Closed Bug 1779833 Opened 2 years ago Closed 2 years ago

Intermittent SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/obj-build/dist/include/js/Value.h:722:12 in isGCThing

Categories

(Core :: JavaScript: GC, defect)

Product:
Core
Component:
JavaScript: GC
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
104 Branch
Tracking Flags:
Tracking Status
firefox-esr91 --- unaffected
firefox-esr102 --- unaffected
firefox102 --- unaffected
firefox103 --- unaffected
firefox104 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jonco)

References

(Regression)

Details

(4 keywords)

Attachments

(4 files)

ASan report
42.83 KB, text/plain
Details
Bug 1779833 - Part 1: Split ordered hash table iteration into two classes to allow iteration of const tables r?jandem
48 bytes, text/x-phabricator-request
Details | Review
Bug 1779833 - Part 2: Fix places were post barriers were still applied to nursery allocated Map objects r?jandem
48 bytes, text/x-phabricator-request
Details | Review
Bug 1779833 - Part 3: Testcase to trace store buffer entries that point to freed memory r?jandem
48 bytes, text/x-phabricator-request
Details | Review

Filed by: abutkovits [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=384509828&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/O8d5kzFXRfKUc2F9L-sNXA/runs/0/artifacts/public/logs/live_backing.log

[task 2022-07-15T19:44:12.210Z] 19:44:12     INFO - TEST-START | /webrtc/RTCTrackEvent-fire.html
[task 2022-07-15T19:44:12.215Z] 19:44:12     INFO - Setting pref media.navigator.permission.disabled to true
[task 2022-07-15T19:44:12.234Z] 19:44:12     INFO - Setting pref media.navigator.streams.fake to true
[task 2022-07-15T19:44:12.251Z] 19:44:12     INFO - Setting pref privacy.resistFingerprinting.reduceTimerPrecision.jitter to true
[task 2022-07-15T19:44:12.315Z] 19:44:12     INFO - Setting pref privacy.reduceTimerPrecision to true
[task 2022-07-15T19:44:12.336Z] 19:44:12     INFO - Setting pref media.peerconnection.ice.trickle_grace_period to 5000
[task 2022-07-15T19:44:12.357Z] 19:44:12     INFO - Setting pref media.peerconnection.ice.obfuscate_host_addresses to true
[task 2022-07-15T19:44:12.396Z] 19:44:12     INFO - Setting pref media.navigator.permission.disabled to true
[task 2022-07-15T19:44:12.443Z] 19:44:12     INFO - Setting pref media.navigator.streams.fake to true
[task 2022-07-15T19:44:12.484Z] 19:44:12     INFO - Setting pref privacy.resistFingerprinting.reduceTimerPrecision.jitter to false
[task 2022-07-15T19:44:12.517Z] 19:44:12     INFO - Setting pref privacy.reduceTimerPrecision to false
[task 2022-07-15T19:44:12.546Z] 19:44:12     INFO - Setting pref media.peerconnection.ice.trickle_grace_period to 10000
[task 2022-07-15T19:44:12.582Z] 19:44:12     INFO - Setting pref media.peerconnection.ice.obfuscate_host_addresses to false
[task 2022-07-15T19:44:12.622Z] 19:44:12     INFO - Setting pref media.peerconnection.sdp.alternate_parse_mode to 'never'
[task 2022-07-15T19:44:12.657Z] 19:44:12     INFO - Setting pref media.peerconnection.sdp.parser to 'sipcc'
[task 2022-07-15T19:44:12.685Z] 19:44:12     INFO - Closing window 566321ba-19d4-4c22-87e5-55c9f755f21f
[task 2022-07-15T19:44:12.745Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {4a66ed1e-fea2-43de-9a38-3ed9fa8bf6a7}; ending call
[task 2022-07-15T19:44:12.748Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{4a66ed1e-fea2-43de-9a38-3ed9fa8bf6a7} 1657914252038163 (id=79456894981 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> closed
[task 2022-07-15T19:44:12.751Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {6fefa8e9-e40c-439d-a681-f4ee4ea06b27}; ending call
[task 2022-07-15T19:44:12.755Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{6fefa8e9-e40c-439d-a681-f4ee4ea06b27} 1657914252066809 (id=79456894981 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> closed
[task 2022-07-15T19:44:12.756Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {7d00e5a7-a387-43b6-b437-d1c8334a2963}; ending call
[task 2022-07-15T19:44:12.756Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{7d00e5a7-a387-43b6-b437-d1c8334a2963} 1657914252075217 (id=79456894981 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> closed
[task 2022-07-15T19:44:12.757Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {3e6e7e9c-998f-45d8-8bc6-8970ea55e4f8}; ending call
[task 2022-07-15T19:44:12.761Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{3e6e7e9c-998f-45d8-8bc6-8970ea55e4f8} 1657914252079694 (id=79456894981 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> closed
