1903170 - Crash in [@ mozilla::OriginAttributesPattern::Matches] from quota::DirectoryLockImpl::Overlaps

Status: RESOLVED FIXED

(Core :: Storage: Quota Manager, defect)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/01f3341d-176c-42c5-9df5-e10460240617

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::OriginAttributesPattern::Matches const  caps/OriginAttributes.h:157
1  xul.dll  mozilla::dom::quota::DirectoryLockImpl::Overlaps const  dom/quota/DirectoryLockImpl.cpp:78
1  xul.dll  mozilla::dom::quota::DirectoryLockImpl::MustWaitFor const  dom/quota/DirectoryLockImpl.cpp:103
1  xul.dll  mozilla::dom::quota::DirectoryLockImpl::AcquireInternal  dom/quota/DirectoryLockImpl.cpp:218
2  xul.dll  xul.dll@0x108e6ee  
3  xul.dll  mozilla::dom::quota::QuotaManager::OpenStorageDirectory  dom/quota/ActorsParent.cpp:5149
4  xul.dll  mozilla::dom::quota::OpenStorageDirectoryHelper<mozilla::dom::quota::ResolvableNormalOriginOp<bool> >::OpenStorageDirectory  dom/quota/OriginOperations.cpp:882
5  xul.dll  mozilla::dom::quota::ClearDataOp::OpenDirectory  dom/quota/OriginOperations.cpp:2262
6  xul.dll  mozilla::dom::quota::NormalOriginOperationBase::Open  dom/quota/NormalOriginOperationBase.cpp:26
7  xul.dll  mozilla::dom::quota::OriginOperationBase::RunImmediately::<lambda_3>::operator const  dom/quota/OriginOperationBase.cpp:50

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-06-17
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 2 out of 3 crashes happened on null or near null memory address

Comment 1

[Andrew McCreight [:mccr8]]

3 crashes on Nightly in the last few days. One of the three is a crash on a poison value: bp-178c203c-5036-4c2f-98c3-499f20240617

Comment 2

[Jan Varga [:janv]]

Yeah, this is probably a dupe of bug 1902941.
I already added a diagnostic assertion which should reveal the root cause:
https://phabricator.services.mozilla.com/D213917

Comment 3

[Andrew McCreight [:mccr8]]

It looks like work to fix this landed in bug 1883353, and it does look like the crash has gone away, though the volume wasn't high to begin with.