Closed Bug 1782219 Opened 2 years ago Closed 1 year ago

Intermittent SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:66 in RefPtr<mozilla::layers::CompositorThreadHolder>::assign_assuming_AddRef

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
109 Branch
Tracking Flags:
Tracking Status
thunderbird_esr91 --- wontfix
firefox-esr102 108+ fixed
firefox105 --- wontfix
firefox106 --- wontfix
firefox107 --- wontfix
firefox108 + fixed
firefox109 + fixed

People

(Reporter: intermittent-bug-filer, Assigned: sotaro)

References

(Regression)

Details

(4 keywords, Whiteboard: [post-critsmash-triage][adv-main108+r][adv-esr102.6+r])

Attachments

(2 files, 1 obsolete file)

Bug 1782219 - Protect sVideoBridgeFromProcess by StaticDataMutex
48 bytes, text/x-phabricator-request
diannaS
: approval-mozilla-beta+
tjr
: sec-approval+
Details | Review
Bug 1782219 - patch of D121045 for ESR102
48 bytes, text/x-phabricator-request
diannaS
: approval-mozilla-esr102+
Details | Review

Filed by: abutkovits [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer?job_id=385776970&repo=mozilla-central
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/UKcjzGYMQYeAJszxXGPWeA/runs/0/artifacts/public/logs/live_backing.log
Reftest URL: https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/UKcjzGYMQYeAJszxXGPWeA/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