[task 2022-07-15T19:44:12.761Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {78d62376-02b1-40b0-94cd-cde831e3ae8d}; ending call
[task 2022-07-15T19:44:12.768Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{78d62376-02b1-40b0-94cd-cde831e3ae8d} 1657914252085344 (id=79456894981 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> closed
[task 2022-07-15T19:44:12.769Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {df0462be-4317-42bd-9c74-4d659c8cd490}; ending call
[task 2022-07-15T19:44:12.770Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{df0462be-4317-42bd-9c74-4d659c8cd490} 1657914252090297 (id=79456894981 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> closed
[task 2022-07-15T19:44:12.771Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {7b8b9d03-4265-48d1-83ba-8cc2c44fe4fb}; ending call
[task 2022-07-15T19:44:12.771Z] 19:44:12     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{7b8b9d03-4265-48d1-83ba-8cc2c44fe4fb} 1657914252095802 (id=79456894981 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> closed
[task 2022-07-15T19:44:13.070Z] 19:44:13     INFO - PID 28954 | -----------------------------------------------------
[task 2022-07-15T19:44:13.072Z] 19:44:13     INFO - PID 28954 | Suppressions used:
[task 2022-07-15T19:44:13.072Z] 19:44:13     INFO - PID 28954 |   count      bytes template
[task 2022-07-15T19:44:13.073Z] 19:44:13     INFO - PID 28954 |       2        288 libfontconfig.so
[task 2022-07-15T19:44:13.074Z] 19:44:13     INFO - PID 28954 |       2      65568 nr_reg_local_init
[task 2022-07-15T19:44:13.075Z] 19:44:13     INFO - PID 28954 |     156      14879 r_log_register
[task 2022-07-15T19:44:13.075Z] 19:44:13     INFO - PID 28954 |      69       3176 nr_reg_set
[task 2022-07-15T19:44:13.076Z] 19:44:13     INFO - PID 28954 | -----------------------------------------------------
[task 2022-07-15T19:44:13.329Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:366: PeerConnectionImpl: PeerConnectionImpl constructor for
[task 2022-07-15T19:44:13.335Z] 19:44:13     INFO - PID 28954 | [Parent 28954: Socket Thread]: D/mtransport NrIceCtx static call to find local stun addresses
[task 2022-07-15T19:44:13.351Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|sdp_config] sdp_config.c:86: SDP: Initialized config pointer: 60b00009c1f0
[task 2022-07-15T19:44:13.351Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{49cc82b6-a42a-4a4b-810e-45a8c7bfab06} 1657914253331870 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> have-remote-offer
[task 2022-07-15T19:44:13.359Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:3152: OnStunAddrsAvailable: receiving (5) stun addrs
[task 2022-07-15T19:44:13.360Z] 19:44:13     INFO - PID 28954 | [Child 32155: Socket Thread]: I/mtransport NrIceCtx(PC:{49cc82b6-a42a-4a4b-810e-45a8c7bfab06} 1657914253331870 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-): SetStunServers
[task 2022-07-15T19:44:13.362Z] 19:44:13     INFO - PID 28954 | [Child 32155: Socket Thread]: I/mtransport NrIceCtx(PC:{49cc82b6-a42a-4a4b-810e-45a8c7bfab06} 1657914253331870 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-): SetTurnServers
[task 2022-07-15T19:44:13.369Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {49cc82b6-a42a-4a4b-810e-45a8c7bfab06}; ending call
[task 2022-07-15T19:44:13.372Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{49cc82b6-a42a-4a4b-810e-45a8c7bfab06} 1657914253331870 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: have-remote-offer -> closed
[task 2022-07-15T19:44:13.375Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:366: PeerConnectionImpl: PeerConnectionImpl constructor for
[task 2022-07-15T19:44:13.375Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|sdp_config] sdp_config.c:86: SDP: Initialized config pointer: 60b00009d8a0
[task 2022-07-15T19:44:13.381Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{79d5d985-edee-40f3-a838-b10539d59ebe} 1657914253368693 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> have-remote-offer
[task 2022-07-15T19:44:13.382Z] 19:44:13     INFO - PID 28954 | [Parent 28954: Socket Thread]: D/mtransport NrIceCtx static call to find local stun addresses
[task 2022-07-15T19:44:13.401Z] 19:44:13     INFO - PID 28954 | [Child 32155: Socket Thread]: I/mtransport NrIceCtx(PC:{79d5d985-edee-40f3-a838-b10539d59ebe} 1657914253368693 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-): SetStunServers
