Closed Bug 1764933 Opened 2 years ago Closed 2 years ago

Crash [@ get]

Categories

(Core :: WebRTC, defect, P1)

x86_64
Linux
defect

Tracking

()

VERIFIED FIXED
101 Branch
Tracking Status
firefox-esr91 --- unaffected
firefox99 --- unaffected
firefox100 --- unaffected
firefox101 --- verified

People

(Reporter: jkratzer, Assigned: bwc)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(3 files)

Testcase found while fuzzing mozilla-central rev 7f6fc25d231f (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 7f6fc25d231f -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html
[@ get]

    =================================================================
    ==2293372==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000d0 (pc 0x7f9295fe30db bp 0x7ffcbb1d7610 sp 0x7ffcbb1d7610 T0)
    ==2293372==The signal is caused by a READ memory access.
    ==2293372==Hint: address points to the zero page.
        #0 0x7f9295fe30db in get /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27
        #1 0x7f9295fe30db in operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:316:12
        #2 0x7f9295fe30db in mozilla::TransceiverImpl::GetKind(nsTSubstring<char16_t>&) const /dom/media/webrtc/jsapi/TransceiverImpl.cpp:543:3
        #3 0x7f9295fe2a29 in mozilla::dom::RTCRtpSender::ReplaceTrack(mozilla::dom::MediaStreamTrack*) /dom/media/webrtc/jsapi/RTCRtpSender.cpp:584:23
        #4 0x7f929334361a in replaceTrack /builds/worker/workspace/obj-build/dom/bindings/RTCRtpSenderBinding.cpp:242:60
        #5 0x7f929334361a in mozilla::dom::RTCRtpSender_Binding::replaceTrack_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/RTCRtpSenderBinding.cpp:253:13
        #6 0x7f929441f10a in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3270:13
        #7 0x7f929e43d5b4 in CallJSNative /js/src/vm/Interpreter.cpp:420:13
        #8 0x7f929e43d5b4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:507:12
        #9 0x7f929e429cfb in CallFromStack /js/src/vm/Interpreter.cpp:571:10
        #10 0x7f929e429cfb in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3293:16
        #11 0x7f929e40edf1 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:389:13
        #12 0x7f929e43d6ef in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:539:13
        #13 0x7f929e43f2db in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:584:8
        #14 0x7f929cf0ca17 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /js/src/vm/SelfHosting.cpp:1590:10
        #15 0x7f929cb4efd9 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /js/src/vm/AsyncFunction.cpp:152:8
        #16 0x7f929ce15b8a in AsyncFunctionPromiseReactionJob /js/src/builtin/Promise.cpp:1949:12
        #17 0x7f929ce15b8a in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /js/src/builtin/Promise.cpp:2012:12
        #18 0x7f929e43d5b4 in CallJSNative /js/src/vm/Interpreter.cpp:420:13
        #19 0x7f929e43d5b4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:507:12
        #20 0x7f929e43f2db in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:584:8
        #21 0x7f929cb8737d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #22 0x7f92932141ac in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:35:8
        #23 0x7f928f25d777 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:89:12
        #24 0x7f928f25d777 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:102:12
        #25 0x7f928f25d777 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /xpcom/base/CycleCollectedJSContext.cpp:213:18
        #26 0x7f928f23ca87 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /xpcom/base/CycleCollectedJSContext.cpp:674:17
        #27 0x7f928f23da6f in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /xpcom/base/CycleCollectedJSContext.cpp:463:3
        #28 0x7f9290e6efe6 in XPCJSContext::AfterProcessTask(unsigned int) /js/xpconnect/src/XPCJSContext.cpp:1483:28
        #29 0x7f928f481938 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1217:24
        #30 0x7f928f48b14c in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #31 0x7f9290b9b98f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #32 0x7f9290a15971 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #33 0x7f9290a15971 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #34 0x7f9290a15971 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #35 0x7f929789bfa7 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #36 0x7f929c7320af in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:870:20
        #37 0x7f9290a15971 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #38 0x7f9290a15971 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #39 0x7f9290a15971 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #40 0x7f929c7312d3 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:729:34
        #41 0x5625f015b47d in content_process_main(mozilla::Bootstrap*, int, char**) /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #42 0x5625f015b8b0 in main /browser/app/nsBrowserApp.cpp:327:18
        #43 0x7f92b41fb0b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
        #44 0x5625f00aa569 in _start (/home/jkratzer/builds/mc-asan/firefox+0x5e569)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27 in get
    ==2293372==ABORTING
Attached file Testcase
Keywords: bugmon
Crash Signature: [@ get] → [@ get] [@ mozilla::dom::RTCRtpSender::ReplaceTrack ]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220415213125-86271ddb1099.
The bug appears to have been introduced in the following build range:

Start: 7fac8607d414d792f4530b726f68ad36afb3c545 (20220405212313)
End: 5135fb6675eacd4e4aa46983b4c7821f678544a6 (20220405205608)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7fac8607d414d792f4530b726f68ad36afb3c545&tochange=5135fb6675eacd4e4aa46983b4c7821f678544a6

Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Looks like a class of cycle collection bugs.

Severity: -- → S3
Priority: -- → P2
Regressed by: 1616937, 1624989
See Also: → 1764940
Severity: S3 → S2
Assignee: nobody → docfaraday
Priority: P2 → P1
Has Regression Range: --- → yes

Depends on D143954

This fix also seems to fix bug 1764940. I still want to land a test-case for 1764940 though, so I'm not going to close that bug as a dupe.

This may also fix bug 1764923, but I have had no luck reproducing that bug, with or without a fix.

Yeah, android crashtests are permaorange on baseline. Not seeing any new problems on try.

Pushed by bcampen@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/7283385cb6cd
Test case for bug. r=jib
https://hg.mozilla.org/integration/autoland/rev/fa1667559368
Do not null out the transceiver in Shutdown r=jib
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 101 Branch

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220420215300-a33cd50e2f73.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon
Crash Signature: [@ get] [@ mozilla::dom::RTCRtpSender::ReplaceTrack ] → [@ get] [@ mozilla::dom::RTCRtpSender::ReplaceTrack ] [@ mozilla::dom::ReplaceTrackOperation::CallImpl]
Crash Signature: [@ get] [@ mozilla::dom::RTCRtpSender::ReplaceTrack ] [@ mozilla::dom::ReplaceTrackOperation::CallImpl] → [@ get] [@ mozilla::dom::RTCRtpSender::ReplaceTrack ] [@ mozilla::dom::ReplaceTrackOperation::CallImpl]
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: