp:327:18
#36 0x7f500b7cd0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#37 0x55ba8c69aec9 in _start (/home/jkratzer/builds/mc-asan/firefox+0x5cec9)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /netwerk/ipc/DocumentChannel.cpp:299:3 in mozilla::net::DocumentChannel::SetLoadFlags(unsigned int)
==3558750==ABORTING
Reporter | ||
Comment 1•1 year ago
|
||
Comment 2•1 year ago
|
||
Bugmon Analysis
Unable to reproduce bug 1743456 using build mozilla-central 20211129094259-d03f87555639. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Keywords: bugmon
Comment 3•1 year ago
|
||
Anny, can you take a look?
Severity: -- → S3
Flags: needinfo?(agakhokidze)
Priority: -- → P2
Whiteboard: [bugmon:confirm] → [bugmon:confirm][necko-triage]
Comment 4•1 year ago
|
||
Redirecting the NI to Hsin-Yi, as I won't be able to look into this anymore.
Flags: needinfo?(agakhokidze) → needinfo?(htsai)
Comment 5•1 year ago
|
||
Isn't this a duplicate of Bug 1694904?
Updated•7 months ago
|
Status: NEW → RESOLVED
Closed: 7 months ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•