[task 2022-07-29T10:34:25.249Z] 10:34:25     INFO - REFTEST TEST-END | layout/reftests/font-inflation/xul-reflow-1.html == layout/reftests/font-inflation/xul-reflow-1-ref.html
[task 2022-07-29T10:34:25.291Z] 10:34:25     INFO - REFTEST INFO | RESTORE PREFERENCE pref(font.size.inflation.forceEnabled,false)
[task 2022-07-29T10:34:25.296Z] 10:34:25     INFO - REFTEST INFO | RESTORE PREFERENCE pref(font.size.inflation.emPerLine,0)
[task 2022-07-29T10:34:25.296Z] 10:34:25     INFO - REFTEST INFO | RESTORE PREFERENCE pref(dom.meta-viewport.enabled,false)
[task 2022-07-29T10:34:25.297Z] 10:34:25     INFO - REFTEST INFO | Slowest test took 725ms (file:///Z:/task_165908737780271/build/tests/reftest/tests/layout/reftests/font-inflation/video-1.html)
[task 2022-07-29T10:34:25.297Z] 10:34:25     INFO - REFTEST INFO | Total canvas count = 0
[task 2022-07-29T10:34:25.458Z] 10:34:25     INFO - 1659090865455	Marionette	TRACE	Received observer notification quit-application
[task 2022-07-29T10:34:25.458Z] 10:34:25     INFO - 1659090865455	Marionette	INFO	Stopped listening on port 2828
[task 2022-07-29T10:34:25.459Z] 10:34:25     INFO - 1659090865455	Marionette	DEBUG	Marionette stopped listening
[task 2022-07-29T10:34:25.680Z] 10:34:25     INFO - [Parent 7460, Main Thread] WARNING: ContentParent: id=121d54ff6280 - BlockShutdown: CanSend.: file /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:3595
[task 2022-07-29T10:34:25.681Z] 10:34:25     INFO - [Parent 7460, Main Thread] WARNING: ContentParent: id=121d54ff6280 - ShutDownProcess: Sent shutdown message.: file /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:1799
[task 2022-07-29T10:34:25.682Z] 10:34:25     INFO - [Parent 7460, Main Thread] WARNING: ContentParent: id=121d55c0f580 - BlockShutdown: CanSend.: file /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:3595
[task 2022-07-29T10:34:25.683Z] 10:34:25     INFO - [Parent 7460, Main Thread] WARNING: ContentParent: id=121d55c0f580 - ShutDownProcess: Sent shutdown message.: file /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:1799
[task 2022-07-29T10:34:25.700Z] 10:34:25     INFO - [Parent 7460, Main Thread] WARNING: ContentParent: id=121d54ff6280 - ShutDownProcess: Closing channel.: file /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:1834
[task 2022-07-29T10:34:25.700Z] 10:34:25     INFO - [Parent 7460, Main Thread] WARNING: ContentParent: id=121d54ff6280 - RemoveShutdownBlockers: file /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:3697
[task 2022-07-29T10:34:25.702Z] 10:34:25     INFO - [Parent 7460, Main Thread] WARNING: ContentParent: id=121d55c0f580 - ShutDownProcess: Closing channel.: file /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:1834
[task 2022-07-29T10:34:25.703Z] 10:34:25     INFO - [Parent 7460, Main Thread] WARNING: ContentParent: id=121d55c0f580 - RemoveShutdownBlockers: file /builds/worker/checkouts/gecko/dom/ipc/ContentParent.cpp:3697
[task 2022-07-29T10:34:26.563Z] 10:34:26     INFO - =================================================================
[task 2022-07-29T10:34:26.564Z] 10:34:26    ERROR - ==1304==ERROR: AddressSanitizer: heap-use-after-free on address 0x121437f22fc8 at pc 0x7ffc657b67a6 bp 0x00581181e0a0 sp 0x00581181e0e8
[task 2022-07-29T10:34:26.565Z] 10:34:26     INFO - READ of size 8 at 0x121437f22fc8 thread T24
[task 2022-07-29T10:34:26.998Z] 10:34:26     INFO -     #0 0x7ffc657b67a5 in RefPtr<mozilla::layers::CompositorThreadHolder>::assign_assuming_AddRef /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:66
[task 2022-07-29T10:34:26.998Z] 10:34:26     INFO -     #1 0x7ffc657b67a5 in RefPtr<mozilla::layers::CompositorThreadHolder>::operator= /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:168
[task 2022-07-29T10:34:26.999Z] 10:34:26     INFO -     #2 0x7ffc657b67a5 in mozilla::layers::VideoBridgeParent::ReleaseCompositorThread /builds/worker/checkouts/gecko/gfx/layers/ipc/VideoBridgeParent.cpp:102
[task 2022-07-29T10:34:26.999Z] 10:34:26     INFO -     #3 0x7ffc657b67a5 in mozilla::layers::VideoBridgeParent::Shutdown(void) /builds/worker/checkouts/gecko/gfx/layers/ipc/VideoBridgeParent.cpp:99
[task 2022-07-29T10:34:27.000Z] 10:34:27     INFO -     #4 0x7ffc6a50edc8 in mozilla::RemoteDecoderManagerParent::ShutdownVideoBridge::<lambda_2>::operator() /builds/worker/checkouts/gecko/dom/media/ipc/RemoteDecoderManagerParent.cpp:104
[task 2022-07-29T10:34:27.000Z] 10:34:27     INFO -     #5 0x7ffc6a50edc8 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/dom/media/ipc/RemoteDecoderManagerParent.cpp:102:60'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
[task 2022-07-29T10:34:27.001Z] 10:34:27     INFO -     #6 0x7ffc633d0e82 in mozilla::SyncRunnable::Run(void) /builds/worker/workspace/obj-build/dist/include/mozilla/SyncRunnable.h:114
[task 2022-07-29T10:34:27.002Z] 10:34:27     INFO -     #7 0x7ffc631bb30e in mozilla::TaskQueue::Runner::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:259
[task 2022-07-29T10:34:27.002Z] 10:34:27     INFO -     #8 0x7ffc631f408c in nsThreadPool::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:310
[task 2022-07-29T10:34:27.003Z] 10:34:27     INFO -     #9 0x7ffc631e13a5 in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199
[task 2022-07-29T10:34:27.003Z] 10:34:27     INFO -     #10 0x7ffc631efa5c in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465
[task 2022-07-29T10:34:27.005Z] 10:34:27     INFO -     #11 0x7ffc64817e9e in mozilla::ipc::MessagePumpForNonMainThreads::Run(class base::MessagePump::Delegate *) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300
[task 2022-07-29T10:34:27.005Z] 10:34:27     INFO -     #12 0x7ffc647324d5 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380
[task 2022-07-29T10:34:27.006Z] 10:34:27     INFO -     #13 0x7ffc647324d5 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373
[task 2022-07-29T10:34:27.007Z] 10:34:27     INFO -     #14 0x7ffc647322a5 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355
[task 2022-07-29T10:34:27.009Z] 10:34:27     INFO -     #15 0x7ffc631d6d7e in nsThread::ThreadFunc(void *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:384
[task 2022-07-29T10:34:27.009Z] 10:34:27     INFO -     #16 0x7ffc874d96ad in _PR_NativeRunThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:399
[task 2022-07-29T10:34:27.010Z] 10:34:27     INFO -     #17 0x7ffc874b1a3b in pr_root /builds/worker/checkouts/gecko/nsprpub/pr/src/md/windows/w95thred.c:139