[task 2022-07-15T19:44:13.402Z] 19:44:13     INFO - PID 28954 | [Child 32155: Socket Thread]: I/mtransport NrIceCtx(PC:{79d5d985-edee-40f3-a838-b10539d59ebe} 1657914253368693 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-): SetTurnServers
[task 2022-07-15T19:44:13.403Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {79d5d985-edee-40f3-a838-b10539d59ebe}; ending call
[task 2022-07-15T19:44:13.406Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{79d5d985-edee-40f3-a838-b10539d59ebe} 1657914253368693 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: have-remote-offer -> closed
[task 2022-07-15T19:44:13.409Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:366: PeerConnectionImpl: PeerConnectionImpl constructor for
[task 2022-07-15T19:44:13.413Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|sdp_config] sdp_config.c:86: SDP: Initialized config pointer: 60b00009eb30
[task 2022-07-15T19:44:13.415Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{0502a3db-a2e8-4c28-8fa5-f7b04b5ef38f} 1657914253402288 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> have-remote-offer
[task 2022-07-15T19:44:13.423Z] 19:44:13     INFO - PID 28954 | [Child 32155: Socket Thread]: I/mtransport NrIceCtx(PC:{0502a3db-a2e8-4c28-8fa5-f7b04b5ef38f} 1657914253402288 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-): SetStunServers
[task 2022-07-15T19:44:13.423Z] 19:44:13     INFO - PID 28954 | [Child 32155: Socket Thread]: I/mtransport NrIceCtx(PC:{0502a3db-a2e8-4c28-8fa5-f7b04b5ef38f} 1657914253402288 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-): SetTurnServers
[task 2022-07-15T19:44:13.431Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:2045: Close: Closing PeerConnectionImpl {0502a3db-a2e8-4c28-8fa5-f7b04b5ef38f}; ending call
[task 2022-07-15T19:44:13.431Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{0502a3db-a2e8-4c28-8fa5-f7b04b5ef38f} 1657914253402288 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: have-remote-offer -> closed
[task 2022-07-15T19:44:13.432Z] 19:44:13     INFO - PID 28954 | [Parent 28954: Socket Thread]: D/mtransport NrIceCtx static call to find local stun addresses
[task 2022-07-15T19:44:13.436Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:366: PeerConnectionImpl: PeerConnectionImpl constructor for
[task 2022-07-15T19:44:13.439Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/signaling [main|sdp_config] sdp_config.c:86: SDP: Initialized config pointer: 60b00009fa50
[task 2022-07-15T19:44:13.441Z] 19:44:13     INFO - PID 28954 | [Child 32155: Main Thread]: I/jsep [{6b3df85c-f8f9-4695-ba0a-ea30af0ecbad} 1657914253430871 (id=79456894985 url=http://web-platform.test:8000/webrtc/RTCTrackEvent-]: stable -> have-remote-offer
[task 2022-07-15T19:44:13.446Z] 19:44:13     INFO - PID 28954 | =================================================================
[task 2022-07-15T19:44:13.446Z] 19:44:13     INFO - PID 28954 | [Parent 28954: Socket Thread]: D/mtransport NrIceCtx static call to find local stun addresses
[task 2022-07-15T19:44:13.446Z] 19:44:13    ERROR - PID 28954 | ==32155==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000167e20 at pc 0x7f86a474262b bp 0x7ffd459fb810 sp 0x7ffd459fb808
[task 2022-07-15T19:44:13.446Z] 19:44:13     INFO - PID 28954 | READ of size 8 at 0x60c000167e20 thread T0 (Isolated Web Co)
[task 2022-07-15T19:44:13.811Z] 19:44:13     INFO - PID 28954 | [Child 32117: Socket Thread]: I/mtransport NrIceCtx(PC:{6aa64d8a-9f97-4d2c-b8c3-758a7d035428} 1657914249917063 (id=77309411337 url=https://web-platform.test:8443/webrtc/RTCRtpTransce): Destroy
[task 2022-07-15T19:44:13.813Z] 19:44:13     INFO - PID 28954 | [Child 32117: Socket Thread]: I/mtransport NrIceCtx(PC:{23a03c57-ac1f-481c-a4ef-7b8d7ba9b0cf} 1657914244785927 (id=77309411333 url=https://web-platform.test:8443/webrtc/RTCRtpTransce): Destroy
[task 2022-07-15T19:44:13.814Z] 19:44:13     INFO - PID 28954 | [Child 32117: Socket Thread]: I/mtransport NrIceCtx(PC:{b8db11b6-5800-44b5-968f-c69519df223c} 1657914249533733 (id=77309411337 url=https://web-platform.test:8443/webrtc/RTCRtpTransce): Destroy
[task 2022-07-15T19:44:13.816Z] 19:44:13     INFO - PID 28954 | Timecard created 1657914244.785463
[task 2022-07-15T19:44:13.818Z] 19:44:13     INFO - PID 28954 |  Timestamp   | Delta       | Event                                  | File                         | Function
