1756639 - Crash in [@ mozilla::dom::MessageChannel::~MessageChannel]

Status: RESOLVED INCOMPLETE

(Core :: DOM: postMessage, defect)

Description

[Randell Jesup [:jesup] (needinfo me)]

UAFs with e5e5 addresses in ~MessageChannel, called from CC

Comment 1

[Andrew McCreight [:mccr8]]

This is actually about the DOM API MessageChannel, not the IPC MessageChannel. The cycle collector appears in the stack just because it always does when we delete cycle collected objects.

Comment 2

[Andrew McCreight [:mccr8]]

There are 3 reports in the last 6 months, all from the same install time. The URL of the crash is WhatsApp.

Comment 3

[Jens Stutte [:jstutte]]

I see always only that 3 crashes from the same install and same beta-version on Windows 7. Randell, is this really worth a sec-high rating?

Comment 4

[Jens Stutte [:jstutte]]

We do not have any actionable information but want to monitor this for a while before marking it stalled.

Comment 5

[Andrew McCreight [:mccr8]]

Given that this only happened once as far as we can see, I'd just mark it incomplete if it doesn't come up again.

Comment 6

[Jens Stutte [:jstutte]]

(In reply to Andrew McCreight [:mccr8] from comment #5)

Given that this only happened once as far as we can see, I'd just mark it incomplete if it doesn't come up again.

Yes, no more reports and those occurred where all from the same beta install on the same day, so not even from a shipped release.