[task 2022-07-29T10:34:27.012Z] 10:34:27     INFO -     #18 0x7ffcac7e1bb1  (C:\Windows\System32\ucrtbase.dll+0x180021bb1)
[task 2022-07-29T10:34:27.012Z] 10:34:27     INFO -     #19 0x7ffc81cd9dc3 in __asan::AsanThread::ThreadStart(unsigned __int64) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_thread.cpp:277
[task 2022-07-29T10:34:27.013Z] 10:34:27     INFO -     #20 0x7ffcad467033  (C:\Windows\System32\KERNEL32.DLL+0x180017033)
[task 2022-07-29T10:34:27.014Z] 10:34:27     INFO -     #21 0x7ffc88e1831c in mozilla::interceptor::FuncHook<mozilla::interceptor::WindowsDllInterceptor<mozilla::interceptor::VMSharingPolicyShared>,void (*)(int, void *, void *)>::operator() /builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/nsWindowsDllInterceptor.h:150
[task 2022-07-29T10:34:27.014Z] 10:34:27     INFO -     #22 0x7ffc88e1831c in patched_BaseThreadInitThunk /builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:577
[task 2022-07-29T10:34:27.015Z] 10:34:27     INFO -     #23 0x7ffcaf102650  (C:\Windows\SYSTEM32\ntdll.dll+0x180052650)
[task 2022-07-29T10:34:27.015Z] 10:34:27     INFO - 0x121437f22fc8 is located 392 bytes inside of 424-byte region [0x121437f22e40,0x121437f22fe8)
[task 2022-07-29T10:34:27.016Z] 10:34:27     INFO - freed by thread T3 here:
[task 2022-07-29T10:34:27.016Z] 10:34:27     INFO -     #0 0x7ffc81ccdf1b in free /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:82
[task 2022-07-29T10:34:27.017Z] 10:34:27     INFO -     #1 0x7ffc657b7f36 in [thunk]: mozilla::layers::VideoBridgeParent::`vector deleting dtor'`adjustor{328}'(unsigned int) (Z:\task_165908737780271\build\application\firefox\xul.dll+0x1831d7f36)
[task 2022-07-29T10:34:27.017Z] 10:34:27     INFO -     #2 0x7ffc6483031e in mozilla::ipc::ActorLifecycleProxy::~ActorLifecycleProxy(void) /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:260
[task 2022-07-29T10:34:27.018Z] 10:34:27     INFO -     #3 0x7ffc6552c7a1 in mozilla::ipc::ActorLifecycleProxy::Release /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/ProtocolUtils.h:608
[task 2022-07-29T10:34:27.018Z] 10:34:27     INFO -     #4 0x7ffc6552c7a1 in mozilla::layers::PVideoBridgeParent::OnChannelClose(void) /builds/worker/workspace/obj-build/ipc/ipdl/PVideoBridgeChild.cpp:319
[task 2022-07-29T10:34:27.019Z] 10:34:27     INFO -     #5 0x7ffc6481063e in mozilla::ipc::MessageChannel::OnNotifyMaybeChannelError(void) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2027
[task 2022-07-29T10:34:27.020Z] 10:34:27     INFO -     #6 0x7ffc648437a2 in mozilla::detail::RunnableMethodArguments<>::applyImpl /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1147
[task 2022-07-29T10:34:27.020Z] 10:34:27     INFO -     #7 0x7ffc648437a2 in mozilla::detail::RunnableMethodArguments<>::apply /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1153
[task 2022-07-29T10:34:27.021Z] 10:34:27     INFO -     #8 0x7ffc648437a2 in mozilla::detail::RunnableMethodImpl<class mozilla::UntrustedModulesProcessor *, void (__cdecl mozilla::UntrustedModulesProcessor::*)(void), 1, 1>::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:1200
[task 2022-07-29T10:34:27.022Z] 10:34:27     INFO -     #9 0x7ffc631e13a5 in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199
[task 2022-07-29T10:34:27.022Z] 10:34:27     INFO -     #10 0x7ffc631efa5c in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465
[task 2022-07-29T10:34:27.023Z] 10:34:27     INFO -     #11 0x7ffc64817ffa in mozilla::ipc::MessagePumpForNonMainThreads::Run(class base::MessagePump::Delegate *) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330
[task 2022-07-29T10:34:27.023Z] 10:34:27     INFO -     #12 0x7ffc647324d5 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380
[task 2022-07-29T10:34:27.024Z] 10:34:27     INFO -     #13 0x7ffc647324d5 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373
[task 2022-07-29T10:34:27.024Z] 10:34:27     INFO -     #14 0x7ffc647322a5 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355
[task 2022-07-29T10:34:27.025Z] 10:34:27     INFO -     #15 0x7ffc631d6d7e in nsThread::ThreadFunc(void *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:384
[task 2022-07-29T10:34:27.025Z] 10:34:27     INFO -     #16 0x7ffc874d96ad in _PR_NativeRunThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:399
[task 2022-07-29T10:34:27.026Z] 10:34:27     INFO -     #17 0x7ffc874b1a3b in pr_root /builds/worker/checkouts/gecko/nsprpub/pr/src/md/windows/w95thred.c:139
[task 2022-07-29T10:34:27.026Z] 10:34:27     INFO -     #18 0x7ffcac7e1bb1  (C:\Windows\System32\ucrtbase.dll+0x180021bb1)
[task 2022-07-29T10:34:27.027Z] 10:34:27     INFO -     #19 0x7ffc81cd9dc3 in __asan::AsanThread::ThreadStart(unsigned __int64) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_thread.cpp:277
[task 2022-07-29T10:34:27.027Z] 10:34:27     INFO -     #20 0x7ffcad467033  (C:\Windows\System32\KERNEL32.DLL+0x180017033)
[task 2022-07-29T10:34:27.028Z] 10:34:27     INFO -     #21 0x7ffc88e1831c in mozilla::interceptor::FuncHook<mozilla::interceptor::WindowsDllInterceptor<mozilla::interceptor::VMSharingPolicyShared>,void (*)(int, void *, void *)>::operator() /builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/nsWindowsDllInterceptor.h:150
[task 2022-07-29T10:34:27.028Z] 10:34:27     INFO -     #22 0x7ffc88e1831c in patched_BaseThreadInitThunk /builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:577
[task 2022-07-29T10:34:27.029Z] 10:34:27     INFO -     #23 0x7ffcaf102650  (C:\Windows\SYSTEM32\ntdll.dll+0x180052650)
[task 2022-07-29T10:34:27.029Z] 10:34:27     INFO - previously allocated by thread T0 here:
[task 2022-07-29T10:34:27.030Z] 10:34:27     INFO -     #0 0x7ffc81cce02b in malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:98
[task 2022-07-29T10:34:27.031Z] 10:34:27     INFO -     #1 0x7ffc88d011ad in moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52
[task 2022-07-29T10:34:27.031Z] 10:34:27     INFO -     #2 0x7ffc657b3e43 in operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33
[task 2022-07-29T10:34:27.034Z] 10:34:27     INFO -     #3 0x7ffc657b3e43 in mozilla::layers::VideoBridgeParent::Open(class mozilla::ipc::Endpoint<class mozilla::layers::PVideoBridgeParent> &&, enum mozilla::layers::VideoBridgeSource) /builds/worker/checkouts/gecko/gfx/layers/ipc/VideoBridgeParent.cpp:50
[task 2022-07-29T10:34:27.036Z] 10:34:27     INFO -     #4 0x7ffc65b348d9 in mozilla::gfx::GPUParent::RecvInitVideoBridge(class mozilla::ipc::Endpoint<class mozilla::layers::PVideoBridgeParent> &&) /builds/worker/checkouts/gecko/gfx/ipc/GPUParent.cpp:435
[task 2022-07-29T10:34:27.036Z] 10:34:27     INFO -     #5 0x7ffc65b91cbd in mozilla::gfx::PGPUParent::OnMessageReceived(class IPC::Message const &) /builds/worker/workspace/obj-build/ipc/ipdl/PGPUParent.cpp:957
[task 2022-07-29T10:34:27.038Z] 10:34:27     INFO -     #6 0x7ffc6480e1c2 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(class mozilla::ipc::ActorLifecycleProxy *, class IPC::Message const &) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1749
[task 2022-07-29T10:34:27.038Z] 10:34:27     INFO -     #7 0x7ffc6480b506 in mozilla::ipc::MessageChannel::DispatchMessage(class mozilla::ipc::ActorLifecycleProxy *, class mozilla::UniquePtr<class IPC::Message, class mozilla::DefaultDelete<class IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1674
[task 2022-07-29T10:34:27.038Z] 10:34:27     INFO -     #8 0x7ffc6480c5fe in mozilla::ipc::MessageChannel::RunMessage(class mozilla::ipc::ActorLifecycleProxy *, class mozilla::ipc::MessageChannel::MessageTask &) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1474
[task 2022-07-29T10:34:27.039Z] 10:34:27     INFO -     #9 0x7ffc6480ce36 in mozilla::ipc::MessageChannel::MessageTask::Run(void) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1572
[task 2022-07-29T10:34:27.039Z] 10:34:27     INFO -     #10 0x7ffc6320569d in mozilla::RunnableTask::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:538
[task 2022-07-29T10:34:27.040Z] 10:34:27     INFO -     #11 0x7ffc631b3d82 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:851
[task 2022-07-29T10:34:27.041Z] 10:34:27     INFO -     #12 0x7ffc631b018c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:683
[task 2022-07-29T10:34:27.041Z] 10:34:27     INFO -     #13 0x7ffc631b0b6e in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:461
[task 2022-07-29T10:34:27.042Z] 10:34:27     INFO -     #14 0x7ffc6320e351 in mozilla::TaskController::InitializeInternal::<lambda_2>::operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:190
[task 2022-07-29T10:34:27.042Z] 10:34:27     INFO -     #15 0x7ffc6320e351 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:190:7'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
[task 2022-07-29T10:34:27.043Z] 10:34:27     INFO -     #16 0x7ffc631e0715 in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1205
[task 2022-07-29T10:34:27.043Z] 10:34:27     INFO -     #17 0x7ffc631efa5c in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465
[task 2022-07-29T10:34:27.044Z] 10:34:27     INFO -     #18 0x7ffc64816d51 in mozilla::ipc::MessagePump::Run(class base::MessagePump::Delegate *) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107
[task 2022-07-29T10:34:27.044Z] 10:34:27     INFO -     #19 0x7ffc647324d5 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380
[task 2022-07-29T10:34:27.045Z] 10:34:27     INFO -     #20 0x7ffc647324d5 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373
[task 2022-07-29T10:34:27.046Z] 10:34:27     INFO -     #21 0x7ffc647322a5 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355
[task 2022-07-29T10:34:27.046Z] 10:34:27     INFO -     #22 0x7ffc6c8f644a in nsBaseAppShell::Run(void) /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150
[task 2022-07-29T10:34:27.047Z] 10:34:27     INFO -     #23 0x7ffc6cae3cea in nsAppShell::Run(void) /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:613
[task 2022-07-29T10:34:27.048Z] 10:34:27     INFO -     #24 0x7ffc7128e614 in XRE_RunAppShell(void) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:887
[task 2022-07-29T10:34:27.048Z] 10:34:27     INFO -     #25 0x7ffc647324d5 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380
[task 2022-07-29T10:34:27.049Z] 10:34:27     INFO -     #26 0x7ffc647324d5 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373
[task 2022-07-29T10:34:27.049Z] 10:34:27     INFO -     #27 0x7ffc647322a5 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355
[task 2022-07-29T10:34:27.050Z] 10:34:27     INFO -     #28 0x7ffc7128d96a in XRE_InitChildProcess(int, char **const, struct XREChildData const *) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:746
[task 2022-07-29T10:34:27.050Z] 10:34:27     INFO -     #29 0x7ff7e7702c5e in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:58
[task 2022-07-29T10:34:27.051Z] 10:34:27     INFO -     #30 0x7ff7e7702c5e in NS_internal_main(int, char **, char **) /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:346
[task 2022-07-29T10:34:27.051Z] 10:34:27     INFO -     #31 0x7ff7e77017bf in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:167
[task 2022-07-29T10:34:27.052Z] 10:34:27     INFO -     #32 0x7ff7e77fcfa7 in invoke_main d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:90
[task 2022-07-29T10:34:27.052Z] 10:34:27     INFO -     #33 0x7ff7e77fcfa7 in __scrt_common_main_seh d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
[task 2022-07-29T10:34:27.053Z] 10:34:27     INFO - Thread T24 created by T0 here:
[task 2022-07-29T10:34:27.062Z] 10:34:27     INFO -     #0 0x7ffc81cdaf62 in __asan_wrap_CreateThread /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_win.cpp:146
[task 2022-07-29T10:34:27.062Z] 10:34:27     INFO -     #1 0x7ffcac7e1896  (C:\Windows\System32\ucrtbase.dll+0x180021896)
[task 2022-07-29T10:34:27.063Z] 10:34:27     INFO -     #2 0x7ffc874b186d in _PR_MD_CREATE_THREAD /builds/worker/checkouts/gecko/nsprpub/pr/src/md/windows/w95thred.c:153
[task 2022-07-29T10:34:27.063Z] 10:34:27     INFO -     #3 0x7ffc874da46a in _PR_NativeCreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:1058
[task 2022-07-29T10:34:27.064Z] 10:34:27     INFO -     #4 0x7ffc874dac03 in _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:1184
[task 2022-07-29T10:34:27.064Z] 10:34:27     INFO -     #5 0x7ffc874d0aff in PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:1404
[task 2022-07-29T10:34:27.065Z] 10:34:27     INFO -     #6 0x7ffc631da311 in nsThread::Init(class nsTSubstring<char> const &) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:618
[task 2022-07-29T10:34:27.065Z] 10:34:27     INFO -     #7 0x7ffc631ecec8 in nsThreadManager::NewNamedThread(class nsTSubstring<char> const &, unsigned int, class nsIThread **) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadManager.cpp:533