[task 2022-07-15T19:44:13.819Z] 19:44:13     INFO - PID 28954 | ==========================================================================================================================
[task 2022-07-15T19:44:13.821Z] 19:44:13     INFO - PID 28954 |     0.000120 |    0.000120 | Constructor Completed                  | PeerConnectionImpl.cpp:367   | PeerConnectionImpl
[task 2022-07-15T19:44:13.843Z] 19:44:13     INFO - PID 28954 |     0.000503 |    0.000383 | Initializing PC Ctx                    | PeerConnectionImpl.cpp:456   | Initialize
[task 2022-07-15T19:44:13.844Z] 19:44:13     INFO - PID 28954 |     0.028661 |    0.028158 | Create Offer                           | PeerConnectionImpl.cpp:1399  | CreateOffer
[task 2022-07-15T19:44:13.851Z] 19:44:13     INFO - PID 28954 |     0.029390 |    0.000729 | Set Local Description                  | PeerConnectionImpl.cpp:1468  | SetLocalDescription
[task 2022-07-15T19:44:13.854Z] 19:44:13     INFO - PID 28954 |     0.053881 |    0.024491 | Set Remote Description                 | PeerConnectionImpl.cpp:1568  | SetRemoteDescription
[task 2022-07-15T19:44:13.855Z] 19:44:13     INFO - PID 28954 |     0.067115 |    0.013234 | Create Offer                           | PeerConnectionImpl.cpp:1399  | CreateOffer
[task 2022-07-15T19:44:13.856Z] 19:44:13     INFO - PID 28954 |     0.068721 |    0.001606 | Set Local Description                  | PeerConnectionImpl.cpp:1468  | SetLocalDescription
[task 2022-07-15T19:44:13.856Z] 19:44:13     INFO - PID 28954 |     0.107755 |    0.039034 | Close                                  | PeerConnectionImpl.cpp:2028  | Close
[task 2022-07-15T19:44:13.857Z] 19:44:13     INFO - PID 28954 |     0.121579 |    0.013824 | Ice Candidate gathered                 | PeerConnectionImpl.cpp:2557  | CandidateReady
[task 2022-07-15T19:44:13.858Z] 19:44:13     INFO - PID 28954 |     0.121598 |    0.000019 | Ice Candidate gathered                 | PeerConnectionImpl.cpp:2557  | CandidateReady
[task 2022-07-15T19:44:13.859Z] 19:44:13     INFO - PID 28954 |     0.121814 |    0.000216 | Ice Candidate gathered                 | PeerConnectionImpl.cpp:2557  | CandidateReady
[task 2022-07-15T19:44:13.860Z] 19:44:13     INFO - PID 28954 |     0.121836 |    0.000022 | Ice Candidate gathered                 | PeerConnectionImpl.cpp:2557  | CandidateReady
[task 2022-07-15T19:44:13.861Z] 19:44:13     INFO - PID 28954 |     0.121856 |    0.000020 | Ice Candidate gathered                 | PeerConnectionImpl.cpp:2557  | CandidateReady
[task 2022-07-15T19:44:13.862Z] 19:44:13     INFO - PID 28954 |     0.121873 |    0.000017 | Ice Candidate gathered                 | PeerConnectionImpl.cpp:2557  | CandidateReady
[task 2022-07-15T19:44:13.863Z] 19:44:13     INFO - PID 28954 |     0.121887 |    0.000014 | Ice Candidate gathered                 | PeerConnectionImpl.cpp:2557  | CandidateReady
[task 2022-07-15T19:44:13.864Z] 19:44:13     INFO - PID 28954 |     0.121903 |    0.000016 | Ice Candidate gathered                 | PeerConnectionImpl.cpp:2557  | CandidateReady
[task 2022-07-15T19:44:13.866Z] 19:44:13     INFO - PID 28954 |     0.121925 |    0.000022 | Ice Candidate gathered                 | PeerConnectionImpl.cpp:2557  | CandidateReady
[task 2022-07-15T19:44:13.867Z] 19:44:13     INFO - PID 28954 |     9.022215 |    8.900290 | Destructor Invoked                     | PeerConnectionImpl.cpp:384   | ~PeerConnectionImpl
[task 2022-07-15T19:44:13.868Z] 19:44:13     INFO - PID 28954 |     9.022215 |    0.000000 | {23a03c57-ac1f-481c-a4ef-7b8d7ba9b0cf} | PeerConnectionImpl.cpp:385   | ~PeerConnectionImpl
[task 2022-07-15T19:44:13.869Z] 19:44:13     INFO - PID 28954 | [Child 32117: Main Thread]: I/signaling [main|PeerConnectionImpl] PeerConnectionImpl.cpp:392: ~PeerConnectionImpl: PeerConnectionImpl destructor invoked for {23a03c57-ac1f-481c-a4ef-7b8d7ba9b0cf}
[task 2022-07-15T19:44:13.870Z] 19:44:13     INFO - PID 28954 | [Child 32117: Socket Thread]: I/mtransport NrIceCtx(PC:{cc5ac3c7-a710-48e5-b859-f5861f3ecaae} 1657914249525971 (id=77309411337 url=https://web-platform.test:8443/webrtc/RTCRtpTransce): Destroy
[task 2022-07-15T19:44:13.871Z] 19:44:13     INFO - PID 28954 | [Child 32117: Socket Thread]: I/mtransport NrIceCtx(PC:{23b6607a-05ce-45a2-b96d-dae09c8c02a7} 1657914244756266 (id=77309411333 url=https://web-platform.test:8443/webrtc/RTCRtpTransce): Destroy
[task 2022-07-15T19:44:13.872Z] 19:44:13     INFO - PID 28954 | Timecard created 1657914249.527204

