1760340 - "Hit fatal chromium sandbox condition" when running "mach reftest" on Windows.

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P1)

Description

[Emilio Cobos Álvarez (:emilio)]

$ mach reftest layout/reftests/high-contrast/background-transparent-form-control.html
REFTEST WARNING | runreftest.py | Failed to copy c:\moz\mozilla-unified\obj-x86_64-pc-mingw32\dist\plugins to profile
REFTEST INFO | Running with e10s: True
REFTEST INFO | Running with fission: True
REFTEST INFO | Application command: c:\moz\mozilla-unified\obj-x86_64-pc-mingw32\dist\bin\firefox.exe -marionette --wait-for-browser -profile C:\Users\emilio\AppData\Local\Temp\tmp0qv5ivuq.mozrunner
### XPCOM_MEM_BLOAT_LOG defined -- logging bloat/leaks to C:\Users\emilio\AppData\Local\Temp\tmp0qv5ivuq.mozrunner\runreftest_leaks.log
[13696, Main Thread] WARNING: XPCOM_MEM_BLOAT_LOG is set, disabling native allocations.: file c:/moz/mozilla-unified/tools/profiler/core/platform.cpp:282
[2022-03-18T18:35:45Z WARN  rkv::backend::impl_safe::environment] `load_ratio()` is irrelevant for this storage backend.
### XPCOM_MEM_BLOAT_LOG defined -- logging bloat/leaks to C:\Users\emilio\AppData\Local\Temp\tmp0qv5ivuq.mozrunner\runreftest_leaks_socket_pid14504.log
[14504, Main Thread] WARNING: XPCOM_MEM_BLOAT_LOG is set, disabling native allocations.: file c:/moz/mozilla-unified/tools/profiler/core/platform.cpp:282
[Socket 14504, Main Thread] WARNING: 'NS_FAILED(rv)', file c:/moz/mozilla-unified/netwerk/protocol/http/nsHttpHandler.cpp:339
[Socket 14504, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, kKnownEsrVersion) failed with result 0x80004002 (NS_NOINTERFACE): file c:/moz/mozilla-unified/toolkit/components/resistfingerprinting/nsRFPService.cpp:560
[Parent 13696, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80520012 (NS_ERROR_FILE_NOT_FOUND): file c:/moz/mozilla-unified/layout/style/Loader.cpp:2039
### XPCOM_MEM_BLOAT_LOG defined -- logging bloat/leaks to C:\Users\emilio\AppData\Local\Temp\tmp0qv5ivuq.mozrunner\runreftest_leaks_gpu_pid4328.log
[4328, Main Thread] WARNING: XPCOM_MEM_BLOAT_LOG is set, disabling native allocations.: file c:/moz/mozilla-unified/tools/profiler/core/platform.cpp:282
1647628546076   Marionette      INFO    Marionette enabled
1647628546170   Marionette      TRACE   Received observer notification toplevel-window-ready
[GPU 4328, Renderer] WARNING: Failed to bind API to GL!: file c:/moz/mozilla-unified/gfx/gl/GLContextProviderEGL.cpp:622
[GPU 4328, Renderer] WARNING: Failed to create GLContext from PBuffer: file c:/moz/mozilla-unified/gfx/gl/GLContextProviderEGL.cpp:1159
[GPU 4328, Renderer] WARNING: Failed to create EGLContext with khr_rbab_attribs: file c:/moz/mozilla-unified/gfx/gl/GLContextProviderEGL.cpp:720
Initializing context 000001C24BC87000 surface 000001C24A06A430 on display 000001C24A0D3C00
GL_VENDOR: Google Inc. (AMD)
mVendor: Unknown
GL_RENDERER: ANGLE (AMD, AMD Radeon RX 5700 XT Direct3D11 vs_5_0 ps_5_0, D3D11-30.0.13023.3018)
mRenderer: Unknown
mIsMesa: 0
[GPU 4328, COM MTA] WARNING: NS_ENSURE_TRUE(actsNum > 0) failed: file c:/moz/mozilla-unified/dom/media/platforms/wmf/MFTDecoder.cpp:59
[GPU 4328, COM MTA] WARNING: NS_ENSURE_TRUE(actsNum > 0) failed: file c:/moz/mozilla-unified/dom/media/platforms/wmf/MFTDecoder.cpp:59
[GPU 4328, COM MTA] WARNING: NS_ENSURE_TRUE(actsNum > 0) failed: file c:/moz/mozilla-unified/dom/media/platforms/wmf/MFTDecoder.cpp:59
[2022-03-18T18:35:46Z WARN  webrender::device::gl] Missing optimized shader source for gpu_cache_update
[2022-03-18T18:35:46Z WARN  webrender::device::gl] Cropping texture upload Box2D((0, 0), (0, 1)) to None
[2022-03-18T18:35:46Z WARN  webrender::device::gl] Cropping texture upload Box2D((0, 0), (0, 1)) to None
[Parent 13696, Main Thread] WARNING: NS_ENSURE_TRUE(rootFrame) failed: file c:/moz/mozilla-unified/dom/base/nsGlobalWindowOuter.cpp:4167
[Parent 13696, Main Thread] WARNING: NS_ENSURE_TRUE(rootFrame) failed: file c:/moz/mozilla-unified/dom/base/nsGlobalWindowOuter.cpp:4167
[2022-03-18T18:35:46Z WARN  webrender::device::gl] Cropping texture upload Box2D((0, 0), (0, 1)) to None
[2022-03-18T18:35:46Z WARN  webrender::device::gl] Cropping texture upload Box2D((0, 0), (0, 1)) to None
[Parent 13696, Main Thread] WARNING: Failed to retarget HTML data delivery to the parser thread.: file c:/moz/mozilla-unified/parser/html/nsHtml5StreamParser.cpp:1180
[2022-03-18T18:35:46Z WARN  webrender::device::gl] Missing optimized shader source for gpu_cache_update
[Parent 13696, Main Thread] WARNING: NS_ENSURE_TRUE(rootFrame) failed: file c:/moz/mozilla-unified/dom/base/nsGlobalWindowOuter.cpp:4167
Hit MOZ_CRASH(Hit fatal chromium sandbox condition.) at c:/moz/mozilla-unified/security/sandbox/chromium-shim/base/logging.cpp:111
[GPU 4328, IPC I/O Child] WARNING: [EDEB036D7588DD91.20C8444B7ADC32B2]: Ignoring message 'EVENT_MESSAGE' to peer 1.1 due to a missing broker: file c:/moz/mozilla-unified/ipc/glue/NodeController.cpp:348
[GPU 4328, IPC I/O Child] WARNING: [EDEB036D7588DD91.20C8444B7ADC32B2]: Ignoring message 'EVENT_MESSAGE' to peer 1.1 due to a missing broker: file c:/moz/mozilla-unified/ipc/glue/NodeController.cpp:348
[GPU 4328, IPC I/O Child] WARNING: [EDEB036D7588DD91.20C8444B7ADC32B2]: Ignoring message 'EVENT_MESSAGE' to peer 1.1 due to a missing broker: file c:/moz/mozilla-unified/ipc/glue/NodeController.cpp:348
[GPU 4328, Compositor] WARNING: IPC message 'PCompositorWidget::Msg_ObserveVsync' discarded: actor cannot send: file c:/moz/mozilla-unified/ipc/glue/ProtocolUtils.cpp:506
[GPU 4328, IPC I/O Child] WARNING: [EDEB036D7588DD91.20C8444B7ADC32B2]: Ignoring message 'EVENT_MESSAGE' to peer 1.1 due to a missing broker: file c:/moz/mozilla-unified/ipc/glue/NodeController.cpp:348
[GPU 4328, Compositor] WARNING: IPC message 'PCompositorWidget::Msg_UnobserveVsync' discarded: actor cannot send: file c:/moz/mozilla-unified/ipc/glue/ProtocolUtils.cpp:506
[GPU 4328, IPC I/O Child] WARNING: [EDEB036D7588DD91.20C8444B7ADC32B2]: Ignoring message 'EVENT_MESSAGE' to peer 1.1 due to a missing broker: file c:/moz/mozilla-unified/ipc/glue/NodeController.cpp:348
[GPU 4328, IPC I/O Child] WARNING: [EDEB036D7588DD91.20C8444B7ADC32B2]: Ignoring message 'EVENT_MESSAGE' to peer 1.1 due to a missing broker: file c:/moz/mozilla-unified/ipc/glue/NodeController.cpp:348
[GPU 4328, IPC I/O Child] WARNING: [EDEB036D7588DD91.20C8444B7ADC32B2]: Ignoring message 'EVENT_MESSAGE' to peer 1.1 due to a missing broker: file c:/moz/mozilla-unified/ipc/glue/NodeController.cpp:348
[GPU 4328, IPC I/O Child] WARNING: [EDEB036D7588DD91.20C8444B7ADC32B2]: Ignoring message 'EVENT_MESSAGE' to peer 1.1 due to a missing broker: file c:/moz/mozilla-unified/ipc/glue/NodeController.cpp:348
[GPU 4328, Main Thread] WARNING: Shutting down GPU process early due to a crash!: file c:/moz/mozilla-unified/gfx/ipc/GPUParent.cpp:646

Comment 1

[Emilio Cobos Álvarez (:emilio)]

MOZ_DISABLE_CONTENT_SANDBOX=1 helps.

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Bug 1055227, filed in 2014, is still relevant.

IPC has a replacement for Chromium logging which does do actual logging; the one for sandboxing does not, but from a quick look at the code it looks like we are accumulating the message into the stream_ member (even though it's not used), so it might be simple to patch the destructor so that it prints something.

(This also means that, as far as the concerns about async signal safety in 1055227, we're already risking deadlock (or UB) from printing into the stringstream if these macros are used in a signal handler, unless I'm missing something. Not an issue on Windows, but suggests that adding a printf or NS_DebugBreak into the destructor wouldn't introduce a problem on Linux where we don't already have one.)

Comment 3

[Gian-Carlo Pascutto [:gcp]]

Bob said he was going to have a look.

Comment 5

[Bob Owen (:bobowen)]

Sorry forgot about this issue.
This isn't a problem with the sandbox logging, that is just what is used to force a crash (their CHECK and DCHECK).

This was actually regressed by bug 1635428, because these tests add in rules with forward slashes.
I could change all the test scripts, but I think it should be safe to change from a check to a replacement of / with \.

Comment 6

[Release mgmt bot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1635428

Comment 7

[Bob Owen (:bobowen)]

Whoops wrong regressing bug.

Comment 8

[Bob Owen (:bobowen)]

https://treeherder.mozilla.org/jobs?repo=try&revision=bd67128c597f899f723660b69da094ea95220a81

Comment 9

[Bob Owen (:bobowen)]

Attachment: Bug 1760340: Re-allow forward slashes in windows sandbox file system policy rules. r=handyman!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3b57c0c8f967
Re-allow forward slashes in windows sandbox file system policy rules. r=handyman

Comment 11

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/3b57c0c8f967