[task 2022-07-29T10:34:27.066Z] 10:34:27     INFO -     #8 0x7ffc631f9d1c in NS_NewNamedThread(class nsTSubstring<char> const &, class nsIThread **, struct already_AddRefed<class nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:161
[task 2022-07-29T10:34:27.066Z] 10:34:27     INFO -     #9 0x7ffc631f283f in NS_NewNamedThread /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:154
[task 2022-07-29T10:34:27.067Z] 10:34:27     INFO -     #10 0x7ffc631f283f in nsThreadPool::PutEvent(struct already_AddRefed<class nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:123
[task 2022-07-29T10:34:27.068Z] 10:34:27     INFO -     #11 0x7ffc631f56e1 in nsThreadPool::Dispatch(struct already_AddRefed<class nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:362
[task 2022-07-29T10:34:27.068Z] 10:34:27     INFO -     #12 0x7ffc631a351a in mozilla::SharedThreadPool::Dispatch(struct already_AddRefed<class nsIRunnable>, unsigned int) /builds/worker/workspace/obj-build/dist/include/mozilla/SharedThreadPool.h:72
[task 2022-07-29T10:34:27.069Z] 10:34:27     INFO -     #13 0x7ffc631b86fb in mozilla::TaskQueue::DispatchLocked(class nsCOMPtr<class nsIRunnable> &, unsigned int, enum mozilla::AbstractThread::DispatchReason) /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:122
[task 2022-07-29T10:34:27.069Z] 10:34:27     INFO -     #14 0x7ffc6a504a14 in mozilla::TaskQueue::Dispatch /builds/worker/workspace/obj-build/dist/include/mozilla/TaskQueue.h:89
[task 2022-07-29T10:34:27.070Z] 10:34:27     INFO -     #15 0x7ffc6a504a14 in mozilla::RemoteDecoderManagerParent::StartupThreads(void) /builds/worker/checkouts/gecko/dom/media/ipc/RemoteDecoderManagerParent.cpp:81
[task 2022-07-29T10:34:27.071Z] 10:34:27     INFO -     #16 0x7ffc6a5052e4 in mozilla::RemoteDecoderManagerParent::CreateForContent(class mozilla::ipc::Endpoint<class mozilla::PRemoteDecoderManagerParent> &&) /builds/worker/checkouts/gecko/dom/media/ipc/RemoteDecoderManagerParent.cpp:129
[task 2022-07-29T10:34:27.071Z] 10:34:27     INFO -     #17 0x7ffc6484924b in mozilla::ipc::UtilityAudioDecoderParent::RecvNewContentRemoteDecoderManager(class mozilla::ipc::Endpoint<class mozilla::PRemoteDecoderManagerParent> &&) /builds/worker/checkouts/gecko/ipc/glue/UtilityAudioDecoderParent.cpp:81
[task 2022-07-29T10:34:27.072Z] 10:34:27     INFO -     #18 0x7ffc65b8ef9b in mozilla::gfx::PGPUParent::OnMessageReceived(class IPC::Message const &) /builds/worker/workspace/obj-build/ipc/ipdl/PGPUParent.cpp:1373
[task 2022-07-29T10:34:27.072Z] 10:34:27     INFO -     #19 0x7ffc6480e1c2 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(class mozilla::ipc::ActorLifecycleProxy *, class IPC::Message const &) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1749
[task 2022-07-29T10:34:27.073Z] 10:34:27     INFO -     #20 0x7ffc6480b506 in mozilla::ipc::MessageChannel::DispatchMessage(class mozilla::ipc::ActorLifecycleProxy *, class mozilla::UniquePtr<class IPC::Message, class mozilla::DefaultDelete<class IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1674
[task 2022-07-29T10:34:27.074Z] 10:34:27     INFO -     #21 0x7ffc6480c5fe in mozilla::ipc::MessageChannel::RunMessage(class mozilla::ipc::ActorLifecycleProxy *, class mozilla::ipc::MessageChannel::MessageTask &) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1474
[task 2022-07-29T10:34:27.074Z] 10:34:27     INFO -     #22 0x7ffc6480ce36 in mozilla::ipc::MessageChannel::MessageTask::Run(void) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1572
[task 2022-07-29T10:34:27.075Z] 10:34:27     INFO -     #23 0x7ffc6320569d in mozilla::RunnableTask::Run(void) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:538
[task 2022-07-29T10:34:27.076Z] 10:34:27     INFO -     #24 0x7ffc631b3d82 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:851
[task 2022-07-29T10:34:27.076Z] 10:34:27     INFO -     #25 0x7ffc631b018c in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(class mozilla::detail::BaseAutoLock<class mozilla::Mutex &> const &) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:683
[task 2022-07-29T10:34:27.077Z] 10:34:27     INFO -     #26 0x7ffc631b0b6e in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:461
[task 2022-07-29T10:34:27.077Z] 10:34:27     INFO -     #27 0x7ffc6320e351 in mozilla::TaskController::InitializeInternal::<lambda_2>::operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:190
[task 2022-07-29T10:34:27.078Z] 10:34:27     INFO -     #28 0x7ffc6320e351 in mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:190:7'>::Run /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531
[task 2022-07-29T10:34:27.079Z] 10:34:27     INFO -     #29 0x7ffc631e0715 in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1205
[task 2022-07-29T10:34:27.079Z] 10:34:27     INFO -     #30 0x7ffc631efa5c in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465
[task 2022-07-29T10:34:27.080Z] 10:34:27     INFO -     #31 0x7ffc64816d51 in mozilla::ipc::MessagePump::Run(class base::MessagePump::Delegate *) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107
[task 2022-07-29T10:34:27.080Z] 10:34:27     INFO -     #32 0x7ffc647324d5 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380
[task 2022-07-29T10:34:27.081Z] 10:34:27     INFO -     #33 0x7ffc647324d5 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373
[task 2022-07-29T10:34:27.081Z] 10:34:27     INFO -     #34 0x7ffc647322a5 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355
[task 2022-07-29T10:34:27.082Z] 10:34:27     INFO -     #35 0x7ffc6c8f644a in nsBaseAppShell::Run(void) /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150
[task 2022-07-29T10:34:27.082Z] 10:34:27     INFO -     #36 0x7ffc6cae3cea in nsAppShell::Run(void) /builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:613
[task 2022-07-29T10:34:27.083Z] 10:34:27     INFO -     #37 0x7ffc7128e614 in XRE_RunAppShell(void) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:887
[task 2022-07-29T10:34:27.083Z] 10:34:27     INFO -     #38 0x7ffc647324d5 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380
[task 2022-07-29T10:34:27.084Z] 10:34:27     INFO -     #39 0x7ffc647324d5 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373
[task 2022-07-29T10:34:27.085Z] 10:34:27     INFO -     #40 0x7ffc647322a5 in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355
[task 2022-07-29T10:34:27.085Z] 10:34:27     INFO -     #41 0x7ffc7128d96a in XRE_InitChildProcess(int, char **const, struct XREChildData const *) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:746
[task 2022-07-29T10:34:27.086Z] 10:34:27     INFO -     #42 0x7ff7e7702c5e in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:58
[task 2022-07-29T10:34:27.086Z] 10:34:27     INFO -     #43 0x7ff7e7702c5e in NS_internal_main(int, char **, char **) /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:346
[task 2022-07-29T10:34:27.087Z] 10:34:27     INFO -     #44 0x7ff7e77017bf in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:167
[task 2022-07-29T10:34:27.087Z] 10:34:27     INFO -     #45 0x7ff7e77fcfa7 in invoke_main d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:90
[task 2022-07-29T10:34:27.088Z] 10:34:27     INFO -     #46 0x7ff7e77fcfa7 in __scrt_common_main_seh d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
[task 2022-07-29T10:34:27.089Z] 10:34:27     INFO -     #47 0x7ffcad467033  (C:\Windows\System32\KERNEL32.DLL+0x180017033)
[task 2022-07-29T10:34:27.090Z] 10:34:27     INFO -     #48 0x7ffcaf102650  (C:\Windows\SYSTEM32\ntdll.dll+0x180052650)
[task 2022-07-29T10:34:27.090Z] 10:34:27     INFO - Thread T3 created by T0 here:
[task 2022-07-29T10:34:27.091Z] 10:34:27     INFO -     #0 0x7ffc81cdaf62 in __asan_wrap_CreateThread /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_win.cpp:146
[task 2022-07-29T10:34:27.092Z] 10:34:27     INFO -     #1 0x7ffcac7e1896  (C:\Windows\System32\ucrtbase.dll+0x180021896)
[task 2022-07-29T10:34:27.093Z] 10:34:27     INFO -     #2 0x7ffc874b186d in _PR_MD_CREATE_THREAD /builds/worker/checkouts/gecko/nsprpub/pr/src/md/windows/w95thred.c:153
[task 2022-07-29T10:34:27.094Z] 10:34:27     INFO -     #3 0x7ffc874da46a in _PR_NativeCreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:1058
[task 2022-07-29T10:34:27.095Z] 10:34:27     INFO -     #4 0x7ffc874dac03 in _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:1184
[task 2022-07-29T10:34:27.096Z] 10:34:27     INFO -     #5 0x7ffc874d0aff in PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:1404
[task 2022-07-29T10:34:27.096Z] 10:34:27     INFO -     #6 0x7ffc631da311 in nsThread::Init(class nsTSubstring<char> const &) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:618
[task 2022-07-29T10:34:27.097Z] 10:34:27     INFO -     #7 0x7ffc631ecec8 in nsThreadManager::NewNamedThread(class nsTSubstring<char> const &, unsigned int, class nsIThread **) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadManager.cpp:533
[task 2022-07-29T10:34:27.099Z] 10:34:27     INFO -     #8 0x7ffc631f9d1c in NS_NewNamedThread(class nsTSubstring<char> const &, class nsIThread **, struct already_AddRefed<class nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:161
[task 2022-07-29T10:34:27.099Z] 10:34:27     INFO -     #9 0x7ffc65759fec in NS_NewNamedThread /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:74
[task 2022-07-29T10:34:27.100Z] 10:34:27     INFO -     #10 0x7ffc65759fec in mozilla::layers::CompositorThreadHolder::CreateCompositorThread(void) /builds/worker/checkouts/gecko/gfx/layers/ipc/CompositorThread.cpp:66
[task 2022-07-29T10:34:27.100Z] 10:34:27     INFO -     #11 0x7ffc6575a360 in mozilla::layers::CompositorThreadHolder::CompositorThreadHolder /builds/worker/checkouts/gecko/gfx/layers/ipc/CompositorThread.cpp:40
[task 2022-07-29T10:34:27.101Z] 10:34:27     INFO -     #12 0x7ffc6575a360 in mozilla::layers::CompositorThreadHolder::Start(void) /builds/worker/checkouts/gecko/gfx/layers/ipc/CompositorThread.cpp:109
[task 2022-07-29T10:34:27.102Z] 10:34:27     INFO -     #13 0x7ffc65b32514 in mozilla::gfx::GPUParent::Init(unsigned long, char const *, class mozilla::ipc::ScopedPort) /builds/worker/checkouts/gecko/gfx/ipc/GPUParent.cpp:198
[task 2022-07-29T10:34:27.102Z] 10:34:27     INFO -     #14 0x7ffc65b4bfb5 in mozilla::gfx::GPUProcessImpl::Init(int, char **const) /builds/worker/checkouts/gecko/gfx/ipc/GPUProcessImpl.cpp:45
[task 2022-07-29T10:34:27.103Z] 10:34:27     INFO -     #15 0x7ffc7128d849 in XRE_InitChildProcess(int, char **const, struct XREChildData const *) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:712
[task 2022-07-29T10:34:27.105Z] 10:34:27     INFO -     #16 0x7ff7e7702c5e in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:58
[task 2022-07-29T10:34:27.105Z] 10:34:27     INFO -     #17 0x7ff7e7702c5e in NS_internal_main(int, char **, char **) /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:346
[task 2022-07-29T10:34:27.106Z] 10:34:27     INFO -     #18 0x7ff7e77017bf in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:167
[task 2022-07-29T10:34:27.108Z] 10:34:27     INFO -     #19 0x7ff7e77fcfa7 in invoke_main d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:90
[task 2022-07-29T10:34:27.108Z] 10:34:27     INFO -     #20 0x7ff7e77fcfa7 in __scrt_common_main_seh d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
[task 2022-07-29T10:34:27.109Z] 10:34:27     INFO -     #21 0x7ffcad467033  (C:\Windows\System32\KERNEL32.DLL+0x180017033)
[task 2022-07-29T10:34:27.109Z] 10:34:27     INFO -     #22 0x7ffcaf102650  (C:\Windows\SYSTEM32\ntdll.dll+0x180052650)
[task 2022-07-29T10:34:27.112Z] 10:34:27     INFO - SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:66 in RefPtr<mozilla::layers::CompositorThreadHolder>::assign_assuming_AddRef
[task 2022-07-29T10:34:27.113Z] 10:34:27     INFO - Shadow bytes around the buggy address:
[task 2022-07-29T10:34:27.113Z] 10:34:27     INFO -   0x042ebeee45a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2022-07-29T10:34:27.114Z] 10:34:27     INFO -   0x042ebeee45b0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
[task 2022-07-29T10:34:27.115Z] 10:34:27     INFO -   0x042ebeee45c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
[task 2022-07-29T10:34:27.116Z] 10:34:27     INFO -   0x042ebeee45d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2022-07-29T10:34:27.117Z] 10:34:27     INFO -   0x042ebeee45e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
[task 2022-07-29T10:34:27.118Z] 10:34:27     INFO - =>0x042ebeee45f0: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fa fa fa
[task 2022-07-29T10:34:27.119Z] 10:34:27     INFO -   0x042ebeee4600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2022-07-29T10:34:27.120Z] 10:34:27     INFO -   0x042ebeee4610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2022-07-29T10:34:27.120Z] 10:34:27     INFO -   0x042ebeee4620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2022-07-29T10:34:27.121Z] 10:34:27     INFO -   0x042ebeee4630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2022-07-29T10:34:27.121Z] 10:34:27     INFO -   0x042ebeee4640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
