1813168 - Creating a WebAuthn credential can "leak the world"

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P3)

Description

[John Schanck [:jschanck]]

Creating a WebAuthn credential in a debug build and closing the window can result in WARNING: YOU ARE LEAKING THE WORLD (at least one JSRuntime and everything alive inside it, that is) AT JS_ShutDown TIME. FIX THIS! being logged to the console.

To reproduce:

• go to https://webauthn.bin.coffee
• create a credential
• close the window

FWIW, I wasn't able to reproduce on https://webauthn.io or https://demo.yubico.com. Also, this doesn't seem to be a duplicate of Bug 1540885 as the make credential request has to finish.

After following the instructions on https://firefox-source-docs.mozilla.org/performance/memory/heap_scan_mode.html, I think I tracked this down to a reference held by the PublicKeyCredential created in FinishMakeCredential. The relevant output from block_analyzer.py is below.

0x7f0dda4a6500 size = 392 bytes at byte offset 376
  mozilla::dmd::StackTrace::Get(mozilla::dmd::Thread*) (./mozilla-unified/memory/replace/dmd/DMD.cpp:664)
  mozilla::dmd::AllocCallback(void*, unsigned long, mozilla::dmd::Thread*) (./mozilla-unified/memory/replace/dmd/DMD.cpp:1025)
  replace_malloc(unsigned long) (./mozilla-unified/memory/replace/dmd/DMD.cpp:1093)
  moz_xmalloc (./mozilla-unified/memory/mozalloc/mozalloc.cpp:53)
  mozilla::dom::WebAuthnManager::FinishMakeCredential(unsigned long const&, mozilla::dom::WebAuthnMakeCredentialResult const&) (./mozilla-unified/dom/webauthn/WebAuthnManager.cpp:735)
  mozilla::dom::WebAuthnTransactionChild::RecvConfirmRegister(unsigned long const&, mozilla::dom::WebAuthnMakeCredentialResult const&) (./mozilla-unified/dom/webauthn/WebAuthnTransactionChild.cpp:36)
  mozilla::dom::PWebAuthnTransactionChild::OnMessageReceived(IPC::Message const&) (./mozilla-unified/obj-x86_64-pc-linux-gnu/ipc/ipdl/PWebAuthnTransactionChild.cpp:0)
  mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) (./mozilla-unified/obj-x86_64-pc-linux-gnu/ipc/ipdl/PBackgroundChild.cpp:6305)

0x7f0debd9dd40 size = 240 bytes at byte offset 120
  mozilla::dmd::StackTrace::Get(mozilla::dmd::Thread*) (./mozilla-unified/memory/replace/dmd/DMD.cpp:664)
  mozilla::dmd::AllocCallback(void*, unsigned long, mozilla::dmd::Thread*) (./mozilla-unified/memory/replace/dmd/DMD.cpp:1025)
  replace_malloc(unsigned long) (./mozilla-unified/memory/replace/dmd/DMD.cpp:1093)
  moz_xmalloc (./mozilla-unified/memory/mozalloc/mozalloc.cpp:53)
  bool mozilla::SegmentedVector<mozilla::JSHolderMap::Entry, (unsigned long)256, InfallibleAllocPolicy>::Append<mozilla::JSHolderMap::Entry>(mozilla::JSHolderMap::Entry&&) (./mozilla-unified/obj-x86_64-pc-linux-gnu/dist/include/mozilla/SegmentedVector.h:162)
  mozilla::JSHolderMap::Put(void*, nsScriptObjectTracer*, JS::Zone*) (./mozilla-unified/xpcom/base/CycleCollectedJSRuntime.cpp:647)
  mozilla::cyclecollector::HoldJSObjectsImpl(nsISupports*) (./mozilla-unified/xpcom/base/HoldDropJSObjects.cpp:0)
  NS_NewChildProcessMessageManager(nsISupports**) (./mozilla-unified/dom/base/nsFrameMessageManager.cpp:1599)

0x7f0dd796c400 size = 640 bytes at byte offset 608
  mozilla::dmd::StackTrace::Get(mozilla::dmd::Thread*) (./mozilla-unified/memory/replace/dmd/DMD.cpp:664)
  mozilla::dmd::AllocCallback(void*, unsigned long, mozilla::dmd::Thread*) (./mozilla-unified/memory/replace/dmd/DMD.cpp:1025)
  replace_malloc(unsigned long) (./mozilla-unified/memory/replace/dmd/DMD.cpp:1093)
  moz_xmalloc (./mozilla-unified/memory/mozalloc/mozalloc.cpp:53)
  mozilla::detail::HashTable<mozilla::HashMapEntry<void*, mozilla::JSHolderMap::Entry*>, mozilla::HashMap<void*, mozilla::JSHolderMap::Entry*, mozilla::DefaultHasher<void*, void>, InfallibleAllocPolicy>::MapHashPolicy, InfallibleAllocPolicy>::createTable(InfallibleAllocPolicy&, unsigned int, mozi
  mozilla::detail::HashTable<mozilla::HashMapEntry<void*, mozilla::JSHolderMap::Entry*>, mozilla::HashMap<void*, mozilla::JSHolderMap::Entry*, mozilla::DefaultHasher<void*, void>, InfallibleAllocPolicy>::MapHashPolicy, InfallibleAllocPolicy>::changeTableSize(unsigned int, mozilla::detail::HashTab
  mozilla::detail::HashTable<mozilla::HashMapEntry<void*, mozilla::JSHolderMap::Entry*>, mozilla::HashMap<void*, mozilla::JSHolderMap::Entry*, mozilla::DefaultHasher<void*, void>, InfallibleAllocPolicy>::MapHashPolicy, InfallibleAllocPolicy>::remove(mozilla::detail::HashTable<mozilla::HashMapEntr
  mozilla::JSHolderMap::Extract(void*) (./mozilla-unified/xpcom/base/CycleCollectedJSRuntime.cpp:603)

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1813168 - Add missing cycle collection traverse method to PublicKeyCredential. r=keeler

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/58a336fdc050
Add missing cycle collection traverse method to PublicKeyCredential. r=keeler

Comment 3

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/58a336fdc050