1823570 - Double-free crash in webrtc::videocapturemodule::VideoCaptureIos::Create()

Status: RESOLVED FIXED

(Core :: WebRTC: Audio/Video, defect, P3)

Description

[Randell Jesup [:jesup] (needinfo me)]

About 70 crashes in the last 60 months. MAY stop after 109....
Use this search for the crashes, not the signature:
https://crash-stats.mozilla.org/signature/?moz_crash_reason=~Double-free&proto_signature=%21~Imap&proto_signature=~VideoCaptureIos&signature=free%20%7C%20__CFArrayReleaseValues&date=%3E%3D2022-09-21T00%3A53%3A00.000Z&date=%3C2023-03-21T00%3A53%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_columns=startup_crash&_sort=-version&_sort=-date&page=1

Crash report: https://crash-stats.mozilla.org/report/index/631939b5-d601-480a-a1be-b57c70230106

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)

Top 10 frames of crashing thread:

0  libmozglue.dylib  free  mfbt/Assertions.h:40
1  CoreFoundation  __CFArrayReleaseValues  
2  CoreFoundation  _CFArrayReplaceValues  
3  Foundation  NSKeyValuePopPendingNotificationPerThread  
4  Foundation  NSKeyValueDidChange  
5  Foundation  NSKeyValueDidChangeWithPerThreadPendingNotifications  
6  AVFCapture  -[AVCaptureDevice_Tundra open:]  
7  AVFCapture  -[AVCaptureDeviceInput_Tundra initWithDevice:error:]  
8  AVFCapture  +[AVCaptureDeviceInput_Tundra deviceInputWithDevice:error:]  
9  XUL  -[RTCVideoCaptureIosObjC changeCaptureInputByUniqueId:]  

Comment 1

[Jim Mathies [:jimm]]

Hasn't shown up since 109, mostly showing up in old esr builds. I'd consider this lower priority and not a good use of our time at this point. Looks to be related to camera or screen capture.

Comment 2

[BugBot [:suhaib / :marco]]

The severity field for this bug is set to S3. However, the bug is flagged with the sec-high keyword.
:jib, could you consider increasing the severity of this security bug?

For more information, please visit auto_nag documentation.

Comment 3

[Jim Mathies [:jimm]]

Hey Andreas, can you poke at this and see if there's a chance we might still be vulnerable to this?

Comment 4

[Andreas Pehrson [:pehrsons]]

If the call to [AVCaptureDevice_Tundra open:] is opening the AVCaptureDevice we passed in then it is one we just got fresh from [AVCaptureDevice devicesWithMediaType:AVMediaTypeVideo]. I cannot imagine we've done something weird with it already.

I do note that this is exclusively happening on arm64.

I also see no commits on our part in 110 that would explain why it does not show up there. It seems more likely that Apple fixed something in MacOS 13.2 which was released on Jan 23. Looking at the crash rate in earlier versions of MacOS this seems plausible.

Comment 5

[Andreas Pehrson [:pehrsons]]

I will note that the MacOS 12.6.3 security release was released at the same time as 13.2, so could be reasonably expected to also have a fix. However, there is a crash reported on 12.6.3.

Comment 6

[Jim Mathies [:jimm]]

We think this might have been fixed by Apple. Crash is deep in MacOS code. Marking stalled, we'll keep monitoring it to see if it shows up. If so we'll investigate further.

Comment 7

[Andreas Pehrson [:pehrsons]]

Found the reason why this seemed to have gone away with 110 -- the inlining info on crash-stats changed the signature. There are reports on MacOS 13.2 too.

Comment 8

[Jim Mathies [:jimm]]

Still stalled. The code in question is deep in MacOS internals. No STR.

Comment 9

[Andreas Pehrson [:pehrsons]]

This was likely fixed by bug 1806604 in 114. The most recent crashes (I went back 6 months) stop with 113.