Intermittent SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50 in mozilla::RefPtrTraits<mozilla::media::OriginKeyStore>::Release
Categories
(Core :: WebRTC: Audio/Video, defect, P1)
Tracking
()
People
(Reporter: intermittent-bug-filer, Assigned: jib)
Details
(4 keywords, Whiteboard: [post-critsmash-triage][adv-main101+r][adv-esr91.10+r])
Attachments
(1 external file, 1 obsolete file)
Filed by: archaeopteryx [at] coole-files.de
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=371850564&repo=mozilla-central
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/YzCHCYtvREWGJmAvi7BOZw/runs/0/artifacts/public/logs/live_backing.log
Please check if this is a real issue because this gets reported after a previous failure of the test (bug 1744613).
[task 2022-03-22T06:18:35.740Z] 06:18:35 INFO - TEST-PASS | dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js | AudioContext is not started yet. - true == true -
[task 2022-03-22T06:18:35.740Z] 06:18:35 INFO - - calling gum with {"video":true}
[task 2022-03-22T06:18:35.740Z] 06:18:35 INFO - Buffered messages finished
[task 2022-03-22T06:18:35.741Z] 06:18:35 INFO - TEST-UNEXPECTED-FAIL | dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js | AbortError: The operation was aborted. -
[task 2022-03-22T06:18:35.741Z] 06:18:35 INFO - Stack trace:
[task 2022-03-22T06:18:35.741Z] 06:18:35 INFO - chrome://mochikit/content/browser-test.js:test_ok:1394
[task 2022-03-22T06:18:35.742Z] 06:18:35 INFO - chrome://mochitests/content/browser/dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js:testWebAudioWithGUM:159
[task 2022-03-22T06:18:35.742Z] 06:18:35 INFO - - calling resume() again
[task 2022-03-22T06:18:35.743Z] 06:18:35 INFO - Console message: [JavaScript Warning: "An AudioContext was prevented from starting automatically. It must be created or resumed after a user gesture on the page." {file: "chrome://mochitests/content/browser/dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js" line: 108}]
[task 2022-03-22T06:20:04.329Z] 06:20:04 INFO - Not taking screenshot here: see the one that was previously logged
[task 2022-03-22T06:20:04.332Z] 06:20:04 INFO - TEST-UNEXPECTED-FAIL | dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js | Test timed out -
[task 2022-03-22T06:20:04.377Z] 06:20:04 INFO - GECKO(4748) | MEMORY STAT | vsize 19406276MB | vsizeMaxContiguous 65210484MB | residentFast 1039MB
[task 2022-03-22T06:20:04.378Z] 06:20:04 INFO - TEST-OK | dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js | took 90060ms
[task 2022-03-22T06:20:04.379Z] 06:20:04 INFO - Not taking screenshot here: see the one that was previously logged
[task 2022-03-22T06:20:04.379Z] 06:20:04 INFO - TEST-UNEXPECTED-FAIL | dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js | Found a tab after previous test timed out: https://example.com/ -
[task 2022-03-22T06:20:04.449Z] 06:20:04 INFO - checking window state
[task 2022-03-22T06:20:04.492Z] 06:20:04 INFO - TEST-START | dom/media/autoplay/test/browser/browser_autoplay_videoDocument.js
[task 2022-03-22T06:20:04.558Z] 06:20:04 INFO - Not taking screenshot here: see the one that was previously logged
[task 2022-03-22T06:20:04.558Z] 06:20:04 INFO - Buffered messages logged at 06:20:04
[task 2022-03-22T06:20:04.559Z] 06:20:04 INFO - Entering test bound
[task 2022-03-22T06:20:04.559Z] 06:20:04 INFO - Buffered messages finished
[task 2022-03-22T06:20:04.560Z] 06:20:04 INFO - TEST-UNEXPECTED-FAIL | dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js | Uncaught exception received from previously timed out test - at chrome://mochitests/content/browser/dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js:169 - ReferenceError: ok is not defined
[task 2022-03-22T06:20:04.560Z] 06:20:04 INFO - Stack trace:
[task 2022-03-22T06:20:04.560Z] 06:20:04 INFO - testWebAudioWithGUM@chrome://mochitests/content/browser/dom/media/autoplay/test/browser/browser_autoplay_policy_web_audio_with_gum.js:169:5
[task 2022-03-22T06:20:04.568Z] 06:20:04 INFO - GECKO(4748) | =================================================================
[task 2022-03-22T06:20:04.568Z] 06:20:04 ERROR - GECKO(4748) | ==2932==ERROR: AddressSanitizer: heap-use-after-free on address 0x128a6f05b490 at pc 0x7ffe995875ea bp 0x00d3b2ff0e40 sp 0x00d3b2ff0e88
[task 2022-03-22T06:20:04.569Z] 06:20:04 INFO - GECKO(4748) | READ of size 8 at 0x128a6f05b490 thread T0
[task 2022-03-22T06:20:04.970Z] 06:20:04 INFO - GECKO(4748) | #0 0x7ffe995875e9 in mozilla::RefPtrTraits<mozilla::media::OriginKeyStore>::Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50
[task 2022-03-22T06:20:04.970Z] 06:20:04 INFO - GECKO(4748) | #1 0x7ffe995875e9 in RefPtr<mozilla::media::OriginKeyStore>::ConstRemovingRefPtrTraits<mozilla::media::OriginKeyStore>::Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381
[task 2022-03-22T06:20:04.971Z] 06:20:04 INFO - GECKO(4748) | #2 0x7ffe995875e9 in RefPtr<mozilla::media::OriginKeyStore>::~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81
[task 2022-03-22T06:20:04.971Z] 06:20:04 INFO - GECKO(4748) | #3 0x7ffe995875e9 in mozilla::media::Parent<class mozilla::media::PMediaParent>::~Parent<class mozilla::media::PMediaParent>(void) /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:522
[task 2022-03-22T06:20:04.972Z] 06:20:04 INFO - GECKO(4748) | #4 0x7ffe995854cf in mozilla::media::Parent<class mozilla::media::PMediaParent>::`scalar deleting dtor'(unsigned int) /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:522
[task 2022-03-22T06:20:04.972Z] 06:20:04 INFO - GECKO(4748) | #5 0x7ffe9954b734 in mozilla::media::RefCountedParent::Release /builds/worker/workspace/obj-build/dist/include/mozilla/media/MediaParent.h:43
[task 2022-03-22T06:20:04.973Z] 06:20:04 INFO - GECKO(4748) | #6 0x7ffe9954b734 in mozilla::media::DeallocPMediaParent(class mozilla::media::PMediaParent *) /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:533
[task 2022-03-22T06:20:04.974Z] 06:20:04 INFO - GECKO(4748) | #7 0x7ffe935402fe in mozilla::ipc::ActorLifecycleProxy::~ActorLifecycleProxy(void) /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:256
[task 2022-03-22T06:20:04.974Z] 06:20:04 INFO - GECKO(4748) | #8 0x7ffe9a8b6628 in mozilla::ipc::ActorLifecycleProxy::Release /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/ProtocolUtils.h:616
[task 2022-03-22T06:20:04.975Z] 06:20:04 INFO - GECKO(4748) | #9 0x7ffe9a8b6628 in mozilla::dom::PContentParent::ClearSubtree(void) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:17038