This could be WebRTC-related, but the stacks look pretty deep into some SpiderMonkey internals, so I'll move it there for now. It looks like maybe a JS Map object is involved?

Group: core-security → javascript-core-security
Component: WebRTC → JavaScript: GC
Attached file ASan report —

PeerConnectionObserverJSImpl::OnSetDescriptionSuccess is on the use stack, so this could be some weird interaction with JS-implemented WebIDL. There's also mozilla::MediaTrackGraphShutdownThreadRunnable::Run() on the stack so maybe there's some kind of shutdown issue here? It doesn't look like we are in full XPCOM shutdown, however.

Assignee: nobody → jcoppeard
Flags: needinfo?(jcoppeard)

This adds MutableRange and moves methods that can mutate the table into it. It
then allows us to create Range iterators for const tables. The range classes
still hold a non-const pointer to the table internally.

The problem was that we did not apply post barriers uniformly. For nursery
objects, bug 1779733 removed post barriers from set operations and the
finalizer. However they could still fire when the table was resized by a
removal. This could push store buffer entries into hash table storage which
were not removed when the storage was resized again by a set. This lead to use
after free.

The patch improves things by nurseryTable and tenuredTable methods which return
a pointer to the table with the appropraite barriers depending on whether the
map object itself is tenured or not. The getData method remtains and returns a
const pointer, so can't invoke any write barriers.

Operations that can mutate the map have to handle both nursery and tenured maps.

Depends on D152034

Attachment #9285851 - Attachment description: Bug 1779833 - Part 2: Fix places were post barriers were still applied to nursery allcoated Map objects r?jandem → Bug 1779833 - Part 2: Fix places were post barriers were still applied to nursery allocated Map objects r?jandem

Part 1: Split ordered hash table iteration into two classes to allow iteration of const tables r=jandem
https://hg.mozilla.org/integration/autoland/rev/41f129a3d78bea9769814888e30b5ccff5e31108
https://hg.mozilla.org/mozilla-central/rev/41f129a3d78b

Part 2: Fix places were post barriers were still applied to nursery allocated Map objects r=jandem
https://hg.mozilla.org/integration/autoland/rev/67ba3b11e0532445357969af9807042d0efdc1a8
https://hg.mozilla.org/mozilla-central/rev/67ba3b11e053

Part 3: Testcase to trace store buffer entries that point to freed memory r=jandem
https://hg.mozilla.org/integration/autoland/rev/455f0745a8e63c89e94c7a3823dfaf3d237274cc
https://hg.mozilla.org/mozilla-central/rev/455f0745a8e6

Group: javascript-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 2 years ago
status-firefox104: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 104 Branch
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: