1764933 - Crash [@ get]

Status: VERIFIED FIXED

(Core :: WebRTC, defect, P1)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 7f6fc25d231f (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 7f6fc25d231f -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

[@ get]

    =================================================================
    ==2293372==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000d0 (pc 0x7f9295fe30db bp 0x7ffcbb1d7610 sp 0x7ffcbb1d7610 T0)
    ==2293372==The signal is caused by a READ memory access.
    ==2293372==Hint: address points to the zero page.
        #0 0x7f9295fe30db in get /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27
        #1 0x7f9295fe30db in operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:316:12
        #2 0x7f9295fe30db in mozilla::TransceiverImpl::GetKind(nsTSubstring<char16_t>&) const /dom/media/webrtc/jsapi/TransceiverImpl.cpp:543:3
        #3 0x7f9295fe2a29 in mozilla::dom::RTCRtpSender::ReplaceTrack(mozilla::dom::MediaStreamTrack*) /dom/media/webrtc/jsapi/RTCRtpSender.cpp:584:23
        #4 0x7f929334361a in replaceTrack /builds/worker/workspace/obj-build/dom/bindings/RTCRtpSenderBinding.cpp:242:60
        #5 0x7f929334361a in mozilla::dom::RTCRtpSender_Binding::replaceTrack_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/RTCRtpSenderBinding.cpp:253:13
        #6 0x7f929441f10a in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3270:13
        #7 0x7f929e43d5b4 in CallJSNative /js/src/vm/Interpreter.cpp:420:13
        #8 0x7f929e43d5b4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:507:12
        #9 0x7f929e429cfb in CallFromStack /js/src/vm/Interpreter.cpp:571:10
        #10 0x7f929e429cfb in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3293:16
        #11 0x7f929e40edf1 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:389:13
        #12 0x7f929e43d6ef in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:539:13
        #13 0x7f929e43f2db in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:584:8
        #14 0x7f929cf0ca17 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /js/src/vm/SelfHosting.cpp:1590:10
        #15 0x7f929cb4efd9 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /js/src/vm/AsyncFunction.cpp:152:8
        #16 0x7f929ce15b8a in AsyncFunctionPromiseReactionJob /js/src/builtin/Promise.cpp:1949:12
        #17 0x7f929ce15b8a in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /js/src/builtin/Promise.cpp:2012:12
        #18 0x7f929e43d5b4 in CallJSNative /js/src/vm/Interpreter.cpp:420:13
        #19 0x7f929e43d5b4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:507:12
        #20 0x7f929e43f2db in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:584:8
        #21 0x7f929cb8737d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #22 0x7f92932141ac in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:35:8
        #23 0x7f928f25d777 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:89:12
        #24 0x7f928f25d777 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:102:12
        #25 0x7f928f25d777 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /xpcom/base/CycleCollectedJSContext.cpp:213:18
        #26 0x7f928f23ca87 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /xpcom/base/CycleCollectedJSContext.cpp:674:17
        #27 0x7f928f23da6f in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /xpcom/base/CycleCollectedJSContext.cpp:463:3
        #28 0x7f9290e6efe6 in XPCJSContext::AfterProcessTask(unsigned int) /js/xpconnect/src/XPCJSContext.cpp:1483:28
        #29 0x7f928f481938 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1217:24
        #30 0x7f928f48b14c in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #31 0x7f9290b9b98f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #32 0x7f9290a15971 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #33 0x7f9290a15971 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #34 0x7f9290a15971 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #35 0x7f929789bfa7 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #36 0x7f929c7320af in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:870:20
        #37 0x7f9290a15971 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #38 0x7f9290a15971 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #39 0x7f9290a15971 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #40 0x7f929c7312d3 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:729:34
        #41 0x5625f015b47d in content_process_main(mozilla::Bootstrap*, int, char**) /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #42 0x5625f015b8b0 in main /browser/app/nsBrowserApp.cpp:327:18
        #43 0x7f92b41fb0b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
        #44 0x5625f00aa569 in _start (/home/jkratzer/builds/mc-asan/firefox+0x5e569)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:286:27 in get
    ==2293372==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Bugmon was unable to identify a testcase that reproduces this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Mayank Bansal]

https://crash-stats.mozilla.org/report/index/7361c7bd-7510-44b2-8e58-e11920220416#tab-bugzilla

Comment 4

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220415213125-86271ddb1099.
The bug appears to have been introduced in the following build range:

Start: 7fac8607d414d792f4530b726f68ad36afb3c545 (20220405212313)
End: 5135fb6675eacd4e4aa46983b4c7821f678544a6 (20220405205608)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7fac8607d414d792f4530b726f68ad36afb3c545&tochange=5135fb6675eacd4e4aa46983b4c7821f678544a6

Comment 5

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Looks like a class of cycle collection bugs.

Comment 6

[Byron Campen [:bwc]]

Attachment: Bug 1764933: Test case for bug. r?jib

Depends on D143954

Comment 7

[Byron Campen [:bwc]]

Attachment: Bug 1764933: Do not null out the transceiver in Shutdown r?jib

Depends on D144045

Comment 8

[Byron Campen [:bwc]]

This fix also seems to fix bug 1764940. I still want to land a test-case for 1764940 though, so I'm not going to close that bug as a dupe.

This may also fix bug 1764923, but I have had no luck reproducing that bug, with or without a fix.

Comment 9

[Byron Campen [:bwc]]

https://treeherder.mozilla.org/jobs?repo=try&revision=4a70dd56454de40b0898f48cb4d5f95213224120
https://treeherder.mozilla.org/jobs?repo=try&revision=16da7e4bd731cadd6d3bc1503c7b3bf8adb312de
https://treeherder.mozilla.org/jobs?repo=try&revision=7db5af54210390831eb25fccdafa5b1c8f66e685
https://treeherder.mozilla.org/jobs?repo=try&revision=05251dcc2ce12be485be469275ab46d40fed8d26

Seeing a lot of bug 1411358 in the crashtests on android. I'm going to run a baseline try push.

Comment 10

[Byron Campen [:bwc]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=501578215569eaa6b8c0f619055daff8cf188314
https://treeherder.mozilla.org/#/jobs?repo=try&revision=34aee46a1910b13d7455a9e531c84dd4ad5bb8b4

Comment 11

[Byron Campen [:bwc]]

Yeah, android crashtests are permaorange on baseline. Not seeing any new problems on try.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7283385cb6cd
Test case for bug. r=jib
https://hg.mozilla.org/integration/autoland/rev/fa1667559368
Do not null out the transceiver in Shutdown r=jib

Comment 13

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/7283385cb6cd
https://hg.mozilla.org/mozilla-central/rev/fa1667559368

Comment 14

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220420215300-a33cd50e2f73.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.