[task 2022-03-22T06:20:04.975Z] 06:20:04 INFO - GECKO(4748) | #10 0x7ffe9a8b4a71 in mozilla::dom::PContentParent::OnChannelClose(void) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:16913
[task 2022-03-22T06:20:04.976Z] 06:20:04 INFO - GECKO(4748) | #11 0x7ffe93521a80 in mozilla::ipc::MessageChannel::Close(void) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2049
[task 2022-03-22T06:20:04.976Z] 06:20:04 INFO - GECKO(4748) | #12 0x7ffe9a5f5000 in mozilla::dom::ContentParent::ShutDownProcess(enum mozilla::dom::ContentParent::ShutDownMethod) /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:1794
[task 2022-03-22T06:20:04.977Z] 06:20:04 INFO - GECKO(4748) | #13 0x7ffe9a607429 in mozilla::dom::ContentParent::RecvFinishShutdown(void) /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:1809
[task 2022-03-22T06:20:04.977Z] 06:20:04 INFO - GECKO(4748) | #14 0x7ffe9a86ebc5 in mozilla::dom::PContentParent::OnMessageReceived(class IPC::Message const &) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:10920
[task 2022-03-22T06:20:04.978Z] 06:20:04 INFO - GECKO(4748) | #15 0x7ffe9351e7a2 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(class mozilla::ipc::ActorLifecycleProxy *, class IPC::Message const &) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1674
[task 2022-03-22T06:20:04.978Z] 06:20:04 INFO - GECKO(4748) | #16 0x7ffe9351c121 in mozilla::ipc::MessageChannel::DispatchMessage(class mozilla::ipc::ActorLifecycleProxy *, class IPC::Message &&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1599
[task 2022-03-22T06:20:04.979Z] 06:20:04 INFO - GECKO(4748) | #17 0x7ffe9351d56c in mozilla::ipc::MessageChannel::MessageTask::Run(void) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1496
[task 2022-03-22T06:20:04.980Z] 06:20:04 INFO - GECKO(4748) | #18 0x7ffe91f31cbd in mozilla::RunnableTask::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:467
[task 2022-03-22T06:20:04.980Z] 06:20:04 INFO - GECKO(4748) | #19 0x7ffe91ee4d11 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:778
[task 2022-03-22T06:20:04.981Z] 06:20:04 INFO - GECKO(4748) | #20 0x7ffe91ee121c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:612
[task 2022-03-22T06:20:04.981Z] 06:20:04 INFO - GECKO(4748) | #21 0x7ffe91ee1be4 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:390
[task 2022-03-22T06:20:04.982Z] 06:20:04 INFO - GECKO(4748) | #22 0x7ffe91f3a4c1 in mozilla::TaskController::InitializeInternal::<lambda_1>::operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:124
[task 2022-03-22T06:20:04.982Z] 06:20:04 INFO - GECKO(4748) | #23 0x7ffe91f3a4c1 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:124:7'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
[task 2022-03-22T06:20:04.983Z] 06:20:04 INFO - GECKO(4748) | #24 0x7ffe91f11743 in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1173
[task 2022-03-22T06:20:04.983Z] 06:20:04 INFO - GECKO(4748) | #25 0x7ffe91f22d8c in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467
[task 2022-03-22T06:20:04.984Z] 06:20:04 INFO - GECKO(4748) | #26 0x7ffe9352719d in mozilla::ipc::MessagePump::Run(class base::MessagePump::Delegate *) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85
[task 2022-03-22T06:20:04.984Z] 06:20:04 INFO - GECKO(4748) | #27 0x7ffe9343e4d5 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331
[task 2022-03-22T06:20:04.985Z] 06:20:04 INFO - GECKO(4748) | #28 0x7ffe9343e4d5 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324
[task 2022-03-22T06:20:04.985Z] 06:20:04 INFO - GECKO(4748) | #29 0x7ffe9343e2a5 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306
[task 2022-03-22T06:20:04.986Z] 06:20:04 INFO - GECKO(4748) | #30 0x7ffe9b4b88da in nsBaseAppShell::Run(void) /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137
[task 2022-03-22T06:20:04.986Z] 06:20:04 INFO - GECKO(4748) | #31 0x7ffe9b6a855c in nsAppShell::Run(void) /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:614
[task 2022-03-22T06:20:04.987Z] 06:20:04 INFO - GECKO(4748) | #32 0x7ffe9fb687bb in nsAppStartup::Run(void) /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:295
[task 2022-03-22T06:20:04.987Z] 06:20:04 INFO - GECKO(4748) | #33 0x7ffe9fe23c03 in XREMain::XRE_mainRun(void) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5739
[task 2022-03-22T06:20:04.988Z] 06:20:04 INFO - GECKO(4748) | #34 0x7ffe9fe29463 in XREMain::XRE_main(int, char **const, struct mozilla::BootstrapConfig const &) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5924
[task 2022-03-22T06:20:04.988Z] 06:20:04 INFO - GECKO(4748) | #35 0x7ffe9fe2a72a in XRE_main(int, char **const, struct mozilla::BootstrapConfig const &) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5991
[task 2022-03-22T06:20:04.989Z] 06:20:04 INFO - GECKO(4748) | #36 0x7ff698382594 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:226
[task 2022-03-22T06:20:04.989Z] 06:20:04 INFO - GECKO(4748) | #37 0x7ff698382594 in NS_internal_main(int, char **, char **) /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:395
[task 2022-03-22T06:20:04.990Z] 06:20:04 INFO - GECKO(4748) | #38 0x7ff6983817bd in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:167
[task 2022-03-22T06:20:04.990Z] 06:20:04 INFO - GECKO(4748) | #39 0x7ff69847e8c7 in invoke_main d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:90
[task 2022-03-22T06:20:04.991Z] 06:20:04 INFO - GECKO(4748) | #40 0x7ff69847e8c7 in __scrt_common_main_seh d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
[task 2022-03-22T06:20:04.991Z] 06:20:04 INFO - GECKO(4748) | #41 0x7ffed8ec7033 (C:\Windows\System32\KERNEL32.DLL+0x180017033)
[task 2022-03-22T06:20:04.992Z] 06:20:04 INFO - GECKO(4748) | #42 0x7ffed9962650 (C:\Windows\SYSTEM32\ntdll.dll+0x180052650)
[task 2022-03-22T06:20:04.992Z] 06:20:04 INFO - GECKO(4748) | 0x128a6f05b490 is located 0 bytes inside of 112-byte region [0x128a6f05b490,0x128a6f05b500)
[task 2022-03-22T06:20:04.992Z] 06:20:04 INFO - GECKO(4748) | freed by thread T29 here:
[task 2022-03-22T06:20:05.007Z] 06:20:05 INFO - GECKO(4748) | #0 0x7ffead577cdb in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:82
[task 2022-03-22T06:20:05.007Z] 06:20:05 INFO - GECKO(4748) | #1 0x7ffe9958413c in operator delete /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:51
[task 2022-03-22T06:20:05.008Z] 06:20:05 INFO - GECKO(4748) | #2 0x7ffe9958413c in mozilla::media::OriginKeyStore::`scalar deleting dtor'(unsigned int) /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:378
[task 2022-03-22T06:20:05.008Z] 06:20:05 INFO - GECKO(4748) | #3 0x7ffe9220660e in mozilla::net::WebSocketRequest::Release(void) /builds/worker/checkouts/gecko/netwerk/base/Dashboard.cpp:55
[task 2022-03-22T06:20:05.009Z] 06:20:05 INFO - GECKO(4748) | #4 0x7ffe9958756d in mozilla::RefPtrTraits<mozilla::media::OriginKeyStore>::Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50
[task 2022-03-22T06:20:05.009Z] 06:20:05 INFO - GECKO(4748) | #5 0x7ffe9958756d in RefPtr<mozilla::media::OriginKeyStore>::ConstRemovingRefPtrTraits<mozilla::media::OriginKeyStore>::Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381
[task 2022-03-22T06:20:05.010Z] 06:20:05 INFO - GECKO(4748) | #6 0x7ffe9958756d in RefPtr<mozilla::media::OriginKeyStore>::~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81
[task 2022-03-22T06:20:05.010Z] 06:20:05 INFO - GECKO(4748) | #7 0x7ffe9958756d in mozilla::media::Parent<class mozilla::media::PMediaParent>::~Parent<class mozilla::media::PMediaParent>(void) /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:524
[task 2022-03-22T06:20:05.011Z] 06:20:05 INFO - GECKO(4748) | #8 0x7ffe995854cf in mozilla::media::Parent<class mozilla::media::PMediaParent>::`scalar deleting dtor'(unsigned int) /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:522
[task 2022-03-22T06:20:05.011Z] 06:20:05 INFO - GECKO(4748) | #9 0x7ffe9957a922 in mozilla::media::RefCountedParent::Release /builds/worker/workspace/obj-build/dist/include/mozilla/media/MediaParent.h:43
[task 2022-03-22T06:20:05.012Z] 06:20:05 INFO - GECKO(4748) | #10 0x7ffe9957a922 in mozilla::RefPtrTraits<mozilla::media::Parent<mozilla::media::NonE10s> >::Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50
[task 2022-03-22T06:20:05.013Z] 06:20:05 INFO - GECKO(4748) | #11 0x7ffe9957a922 in RefPtr<mozilla::media::Parent<mozilla::media::NonE10s> >::ConstRemovingRefPtrTraits<mozilla::media::Parent<mozilla::media::NonE10s> >::Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381
[task 2022-03-22T06:20:05.013Z] 06:20:05 INFO - GECKO(4748) | #12 0x7ffe9957a922 in RefPtr<mozilla::media::Parent<mozilla::media::NonE10s> >::~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81
[task 2022-03-22T06:20:05.014Z] 06:20:05 INFO - GECKO(4748) | #13 0x7ffe9957a922 in mozilla::media::Parent<mozilla::media::NonE10s>::RecvGetPrincipalKey::<lambda_1>::~ /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:432
[task 2022-03-22T06:20:05.014Z] 06:20:05 INFO - GECKO(4748) | #14 0x7ffe9957a922 in mozilla::DefaultDelete<`lambda at /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:432:7'>::operator() /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:463
[task 2022-03-22T06:20:05.015Z] 06:20:05 INFO - GECKO(4748) | #15 0x7ffe9957a922 in mozilla::UniquePtr<`lambda at /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:432:7',mozilla::DefaultDelete<`lambda at /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:432:7'> >::reset /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:305
[task 2022-03-22T06:20:05.016Z] 06:20:05 INFO - GECKO(4748) | #16 0x7ffe9957a922 in mozilla::UniquePtr<`lambda at /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:432:7',mozilla::DefaultDelete<`lambda at /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:432:7'> >::operator= /builds/worker/workspace/obj-build/dist/include/mozilla/UniquePtr.h:275
[task 2022-03-22T06:20:05.017Z] 06:20:05 INFO - GECKO(4748) | #17 0x7ffe9957a922 in mozilla::detail::ProxyFunctionRunnable<class `public: virtual class mozilla::ipc::IPCResult __cdecl mozilla::media::Parent<class mozilla::media::PMediaParent>::RecvGetPrincipalKey(class mozilla::ipc::PrincipalInfo const &, bool const &, class std::function<void __cdecl(class nsTString<char> const &)> &&)'::`1'::<lambda_1>, class mozilla::MozPromise<class nsTString<char>, enum nsresult, 0>>::Run(void) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1646
[task 2022-03-22T06:20:05.017Z] 06:20:05 INFO - GECKO(4748) | #18 0x7ffe91eec8b0 in mozilla::TaskQueue::Runner::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:206
[task 2022-03-22T06:20:05.018Z] 06:20:05 INFO - GECKO(4748) | #19 0x7ffe91f274f1 in nsThreadPool::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:310
[task 2022-03-22T06:20:05.018Z] 06:20:05 INFO - GECKO(4748) | #20 0x7ffe91f123c1 in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1167
[task 2022-03-22T06:20:05.019Z] 06:20:05 INFO - GECKO(4748) | #21 0x7ffe91f22d8c in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467
[task 2022-03-22T06:20:05.019Z] 06:20:05 INFO - GECKO(4748) | #22 0x7ffe935282fe in mozilla::ipc::MessagePumpForNonMainThreads::Run(class base::MessagePump::Delegate *) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300
[task 2022-03-22T06:20:05.020Z] 06:20:05 INFO - GECKO(4748) | #23 0x7ffe9343e4d5 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331
[task 2022-03-22T06:20:05.020Z] 06:20:05 INFO - GECKO(4748) | #24 0x7ffe9343e4d5 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324
[task 2022-03-22T06:20:05.021Z] 06:20:05 INFO - GECKO(4748) | #25 0x7ffe9343e2a5 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306
[task 2022-03-22T06:20:05.021Z] 06:20:05 INFO - GECKO(4748) | #26 0x7ffe91f084c6 in nsThread::ThreadFunc(void *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:389
[task 2022-03-22T06:20:05.022Z] 06:20:05 INFO - GECKO(4748) | #27 0x7ffeae305a9e in _PR_NativeRunThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:399
[task 2022-03-22T06:20:05.022Z] 06:20:05 INFO - GECKO(4748) | #28 0x7ffeae2ddc4b in pr_root /builds/worker/checkouts/gecko/nsprpub/pr/src/md/windows/w95thred.c:139
[task 2022-03-22T06:20:05.022Z] 06:20:05 INFO - GECKO(4748) | #29 0x7ffed75e1bb1 (C:\Windows\System32\ucrtbase.dll+0x180021bb1)
[task 2022-03-22T06:20:05.023Z] 06:20:05 INFO - GECKO(4748) | #30 0x7ffead582273 in __asan::AsanThread::ThreadStart(unsigned __int64) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_thread.cpp:278
[task 2022-03-22T06:20:05.023Z] 06:20:05 INFO - GECKO(4748) | #31 0x7ffed8ec7033 (C:\Windows\System32\KERNEL32.DLL+0x180017033)
[task 2022-03-22T06:20:05.024Z] 06:20:05 INFO - GECKO(4748) | #32 0x7ffebc767f3c in mozilla::interceptor::FuncHook<mozilla::interceptor::WindowsDllInterceptor<mozilla::interceptor::VMSharingPolicyShared>,void (*)(int, void *, void *)>::operator() /builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/nsWindowsDllInterceptor.h:150
[task 2022-03-22T06:20:05.024Z] 06:20:05 INFO - GECKO(4748) | #33 0x7ffebc767f3c in patched_BaseThreadInitThunk /builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:568
[task 2022-03-22T06:20:05.025Z] 06:20:05 INFO - GECKO(4748) | #34 0x7ffed9962650 (C:\Windows\SYSTEM32\ntdll.dll+0x180052650)
[task 2022-03-22T06:20:05.025Z] 06:20:05 INFO - GECKO(4748) | previously allocated by thread T0 here:
[task 2022-03-22T06:20:05.029Z] 06:20:05 INFO - GECKO(4748) | #0 0x7ffead577deb in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:98
[task 2022-03-22T06:20:05.029Z] 06:20:05 INFO - GECKO(4748) | #1 0x7ffebc65134d in moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52
[task 2022-03-22T06:20:05.030Z] 06:20:05 INFO - GECKO(4748) | #2 0x7ffe9955df65 in operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33
[task 2022-03-22T06:20:05.030Z] 06:20:05 INFO - GECKO(4748) | #3 0x7ffe9955df65 in mozilla::media::OriginKeyStore::Get(void) /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:389
[task 2022-03-22T06:20:05.031Z] 06:20:05 INFO - GECKO(4748) | #4 0x7ffe9954b5af in mozilla::media::Parent<class mozilla::media::PMediaParent>::Parent<class mozilla::media::PMediaParent>(void) /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:517
[task 2022-03-22T06:20:05.031Z] 06:20:05 INFO - GECKO(4748) | #5 0x7ffe9954b4f2 in mozilla::media::AllocPMediaParent(void) /builds/worker/checkouts/gecko/dom/media/systemservices/MediaParent.cpp:527
[task 2022-03-22T06:20:05.032Z] 06:20:05 INFO - GECKO(4748) | #6 0x7ffe9a87ee5c in mozilla::dom::PContentParent::OnMessageReceived(class IPC::Message const &) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:8998
[task 2022-03-22T06:20:05.033Z] 06:20:05 INFO - GECKO(4748) | #7 0x7ffe9351e7a2 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(class mozilla::ipc::ActorLifecycleProxy *, class IPC::Message const &) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1674
[task 2022-03-22T06:20:05.033Z] 06:20:05 INFO - GECKO(4748) | #8 0x7ffe9351c121 in mozilla::ipc::MessageChannel::DispatchMessage(class mozilla::ipc::ActorLifecycleProxy *, class IPC::Message &&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1599
[task 2022-03-22T06:20:05.034Z] 06:20:05 INFO - GECKO(4748) | #9 0x7ffe9351d56c in mozilla::ipc::MessageChannel::MessageTask::Run(void) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1496
[task 2022-03-22T06:20:05.034Z] 06:20:05 INFO - GECKO(4748) | #10 0x7ffe91f31cbd in mozilla::RunnableTask::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:467
[task 2022-03-22T06:20:05.035Z] 06:20:05 INFO - GECKO(4748) | #11 0x7ffe91ee4d11 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:778
[task 2022-03-22T06:20:05.035Z] 06:20:05 INFO - GECKO(4748) | #12 0x7ffe91ee121c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:612
[task 2022-03-22T06:20:05.036Z] 06:20:05 INFO - GECKO(4748) | #13 0x7ffe91ee1be4 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:390
[task 2022-03-22T06:20:05.036Z] 06:20:05 INFO - GECKO(4748) | #14 0x7ffe91f3a4e1 in mozilla::TaskController::InitializeInternal::<lambda_2>::operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:127
[task 2022-03-22T06:20:05.037Z] 06:20:05 INFO - GECKO(4748) | #15 0x7ffe91f3a4e1 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:127:7'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
[task 2022-03-22T06:20:05.038Z] 06:20:05 INFO - GECKO(4748) | #16 0x7ffe91f11743 in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1173
[task 2022-03-22T06:20:05.038Z] 06:20:05 INFO - GECKO(4748) | #17 0x7ffe91f22d8c in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467
[task 2022-03-22T06:20:05.039Z] 06:20:05 INFO - GECKO(4748) | #18 0x7ffe9352718a in mozilla::ipc::MessagePump::Run(class base::MessagePump::Delegate *) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107
[task 2022-03-22T06:20:05.039Z] 06:20:05 INFO - GECKO(4748) | #19 0x7ffe9343e4d5 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331
[task 2022-03-22T06:20:05.040Z] 06:20:05 INFO - GECKO(4748) | #20 0x7ffe9343e4d5 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324
[task 2022-03-22T06:20:05.040Z] 06:20:05 INFO - GECKO(4748) | #21 0x7ffe9343e2a5 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306
[task 2022-03-22T06:20:05.041Z] 06:20:05 INFO - GECKO(4748) | #22 0x7ffe9b4b88da in nsBaseAppShell::Run(void) /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137
[task 2022-03-22T06:20:05.041Z] 06:20:05 INFO - GECKO(4748) | #23 0x7ffe9b6a855c in nsAppShell::Run(void) /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:614
[task 2022-03-22T06:20:05.042Z] 06:20:05 INFO - GECKO(4748) | #24 0x7ffe9fb687bb in nsAppStartup::Run(void) /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:295
[task 2022-03-22T06:20:05.042Z] 06:20:05 INFO - GECKO(4748) | #25 0x7ffe9fe23c03 in XREMain::XRE_mainRun(void) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5739
[task 2022-03-22T06:20:05.043Z] 06:20:05 INFO - GECKO(4748) | #26 0x7ffe9fe29463 in XREMain::XRE_main(int, char **const, struct mozilla::BootstrapConfig const &) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5924
[task 2022-03-22T06:20:05.043Z] 06:20:05 INFO - GECKO(4748) | #27 0x7ffe9fe2a72a in XRE_main(int, char **const, struct mozilla::BootstrapConfig const &) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5991
[task 2022-03-22T06:20:05.044Z] 06:20:05 INFO - GECKO(4748) | #28 0x7ff698382594 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:226
[task 2022-03-22T06:20:05.044Z] 06:20:05 INFO - GECKO(4748) | #29 0x7ff698382594 in NS_internal_main(int, char **, char **) /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:395
[task 2022-03-22T06:20:05.044Z] 06:20:05 INFO - GECKO(4748) | #30 0x7ff6983817bd in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:167
[task 2022-03-22T06:20:05.045Z] 06:20:05 INFO - GECKO(4748) | #31 0x7ff69847e8c7 in invoke_main d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:90
[task 2022-03-22T06:20:05.045Z] 06:20:05 INFO - GECKO(4748) | #32 0x7ff69847e8c7 in __scrt_common_main_seh d:\agent\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
[task 2022-03-22T06:20:05.046Z] 06:20:05 INFO - GECKO(4748) | Thread T29 created by T0 here:
[task 2022-03-22T06:20:05.059Z] 06:20:05 INFO - GECKO(4748) | #0 0x7ffead5831d2 in __asan_wrap_CreateThread /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_win.cpp:146
[task 2022-03-22T06:20:05.073Z] 06:20:05 INFO - GECKO(4748) | #1 0x7ffed75e1896 (C:\Windows\System32\ucrtbase.dll+0x180021896)
[task 2022-03-22T06:20:05.073Z] 06:20:05 INFO - GECKO(4748) | #2 0x7ffeae2dda7d in _PR_MD_CREATE_THREAD /builds/worker/checkouts/gecko/nsprpub/pr/src/md/windows/w95thred.c:153
[task 2022-03-22T06:20:05.074Z] 06:20:05 INFO - GECKO(4748) | #3 0x7ffeae30687c in _PR_NativeCreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:1058
[task 2022-03-22T06:20:05.075Z] 06:20:05 INFO - GECKO(4748) | #4 0x7ffeae3071c3 in _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:1184
[task 2022-03-22T06:20:05.075Z] 06:20:05 INFO - GECKO(4748) | #5 0x7ffeae2fca7f in PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:1404
[task 2022-03-22T06:20:05.075Z] 06:20:05 INFO - GECKO(4748) | #6 0x7ffe91f0b561 in nsThread::Init(class nsTSubstring<char> const &) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:613
[task 2022-03-22T06:20:05.076Z] 06:20:05 INFO - GECKO(4748) | #7 0x7ffe91f20219 in nsThreadManager::NewNamedThread(class nsTSubstring<char> const &, unsigned int, class nsIThread **) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadManager.cpp:580
[task 2022-03-22T06:20:05.077Z] 06:20:05 INFO - GECKO(4748) | #8 0x7ffe91f2ceec in NS_NewNamedThread(class nsTSubstring<char> const &, class nsIThread **, struct already_AddRefed<class nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:163
[task 2022-03-22T06:20:05.077Z] 06:20:05 INFO - GECKO(4748) | #9 0x7ffe91f25af7 in NS_NewNamedThread /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:156
[task 2022-03-22T06:20:05.078Z] 06:20:05 INFO - GECKO(4748) | #10 0x7ffe91f25af7 in nsThreadPool::PutEvent(struct already_AddRefed<class nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:123
[task 2022-03-22T06:20:05.078Z] 06:20:05 INFO - GECKO(4748) | #11 0x7ffe91f2890c in nsThreadPool::Dispatch(struct already_AddRefed<class nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:362
[task 2022-03-22T06:20:05.079Z] 06:20:05 INFO - GECKO(4748) | #12 0x7ffe9241dc53 in mozilla::net::nsStreamTransportService::Dispatch(struct already_AddRefed<class nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsStreamTransportService.cpp:312
[task 2022-03-22T06:20:05.079Z] 06:20:05 INFO - GECKO(4748) | #13 0x7ffe91e45c22 in nsIEventTarget::Dispatch /builds/worker/workspace/obj-build/dist/include/nsIEventTarget.h:41
[task 2022-03-22T06:20:05.080Z] 06:20:05 INFO - GECKO(4748) | #14 0x7ffe91e45c22 in nsAStreamCopier::PostContinuationEvent_Locked /builds/worker/checkouts/gecko/xpcom/io/nsStreamUtils.cpp:451
[task 2022-03-22T06:20:05.080Z] 06:20:05 INFO - GECKO(4748) | #15 0x7ffe91e45c22 in nsAStreamCopier::PostContinuationEvent /builds/worker/checkouts/gecko/xpcom/io/nsStreamUtils.cpp:443
[task 2022-03-22T06:20:05.082Z] 06:20:05 INFO - GECKO(4748) | #16 0x7ffe91e45c22 in nsAStreamCopier::Start(class nsIInputStream *, class nsIOutputStream *, class nsIEventTarget *, void (__cdecl *)(void *, enum nsresult), void *, unsigned int, bool, bool, void (__cdecl *)(void *, unsigned int)) /builds/worker/checkouts/gecko/xpcom/io/nsStreamUtils.cpp:266
[task 2022-03-22T06:20:05.082Z] 06:20:05 INFO - GECKO(4748) | #17 0x7ffe91e4560f in NS_AsyncCopy(class nsIInputStream *, class nsIOutputStream *, class nsIEventTarget *, enum nsAsyncCopyMode, unsigned int, void (__cdecl *)(void *, enum nsresult), void *, bool, bool, class nsISupports **, void (__cdecl *)(void *, unsigned int)) /builds/worker/checkouts/gecko/xpcom/io/nsStreamUtils.cpp:590
[task 2022-03-22T06:20:05.082Z] 06:20:05 INFO - GECKO(4748) | #18 0x7ffe9241ba4d in mozilla::net::nsInputStreamTransport::OpenInputStream(unsigned int, unsigned int, unsigned int, class nsIInputStream **) /builds/worker/checkouts/gecko/netwerk/base/nsStreamTransportService.cpp:114
[task 2022-03-22T06:20:05.083Z] 06:20:05 INFO - GECKO(4748) | #19 0x7ffe91e48221 in NS_MakeAsyncNonBlockingInputStream(struct already_AddRefed<class nsIInputStream>, class nsIAsyncInputStream **, bool, unsigned int, unsigned int, unsigned int) /builds/worker/checkouts/gecko/xpcom/io/nsStreamUtils.cpp:941
[task 2022-03-22T06:20:05.084Z] 06:20:05 INFO - GECKO(4748) | #20 0x7ffe923159dd in nsInputStreamPump::AsyncRead(class nsIStreamListener *) /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:303
[task 2022-03-22T06:20:05.084Z] 06:20:05 INFO - GECKO(4748) | #21 0x7ffe93883b4d in nsJARChannel::ContinueOpenLocalFile(class nsJARInputThunk *, bool) /builds/worker/checkouts/gecko/modules/libjar/nsJARChannel.cpp:465
[task 2022-03-22T06:20:05.085Z] 06:20:05 INFO - GECKO(4748) | #22 0x7ffe938a1e59 in mozilla::detail::RunnableMethodArguments<RefPtr<nsJARInputThunk>,bool>::applyImpl /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1147
[task 2022-03-22T06:20:05.085Z] 06:20:05 INFO - GECKO(4748) | #23 0x7ffe938a1e59 in mozilla::detail::RunnableMethodArguments<RefPtr<nsJARInputThunk>,bool>::apply /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1153
[task 2022-03-22T06:20:05.086Z] 06:20:05 INFO - GECKO(4748) | #24 0x7ffe938a1e59 in mozilla::detail::RunnableMethodImpl<class RefPtr<class nsJARChannel>, enum nsresult (__cdecl nsJARChannel::*)(class nsJARInputThunk *, bool), 1, 0, class RefPtr<class nsJARInputThunk>, bool>::Run(void) /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1200
[task 2022-03-22T06:20:05.087Z] 06:20:05 INFO - GECKO(4748) | #25 0x7ffe91f31cbd in mozilla::RunnableTask::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:467
[task 2022-03-22T06:20:05.087Z] 06:20:05 INFO - GECKO(4748) | #26 0x7ffe91ee4d11 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:778
[task 2022-03-22T06:20:05.088Z] 06:20:05 INFO - GECKO(4748) | #27 0x7ffe91ee121c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:612
[task 2022-03-22T06:20:05.089Z] 06:20:05 INFO - GECKO(4748) | #28 0x7ffe91ee1be4 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:390
[task 2022-03-22T06:20:05.090Z] 06:20:05 INFO - GECKO(4748) | #29 0x7ffe91f3a4e1 in mozilla::TaskController::InitializeInternal::<lambda_2>::operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:127
[task 2022-03-22T06:20:05.091Z] 06:20:05 INFO - GECKO(4748) | #30 0x7ffe91f3a4e1 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:127:7'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
[task 2022-03-22T06:20:05.092Z] 06:20:05 INFO - GECKO(4748) | #31 0x7ffe91f11743 in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1173
[task 2022-03-22T06:20:05.093Z] 06:20:05 INFO - GECKO(4748) | #32 0x7ffe91f22d8c in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467
[task 2022-03-22T06:20:05.094Z] 06:20:05 INFO - GECKO(4748) | #33 0x7ffe91f21a7d in mozilla::SpinEventLoopUntil /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:175
[task 2022-03-22T06:20:05.094Z] 06:20:05 INFO - GECKO(4748) | #34 0x7ffe91f21a7d in nsThreadManager::SpinEventLoopUntilInternal(class nsTSubstring<char> const &, class nsINestedEventLoopCondition *, enum mozilla::ShutdownPhase) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadManager.cpp:686
[task 2022-03-22T06:20:05.095Z] 06:20:05 INFO - GECKO(4748) | #35 0x7ffea339e781 in XPTC__InvokebyIndex (Z:\task_164792712695375\build\application\firefox\xul.dll+0x1920ce781)
[task 2022-03-22T06:20:05.096Z] 06:20:05 INFO - GECKO(4748) | #36 0x7ffe9382b026 in CallMethodHelper::Invoke /builds/worker/checkouts/gecko/js/xpconnect/src/XPCWrappedNative.cpp:1631
[task 2022-03-22T06:20:05.097Z] 06:20:05 INFO - GECKO(4748) | #37 0x7ffe9382b026 in CallMethodHelper::Call /builds/worker/checkouts/gecko/js/xpconnect/src/XPCWrappedNative.cpp:1186
[task 2022-03-22T06:20:05.098Z] 06:20:05 INFO - GECKO(4748) | #38 0x7ffe9382b026 in XPCWrappedNative::CallMethod(class XPCCallContext &, enum XPCWrappedNative::CallMode) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCWrappedNative.cpp:1130
[task 2022-03-22T06:20:05.099Z] 06:20:05 INFO - GECKO(4748) | #39 0x7ffe938318af in XPC_WN_CallMethod(struct JSContext *, unsigned int, class JS::Value *) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:963
[task 2022-03-22T06:20:05.100Z] 06:20:05 INFO - GECKO(4748) | #40 0x7ffea010b167 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:426
[task 2022-03-22T06:20:05.101Z] 06:20:05 INFO - GECKO(4748) | #41 0x7ffea010b167 in js::InternalCallOrConstruct(struct JSContext *, class JS::CallArgs const &, enum js::MaybeConstruct, enum js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:512
[task 2022-03-22T06:20:05.102Z] 06:20:05 INFO - GECKO(4748) | #42 0x7ffea00f3cce in js::CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:576
[task 2022-03-22T06:20:05.103Z] 06:20:05 INFO - GECKO(4748) | #43 0x7ffea00f3cce in Interpret /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3308
[task 2022-03-22T06:20:05.104Z] 06:20:05 INFO - GECKO(4748) | #44 0x7ffea00de693 in js::RunScript(struct JSContext *, class js::RunState &) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:394
[task 2022-03-22T06:20:05.104Z] 06:20:05 INFO - GECKO(4748) | #45 0x7ffea010b3d3 in js::InternalCallOrConstruct(struct JSContext *, class JS::CallArgs const &, enum js::MaybeConstruct, enum js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:544
[task 2022-03-22T06:20:05.106Z] 06:20:05 INFO - GECKO(4748) | #46 0x7ffea1db4c31 in js::jit::DoCallFallback(struct JSContext *, class js::jit::BaselineFrame *, class js::jit::ICFallbackStub *, unsigned int, class JS::Value *, class JS::MutableHandle<class JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1595
[task 2022-03-22T06:20:05.106Z] 06:20:05 INFO - GECKO(4748) | #47 0x1a2e9b12e8e (<unknown module>)
[task 2022-03-22T06:20:05.107Z] 06:20:05 INFO - GECKO(4748) | SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50 in mozilla::RefPtrTraits<mozilla::media::OriginKeyStore>::Release
[task 2022-03-22T06:20:05.109Z] 06:20:05 INFO - GECKO(4748) | Shadow bytes around the buggy address:
[task 2022-03-22T06:20:05.110Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b640: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
[task 2022-03-22T06:20:05.111Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b650: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
[task 2022-03-22T06:20:05.112Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b660: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
[task 2022-03-22T06:20:05.113Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b670: fd fd fd fd fa fa fa fa fa fa fa fa fd fd fd fd
[task 2022-03-22T06:20:05.150Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b680: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
[task 2022-03-22T06:20:05.150Z] 06:20:05 INFO - GECKO(4748) | =>0x04c5bcc0b690: fa fa[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2022-03-22T06:20:05.151Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b6a0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
[task 2022-03-22T06:20:05.152Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b6b0: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
[task 2022-03-22T06:20:05.152Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b6c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2022-03-22T06:20:05.153Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b6d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2022-03-22T06:20:05.153Z] 06:20:05 INFO - GECKO(4748) | 0x04c5bcc0b6e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2022-03-22T06:20:05.154Z] 06:20:05 INFO - GECKO(4748) | Shadow byte legend (one shadow byte represents 8 application bytes):
[task 2022-03-22T06:20:05.154Z] 06:20:05 INFO - GECKO(4748) | Addressable: 00
[task 2022-03-22T06:20:05.155Z] 06:20:05 INFO - GECKO(4748) | Partially addressable: 01 02 03 04 05 06 07
[task 2022-03-22T06:20:05.155Z] 06:20:05 INFO - GECKO(4748) | Heap left redzone: fa
[task 2022-03-22T06:20:05.156Z] 06:20:05 INFO - GECKO(4748) | Freed heap region: fd
[task 2022-03-22T06:20:05.156Z] 06:20:05 INFO - GECKO(4748) | Stack left redzone: f1
[task 2022-03-22T06:20:05.157Z] 06:20:05 INFO - GECKO(4748) | Stack mid redzone: f2
[task 2022-03-22T06:20:05.157Z] 06:20:05 INFO - GECKO(4748) | Stack right redzone: f3
[task 2022-03-22T06:20:05.158Z] 06:20:05 INFO - GECKO(4748) | Stack after return: f5
[task 2022-03-22T06:20:05.158Z] 06:20:05 INFO - GECKO(4748) | Stack use after scope: f8
[task 2022-03-22T06:20:05.159Z] 06:20:05 INFO - GECKO(4748) | Global redzone: f9
[task 2022-03-22T06:20:05.159Z] 06:20:05 INFO - GECKO(4748) | Global init order: f6
[task 2022-03-22T06:20:05.160Z] 06:20:05 INFO - GECKO(4748) | Poisoned by user: f7
[task 2022-03-22T06:20:05.160Z] 06:20:05 INFO - GECKO(4748) | Container overflow: fc
[task 2022-03-22T06:20:05.161Z] 06:20:05 INFO - GECKO(4748) | Array cookie: ac
[task 2022-03-22T06:20:05.161Z] 06:20:05 INFO - GECKO(4748) | Intra object redzone: bb
[task 2022-03-22T06:20:05.162Z] 06:20:05 INFO - GECKO(4748) | ASan internal: fe
[task 2022-03-22T06:20:05.163Z] 06:20:05 INFO - GECKO(4748) | Left alloca redzone: ca
[task 2022-03-22T06:20:05.163Z] 06:20:05 INFO - GECKO(4748) | Right alloca redzone: cb
[task 2022-03-22T06:20:05.163Z] 06:20:05 INFO - GECKO(4748) | ==2932==ABORTING
Comment 1•4 years ago
|
||
OriginKeyStore::sOriginKeyStore is a raw pointer, but OriginKeyStore is a refcounted class, so that seems bad.
I'm guessing this is some kind of shutdown race. The use is coming after we're tearing down PContentParent after we get ContentParent::RecvFinishShutdown.
The destruction is coming via WebSocketRequest::Release on what looks like a networking related thread. I'm not sure how that happens. Maybe something weird is going on with nsMainThreadPtrHolder?
Technically this could qualify as a sandbox escape, because the use is coming from a message from the child process. I guess it depends on whether the free can also be induced by the child process. However, this is coming as the child process is going away, so I don't know if it is exploitable at all.
Comment 2•4 years ago
|
||
The severity field for this bug is set to S4. However, the bug is flagged with the sec-high keyword.
:jimm, could you consider increasing the severity of this security bug?
For more information, please visit auto_nag documentation.
Updated•4 years ago
|
Comment 3•4 years ago
|
||
Most likely camera enumeration related, and related to webrtc.
Updated•4 years ago
|
Updated•4 years ago
|
| Assignee | ||
Comment 4•4 years ago
|
||
Updated•4 years ago
|
Comment 5•4 years ago
|
||
(In reply to Andrew McCreight [:mccr8] from comment #1)
OriginKeyStore::sOriginKeyStore is a raw pointer, but OriginKeyStore is a refcounted class, so that seems bad.
That's OK because the raw pointer is cleared in the OriginKeyStore destructor, provided no raw pointer copies are in use.
I'm guessing this is some kind of shutdown race. The use is coming after we're tearing down PContentParent after we get ContentParent::RecvFinishShutdown.
and destroy RefPtr<OriginKeyStore> media::Parent::mOriginKeyStore.
The destruction is coming via WebSocketRequest::Release on what looks like a networking related thread. I'm not sure how that happens. Maybe something weird is going on with nsMainThreadPtrHolder?
I'm guessing the optimizer has just merged WebSocketRequest::Release() and OriginKeyStore::Release() into a single code sequence.
The free is happening in destruction of another RefPtr<OriginKeyStore> media::Parent::mOriginKeyStore, when the lambda from Parent<Super>::RecvGetPrincipalKey() that calls sOriginKeyStore->mOriginKeys.GetPrincipalKey() releases its Parent reference.
Comment 6•4 years ago
|
||
(In reply to Karl Tomlinson (:karlt) from comment #5)
(In reply to Andrew McCreight [:mccr8] from comment #1)
OriginKeyStore::sOriginKeyStore is a raw pointer, but OriginKeyStore is a refcounted class, so that seems bad.
That's OK because the raw pointer is cleared in the
OriginKeyStoredestructor, provided no raw pointer copies are in use.
Er, no it's not OK because the lock is held only in the destructor, not in the refcount decrement.
Consider:
- Thread 1 removes last ref.
- Thread 2 adds a ref and releases the lock.
- Thread 1 takes the lock and deletes the
OriginKeyStore.
Comment 7•4 years ago
•
|
||
An option to consider for a solution:
- Make
sOriginKeyStoreprivate so that ownership is clear and all uses are viaParent::mOriginKeyStorefrom main-thread-onlyGet(). OriginKeyStoreuses single-thread ref-counting.- Each
Parentreleases itsmOriginKeyStoreon main thread, either by explicitNS_ProxyRelease()from destructor orNS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_DELETE_ON_EVENT_TARGET()forParent.
| Assignee | ||
Comment 8•4 years ago
|
||
Oof, I had all this typed yesterday and forgot to submit. Sorry Karl for not providing context in time. Note I haven't read you comments yet.
(In reply to Andrew McCreight [:mccr8] from comment #1)
OriginKeyStore::sOriginKeyStore is a raw pointer, but OriginKeyStore is a refcounted class, so that seems bad.
sOriginKeyStore is a pointer to the (thread-safe) refcounted singleton created on-demand and shared by each PMediaParent referencing it (and keeping it alive) here, or nullptr. The patch fixes the handoff to addRef inside the sOriginKeyStoreMutex instead of later by the caller, which I think plugs the race here.
The destruction is coming via WebSocketRequest::Release on what looks like a networking related thread.
Judging by the rest of the stack, this looks like an artifact of linker symbol coalescing, as websocket is not involved. T29 is the StreamTransportService thread which RecvGetPrincipalKey dispatches to, to do file system reads of the PROFILE dir.
Those who only care about the fix can stop reading here.
But I remain a bit puzzled by how this happened: The "freed by thread T29" stack shows T29 recently serviced a "NonE10s" (aka parent process) call to RecvGetPrincipalKey, which can only happen from either A) JS in a parent-process calling getUserMedia or enumerateDevices directly (but the related browser tests here appear to call content.navigator.getUserMedia from spawned functions correctly, or B) our getDisplayMedia picker, to show previews.
Technically this could qualify as a sandbox escape, because the use is coming from a message from the child process. I guess it depends on whether the free can also be induced by the child process. However, this is coming as the child process is going away, so I don't know if it is exploitable at all.
| Assignee | ||
Comment 9•4 years ago
|
||
(In reply to Karl Tomlinson (:karlt) from comment #6)
Er, no it's not OK because the lock is held only in the destructor, not in the refcount decrement.
Consider:
- Thread 1 removes last ref.
- Thread 2 adds a ref and releases the lock.
- Thread 1 takes the lock and deletes the
OriginKeyStore.
OriginKeyStore is NS_DECL_THREADSAFE_ISUPPORTS, which uses ThreadSafeAutoRefCnt which should synchronize deletion, right?
Comment 10•4 years ago
•
|
||
(In reply to Jan-Ivar Bruaroey [:jib] (needinfo? me) from comment #8)
Those who only care about the fix can stop reading here.
But I remain a bit puzzled by how this happened: The "freed by thread T29" stack shows T29 recently serviced a "NonE10s" (aka parent process) call to
RecvGetPrincipalKey, which can only happen from either A) JS in a parent-process calling getUserMedia or enumerateDevices directly (but the related browser tests here appear to callcontent.navigator.getUserMediafrom spawned functions correctly, or B) our getDisplayMedia picker, to show previews.
I suspect the symbol name for NonE10s RecvGetPrincipalKey() lambda and RefPtr methods is more linker symbol coalescing.
This is invoked by
mozilla::detail::ProxyFunctionRunnable<class `public: virtual class mozilla::ipc::IPCResult __cdecl mozilla::media::Parent<class mozilla::media::PMediaParent>::RecvGetPrincipalKey(...)'::`1'::<lambda_1>, class mozilla::MozPromise<...>>::Run(void)
and invokes
mozilla::media::Parent<class mozilla::media::PMediaParent>::~Parent<class mozilla::media::PMediaParent>(void)
Comment 11•4 years ago
|
||
(In reply to Jan-Ivar Bruaroey [:jib] (needinfo? me) from comment #9)
OriginKeyStore is NS_DECL_THREADSAFE_ISUPPORTS, which uses ThreadSafeAutoRefCnt which should synchronize deletion, right?
ThreadSafeAutoRefCnt is just an atomic ref-count and so provides that only one thread/caller will believe it has removed the last reference (provided nothing takes a reference after that point).
So, it synchronizes a single deletion only when there are no bare pointers around at the time of last release. sOriginKeyStore defeats that.
NS_IMPL_ISUPPORTS0 uses NS_IMPL_NAMED_RELEASE_WITH_DESTROY(_class, #_class, delete (this)), which provides no synchronization for delete/_destroy. The expectation is that there are no remaining references when the ref-count reaches zero.
| Assignee | ||
Comment 12•4 years ago
|
||
Updated•4 years ago
|
Updated•4 years ago
|
| Assignee | ||
Comment 13•4 years ago
|
||
Thanks for the spot-on analysis and explanation! Patch up based on comment 7.
| Assignee | ||
Comment 14•4 years ago
|
||
Comment on attachment 9271165 [details]
Bug 1760765 - Clean up OriginKeyStore handling. r?karlt
Security Approval Request
- How easily could an exploit be constructed based on the patch?: Seems difficult but not impossible. It would be a sandbox escape, with the UAF being in the parent process, and use coming from a message from the child process. The free is coming from the child process going away, so any exploit of this race would need a way to start and stop content processes. But I suppose this is possible now e.g. with creating and removing cross-origin iframes? So this seems exploitable in theory.
- Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
- Which older supported branches are affected by this flaw?: all
- If not all supported branches, which bug introduced the flaw?: None
- Do you have backports for the affected branches?: No
- If not, how different, hard to create, and risky will they be?: same, easy and risk-free
- How likely is this patch to cause regressions; how much testing does it need?: Unlikely; test suite ran and locally things appear to work fine.
Comment 15•4 years ago
|
||
Comment on attachment 9271165 [details]
Bug 1760765 - Clean up OriginKeyStore handling. r?karlt
Approved to land and uplift
Comment 16•4 years ago
|
||
Comment 17•4 years ago
|
||
Changing the priority to P1 as the bug is tracked by a release manager for the current beta.
See Triage for Bugzilla for more information.
If you disagree, please discuss with a release manager.
Comment 18•4 years ago
|
||
Backed out for causing leakcheck failures:
https://hg.mozilla.org/integration/autoland/rev/64c9c049b40f28cbe1d6becf5cb4937c8b55147e
Push with failure: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry&revision=4192a14c490cc0bf30028db51b03b19fb75266ad&selectedTaskRun=TJ10JT0ISP6sp1wA6vXwvg.0
Failure log: https://treeherder.mozilla.org/logviewer?job_id=376820249&repo=autoland
TEST-UNEXPECTED-FAIL | leakcheck | default 376 bytes leaked (OriginKeyStore, nsLocalFile, nsStringBuffer)
| Assignee | ||
Comment 19•4 years ago
|
||
Looks like the leak is a few lines above. Investigating.
[task 2022-05-04T14:34:20.428Z] 14:34:20 INFO - GECKO(1582) | [Parent 1582, Main Thread] WARNING: no target for 'ProxyDelete RefCountedParent', leaking!: file /builds/worker/checkouts/gecko/xpcom/base/nsISupportsImpl.cpp:128
Comment 20•4 years ago
|
||
S2 seems like a more appropriate severity for a sec-high, but feel free to adjust to S3 if you disagree.
Comment 21•4 years ago
|
||
(In reply to Jan-Ivar Bruaroey [:jib] (needinfo? me) from comment #19)
[task 2022-05-04T14:34:20.428Z] 14:34:20 INFO - GECKO(1582) | [Parent 1582, Main Thread] WARNING: no target for 'ProxyDelete RefCountedParent', leaking!: file /builds/worker/checkouts/gecko/xpcom/base/nsISupportsImpl.cpp:128
This would happen with mNonE10sParent on MediaManager, which is kept alive by the component manager. The component manager is shut down after main thread event processing.
Comment 22•4 years ago
|
||
The leak seems an unfortunate consequence of NS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_DELETE_ON_MAIN_THREAD() getting the event target at the time of last release.
Having GetMainThreadSerialEventTarget() return null after no events can be dispatched seems reasonable, but the consequence is that ProxyDeleteVoid() doesn't have an event target for its IsOnCurrentThread() call, which I assume would have succeeded if the event target had been fetched and stored.
Comment 24•4 years ago
|
||
Clean up OriginKeyStore handling. r=karlt
https://hg.mozilla.org/integration/autoland/rev/f0111f93de7b7c048e912a9676741c5992ee1df0
https://hg.mozilla.org/mozilla-central/rev/f0111f93de7b
Comment 25•4 years ago
|
||
Please nominate this for Beta and ESR approval when you get a chance.
| Assignee | ||
Comment 26•4 years ago
|
||
Comment on attachment 9271165 [details]
Bug 1760765 - Clean up OriginKeyStore handling. r?karlt
Beta/Release Uplift Approval Request
- User impact if declined: Theoretical sandbox escape.
- Is this code covered by automated tests?: Yes
- Has the fix been verified in Nightly?: Yes
- Needs manual test from QE?: Yes
- If yes, steps to reproduce: To verify nothing broke:
- Test with two cameras or mics
- Run https://jsfiddle.net/jib1/qk8och13/show, and hit
Gobutton - Change chosen camera and/or mic using buttons
- Refresh page and hit
Goagain
Page should remember the last chosen camera and mic, not revert to default.
- List of other uplifts needed: None
- Risk to taking this patch: Low
- Why is the change risky/not risky? (and alternatives if risky): Thorough threading review
- String changes made/needed:
- Is Android affected?: Yes
| Assignee | ||
Updated•4 years ago
|
Updated•4 years ago
|
Comment 27•4 years ago
|
||
Comment on attachment 9271165 [details]
Bug 1760765 - Clean up OriginKeyStore handling. r?karlt
Approved for 101.0b7 and 91.10esr.
Comment 28•4 years ago
|
||
| uplift | ||
Comment 29•4 years ago
|
||
| uplift | ||
Comment 30•4 years ago
|
||
| uplift | ||
ESR bustage fix:
https://hg.mozilla.org/releases/mozilla-esr91/rev/739fa7405576
Comment 31•4 years ago
|
||
Hi, Jan-Ivar! I've tried to reproduce the initial issue by following the STR from comment 26. On an affected Nightly build 100.0a1 (2022-03-22), with Win 10 x64, macOS 11 and Ubuntu 18.064 x64, the issue is not reproducing. After refreshing the page and hitting Go, the last selected headset/camera is remembered in the drop-down menu from the test page. I had to 2 mics on mac/Ubuntu (the internal one and a headset with a mic attached) where on Win 10, I had 2 cameras (one external and one from the laptop).
Also, I didn't check the "Remember this decision" checkbox from the permission door hanger, when you first select the permissions for camera and headset. I assume that this does not matter when following the reproducing steps.
Maybe I'm missing something here in order to reproduce the bug, can you please take a look?
Updated•4 years ago
|
| Assignee | ||
Comment 32•4 years ago
|
||
Hi Ciprian, the bug does not reproduce, so the QA task was merely to confirm that cam/mic device memory still works and didn't break. It sounds like you've successfully tested this, so thanks!
Updated•4 years ago
|
Updated•4 years ago
|
Comment 33•4 years ago
|
||
Thanks, Jan-Ivar!
This is verified as fixed on the latest builds: 91.10.0esr, latest Beta 102.0b1 and RC2 101.0. Tested under macOS 11, Ubuntu 18.04 x64 and Win 10 x64.
Updated•3 years ago
|
Description
•