[task 2022-07-29T10:34:27.122Z] 10:34:27     INFO - Shadow byte legend (one shadow byte represents 8 application bytes):
[task 2022-07-29T10:34:27.122Z] 10:34:27     INFO -   Addressable:           00
[task 2022-07-29T10:34:27.123Z] 10:34:27     INFO -   Partially addressable: 01 02 03 04 05 06 07
[task 2022-07-29T10:34:27.123Z] 10:34:27     INFO -   Heap left redzone:       fa
[task 2022-07-29T10:34:27.124Z] 10:34:27     INFO -   Freed heap region:       fd
[task 2022-07-29T10:34:27.124Z] 10:34:27     INFO -   Stack left redzone:      f1
[task 2022-07-29T10:34:27.126Z] 10:34:27     INFO -   Stack mid redzone:       f2
[task 2022-07-29T10:34:27.126Z] 10:34:27     INFO -   Stack right redzone:     f3
[task 2022-07-29T10:34:27.127Z] 10:34:27     INFO -   Stack after return:      f5
[task 2022-07-29T10:34:27.127Z] 10:34:27     INFO -   Stack use after scope:   f8
[task 2022-07-29T10:34:27.127Z] 10:34:27     INFO -   Global redzone:          f9
[task 2022-07-29T10:34:27.129Z] 10:34:27     INFO -   Global init order:       f6
[task 2022-07-29T10:34:27.129Z] 10:34:27     INFO -   Poisoned by user:        f7
[task 2022-07-29T10:34:27.129Z] 10:34:27     INFO -   Container overflow:      fc
[task 2022-07-29T10:34:27.131Z] 10:34:27     INFO -   Array cookie:            ac
[task 2022-07-29T10:34:27.131Z] 10:34:27     INFO -   Intra object redzone:    bb
[task 2022-07-29T10:34:27.131Z] 10:34:27     INFO -   ASan internal:           fe
[task 2022-07-29T10:34:27.131Z] 10:34:27     INFO -   Left alloca redzone:     ca
[task 2022-07-29T10:34:27.133Z] 10:34:27     INFO -   Right alloca redzone:    cb
[task 2022-07-29T10:34:27.134Z] 10:34:27     INFO - ==1304==ABORTING
[task 2022-07-29T10:34:27.977Z] 10:34:27     INFO - REFTEST INFO | Process mode: e10s
[task 2022-07-29T10:34:27.977Z] 10:34:27  WARNING - leakcheck | refcount logging is off, so leaks can't be detected!
[task 2022-07-29T10:34:27.978Z] 10:34:27     INFO - REFTEST INFO | Running tests in file:///Z:/task_165908737780271/build/tests/reftest/tests/layout/reftests/font-matching/reftest.list
[task 2022-07-29T10:34:28.187Z] 10:34:28     INFO - REFTEST INFO | Running with e10s: True
[task 2022-07-29T10:34:28.187Z] 10:34:28     INFO - REFTEST INFO | Running with fission: True
[task 2022-07-29T10:34:28.188Z] 10:34:28     INFO - REFTEST INFO | INFO | runtests.py | ASan using symbolizer at Z:\task_165908737780271\build\application\firefox\llvm-symbolizer.exe
[task 2022-07-29T10:34:28.283Z] 10:34:28     INFO - REFTEST INFO | Failed determine available memory, disabling ASan low-memory configuration
[task 2022-07-29T10:34:28.284Z] 10:34:28     INFO - REFTEST INFO | Application command: Z:\task_165908737780271\build\application\firefox\firefox.exe -marionette --wait-for-browser -profile C:\Users\task_165908737780271\AppData\Local\Temp\tmp4fv0wzil.mozrunner
[task 2022-07-29T10:34:30.505Z] 10:34:30     INFO - 1659090870504	Marionette	INFO	Marionette enabled
[task 2022-07-29T10:34:30.515Z] 10:34:30     INFO - 1659090870514	Marionette	TRACE	Received observer notification final-ui-startup
[task 2022-07-29T10:34:30.522Z] 10:34:30     INFO - 1659090870522	Marionette	INFO	Listening on port 2828
[task 2022-07-29T10:34:30.523Z] 10:34:30     INFO - 1659090870522	Marionette	DEBUG	Marionette is listening
[task 2022-07-29T10:34:30.989Z] 10:34:30     INFO - 1659090870990	Marionette	DEBUG	Accepted connection 0 from 127.0.0.1:50709
[task 2022-07-29T10:34:31.194Z] 10:34:31     INFO - 1659090871193	Marionette	DEBUG	Closed connection 0
[task 2022-07-29T10:34:31.194Z] 10:34:31     INFO - 1659090871194	Marionette	DEBUG	Accepted connection 1 from 127.0.0.1:50710
[task 2022-07-29T10:34:31.360Z] 10:34:31     INFO - 1659090871359	Marionette	DEBUG	1 -> [0,1,"WebDriver:NewSession",{"strictFileInteractability":true}]
[task 2022-07-29T10:34:31.375Z] 10:34:31     INFO - 1659090871374	Marionette	DEBUG	Waiting for initial application window
[task 2022-07-29T10:34:35.054Z] 10:34:35     INFO - console.warn: SearchSettings: "get: No settings file exists, new profile?" (new NotFoundError("Could not open the file at C:\\Users\\task_165908737780271\\AppData\\Local\\Temp\\tmp4fv0wzil.mozrunner\\search.json.mozlz4", (void 0)))
[task 2022-07-29T10:34:35.175Z] 10:34:35     INFO - [Parent 8200, IPC I/O Parent] WARNING: file /builds/worker/checkouts/gecko/ipc/chromium/src/base/process_util_win.cc:167
[task 2022-07-29T10:34:38.581Z] 10:34:38     INFO - 1659090878580	Marionette	TRACE	Received observer notification browser-idle-startup-tasks-finished
[task 2022-07-29T10:34:38.606Z] 10:34:38     INFO - 1659090878605	RemoteAgent	TRACE	[27] Document already finished loading: about:blank
[task 2022-07-29T10:34:38.648Z] 10:34:38     INFO - 1659090878645	Marionette	DEBUG	1 <- [1,1,null,{"sessionId":"65746d1c-d2b8-4c0c-b4a9-6b92d587df95","capabilities":{"browserName":"firefox","browserVersion":"105.0 ... wnTimeout":300000,"moz:useNonSpecCompliantPointerOrigin":false,"moz:webdriverClick":true,"moz:windowless":false,"proxy":{}}}]
[task 2022-07-29T10:34:38.683Z] 10:34:38     INFO - 1659090878677	Marionette	DEBUG	1 -> [0,2,"Addon:Install",{"path":"Z:\\task_165908737780271\\build\\tests\\reftest\\specialpowers","temporary":true}]
[task 2022-07-29T10:34:38.728Z] 10:34:38     INFO - 1659090878727	Marionette	DEBUG	1 <- [1,2,null,{"value":"special-powers@mozilla.org"}]
[task 2022-07-29T10:34:38.744Z] 10:34:38     INFO - 1659090878743	Marionette	DEBUG	1 -> [0,3,"Addon:Install",{"path":"Z:\\task_165908737780271\\build\\tests\\reftest\\reftest","temporary":true}]
[task 2022-07-29T10:34:38.850Z] 10:34:38     INFO - 1659090878849	Marionette	TRACE	Received observer notification domwindowopened
[task 2022-07-29T10:34:38.860Z] 10:34:38     INFO - 1659090878858	Marionette	DEBUG	1 <- [1,3,null,{"value":"reftest@mozilla.org"}]
[task 2022-07-29T10:34:38.876Z] 10:34:38     INFO - 1659090878876	Marionette	DEBUG	1 -> [0,4,"WebDriver:DeleteSession",{}]
[task 2022-07-29T10:34:38.883Z] 10:34:38     INFO - 1659090878882	Marionette	DEBUG	1 <- [1,4,null,{"value":null}]
[task 2022-07-29T10:34:38.892Z] 10:34:38     INFO - 1659090878891	Marionette	DEBUG	Closed connection 1
[task 2022-07-29T10:34:39.635Z] 10:34:39     INFO - REFTEST TEST-START | layout/reftests/font-matching/CSS21-t1502-no-inherited-font-family.xhtml == layout/reftests/font-matching/CSS21-t1502-no-inherited-font-family-ref.xhtml

Looks like an issue with VideoBridgeParent::Shutdown.

Group: core-security → media-core-security
Component: Layout → Audio/Video: Playback
Keywords: csectype-uaf
Keywords: sec-high

Not sure if this is media or graphics related, Andrew any thoughts on which side this falls on?

Flags: needinfo?(aosmond)
Blocks: gfx-triage

Is this an actionable bug? I looks like it only happened once on the Orange Factor link (a pretty generous definition of "intermittent").

Flags: needinfo?(jmathies)
Group: gfx-core-security

People have to have access to every security group in order to see a bug, so adding more is usually not a great idea. I'll remove the media one in favor of the graphics one, because that was more recent.

Group: media-core-security

I'll move it over to Graphics for consistency.

Component: Audio/Video: Playback → Graphics

It would be good if somebody familiar with VideoBridgeParent gave this a once-over in case we can fix something based on that, but after that we should just close this, given that it seems to have just happened once, months ago.

Well, this was a weird one. Jim added it to gfx-triage two months ago, but it was only in the Media security group, so I was the only one who could see it--my team could not--but...I only saw it today when we went to perform Graphics triage! I added Graphics security so my team could see it since Jim felt it was important enough to add to our triage, but I don't know that it is actually Graphics.

We'll have a look-see next week, and we'll bounce it back if not.

Sotaro, could you please have a look at this when you have some time?

Flags: needinfo?(sotaro.ikeda.g)

When the problem happened, VideoBridgeParent was released on compositor thread by PVideoBridgeParent::OnChannelClose().
But VideoBridgeParent::Shutdown() was called on RemoteDecoderManagerParent thread.

Regression seemed to be caused by Bug 1718210.

Assignee: nobody → sotaro.ikeda.g
Flags: needinfo?(sotaro.ikeda.g)
Regressed by: 1718210

Set release status flags based on info from the regressing bug 1718210

status-firefox105: --- → affected
status-firefox106: --- → affected
status-firefox107: --- → affected
status-firefox-esr102: --- → affected
Keywords: regression
Flags: needinfo?(jmathies)
Flags: needinfo?(aosmond)

Set release status flags based on info from the regressing bug 1718210

status-firefox108: --- → affected
No longer blocks: gfx-triage
Attachment #9299623 - Attachment description: WIP: Bug 1782219 - Fix VideoBridgeParent shutdown handling → Bug 1782219 - Fix VideoBridgeParent shutdown handling
Attachment #9299623 - Attachment is obsolete: true

Comment on attachment 9298562 [details]
Bug 1782219 - Protect sVideoBridgeFromProcess by StaticDataMutex

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: It is very hard.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which older supported branches are affected by this flaw?: 92
  • If not all supported branches, which bug introduced the flaw?: Bug 1718210
  • Do you have backports for the affected branches?: No
  • If not, how different, hard to create, and risky will they be?: It is easy to create and low risk.
  • How likely is this patch to cause regressions; how much testing does it need?: It is not likely to cause a regression.
  • Is Android affected?: No
Attachment #9298562 - Flags: sec-approval?

Comment on attachment 9298562 [details]
Bug 1782219 - Protect sVideoBridgeFromProcess by StaticDataMutex

Approved to land and uplift.

Attachment #9298562 - Flags: sec-approval? → sec-approval+

Protect sVideoBridgeFromProcess by StaticDataMutex r=jrmuizel
https://hg.mozilla.org/integration/autoland/rev/6a6da8ccb9aabd0d009cb397ef968c7ffc539d65
https://hg.mozilla.org/mozilla-central/rev/6a6da8ccb9aa

Group: gfx-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 1 year ago
status-firefox109: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 109 Branch

The patch landed in nightly and beta is affected.
:sotaro, is this bug important enough to require an uplift?

  • If yes, please nominate the patch for beta approval.
  • If no, please set status-firefox108 to wontfix.

For more information, please visit auto_nag documentation.

Flags: needinfo?(sotaro.ikeda.g)
status-firefox108: affected → wontfix
Flags: needinfo?(sotaro.ikeda.g)

This a sec-high and the sec-approval specifically called out uplift. Why was this marked wontfix for 108?

Flags: needinfo?(sotaro.ikeda.g)

(In reply to Ryan VanderMeulen [:RyanVM] from comment #18)

This a sec-high and the sec-approval specifically called out uplift. Why was this marked wontfix for 108?

Sorry, I am going to request uplift.

Flags: needinfo?(sotaro.ikeda.g)

Comment on attachment 9298562 [details]
Bug 1782219 - Protect sVideoBridgeFromProcess by StaticDataMutex

Beta/Release Uplift Approval Request

  • User impact if declined: Crash might happen during shutdown.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: No
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: none
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): The change is not risky. It just add a protection by using a mutex.
  • String changes made/needed: none
  • Is Android affected?: No
Attachment #9298562 - Flags: approval-mozilla-beta?

Comment on attachment 9298562 [details]
Bug 1782219 - Protect sVideoBridgeFromProcess by StaticDataMutex

Approved for 108.0b5

Attachment #9298562 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9298562 - Flags: approval-mozilla-esr102?

Comment on attachment 9298562 [details]
Bug 1782219 - Protect sVideoBridgeFromProcess by StaticDataMutex

Please attach a rebased patch for ESR102 when you get a chance.

Flags: needinfo?(sotaro.ikeda.g)
Attachment #9298562 - Flags: approval-mozilla-esr102?
Flags: needinfo?(sotaro.ikeda.g)

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)

Flags: qe-verify-
Whiteboard: [post-critsmash-triage]

Unsure if this shows back up in your list without an explicit approval-mozilla-esr102, so adding a needinfo... :-)

Flags: needinfo?(ryanvm)
Flags: needinfo?(ryanvm)
Attachment #9305044 - Flags: approval-mozilla-esr102?

Comment on attachment 9305044 [details]
Bug 1782219 - patch of D121045 for ESR102

Approved for 102.6esr

Attachment #9305044 - Flags: approval-mozilla-esr102? → approval-mozilla-esr102+
Whiteboard: [post-critsmash-triage] → [post-critsmash-triage][adv-main108+r]
Whiteboard: [post-critsmash-triage][adv-main108+r] → [post-critsmash-triage][adv-main108+r][adv-esr102.6+r]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: