1785050 - Hit MOZ_CRASH(nsWeakReference not thread-safe) at xpcom/base/nsISupportsImpl.cpp:43 through [@ mozilla::net::OutputStreamTunnel::~OutputStreamTunnel]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Christian Holler (:decoder)]

The attached testcase crashes on mozilla-central revision 20220814-64a12fec281c (build with (metadatabuildFlags not available)).

For detailed crash information, see attachment.

To reproduce the issue, perform the following steps:

1. Download the attached testcase, save as "test.bin".
   2a. Build with --enable-fuzzing (requires Clang and ASan, also build gtests using ./mach gtest dontruntests).
   2b. Alternatively you can download builds from TC using python -mfuzzfetch -a --fuzzing -n build --target firefox gtest (see https://github.com/MozillaSecurity/fuzzfetch).
2. Run FUZZER=NetworkHttp2ProxyHttp2 build/firefox test.bin

Marking s-s as this could potentially be a security issue (e.g. use-after-free or double-free).

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1772205

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as tracked for firefox105 (nightly). We have limited time to fix this, the soft freeze is in a day. However, the bug still isn't assigned.

:ghess, could you please find an assignee for this tracked bug? Given that it is a regression and we know the cause, we could also simply backout the regressor. If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit auto_nag documentation.

Comment 5

[Kershaw Chang [:kershaw]]

Attachment: Bug 1785050, r=#necko

Comment 6

[Dragana Damjanovic [:dragana]]

Kershaw, already has a fix for this.

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

r=necko-reviewers,dragana
https://hg.mozilla.org/integration/autoland/rev/c411e9e310525c57013267913fdffc2e457e3656
https://hg.mozilla.org/mozilla-central/rev/c411e9e31052