1746537 - Use-after-free crash in [@ mozilla::net::ProxyAutoConfig::MyIPAddressTryHost]

Status: RESOLVED DUPLICATE of bug 1746543

(Core :: Networking: HTTP, defect, P1)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/015a2800-7f3a-4174-860a-356dc0211216

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 4 frames of crashing thread:

0 xul.dll mozilla::net::ProxyAutoConfig::MyIPAddressTryHost netwerk/base/ProxyAutoConfig.cpp:995
1 xul.dll mozilla::net::ProxyAutoConfig::MyIPAddress netwerk/base/ProxyAutoConfig.cpp:1071
2 xul.dll mozilla::net::PACMyIpAddress netwerk/base/ProxyAutoConfig.cpp:587
3 None @0x0000030cb889a0e9 

There are a couple of crashes with this signature. The rax register contains a jemalloc poison value.

Comment 1

[Andrew McCreight [:mccr8]]

It looks like this feature is Nightly-only for now.

Comment 2

[Andrew McCreight [:mccr8]]

Maybe [@ mozilla::net::ProxyAutoConfig::MyIPAddress ] is the same crash on Windows? Not a lot of these, but they also have a poison value in rax.

Comment 3

[Kershaw Chang [:kershaw]]

I think the problem is that ProxyAutoConfig is released too early at here. In ProxyAutoConfig, we spin the event loop for waiting the DNS result. At this point, if ProxyAutoConfigChild::ActorDestroy is called, we got this crash.

Comment 4

[Kershaw Chang [:kershaw]]

Attachment: Bug 1746537, r=#necko

Comment 5

[Kershaw Chang [:kershaw]]

Sorry, this bug was closed by mistake.

Comment 6

[Phabricator Automation]

Comment on attachment 9255892 [details]
Bug 1746537, r=#necko

Revision D134137 was moved to bug 1746543. Setting attachment 9255892 [details] to obsolete.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1745385

Comment 8

[Ryan VanderMeulen [:RyanVM]]

No recent crashes it would appear. Did bug 1746543 fix this crash too?

Comment 9

[Kershaw Chang [:kershaw]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)

No recent crashes it would appear. Did bug 1746543 fix this crash too?

Yes, I think so. We can close this one.