ABORT: file gecko/ipc/chromium/src/base/pickle.cc, line 86 (Pickle::ReadBool)

RESOLVED DUPLICATE of bug 807738

Status

()

--
critical
RESOLVED DUPLICATE of bug 807738
6 years ago
5 years ago

People

(Reporter: posidron, Unassigned)

Tracking

(Blocks: 1 bug)

Trunk
ARM
Gonk (Firefox OS)
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(blocking-basecamp:-)

Details

(Whiteboard: crash, crash signature)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 648488 [details]
callstack

In this scenario the Write|Datatype|() functions of Pickle were hooked to use abnormal values.

Let me know if you need further information.
(Reporter)

Comment 1

6 years ago
I should perhaps mention that WriteBool() wasn't touched, the value comes from the outside.
We're correctly sanitizing values in the parent process --- we detect that the child has written invalid data to the pipe.

However, after we detect that condition, the *parent* aborts.  Instead, it should kill the child with fire.

Comment 3

6 years ago
this is a reproducible crash?  Sounds similar to 780219 so, i'll minus.  Please renom if you disagree.
blocking-basecamp: --- → -

Updated

5 years ago
Crash Signature: [@ mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::Logger::~Logger()]

Updated

5 years ago
Summary: ABORT: file gecko/ipc/chromium/src/base/pickle.cc, line 86 → ABORT: file gecko/ipc/chromium/src/base/pickle.cc, line 86 (Pickle::ReadBool)

Comment 4

5 years ago
Is there a test case for this?
Abort in DCHECK() with a bool value. Marked as duplicate of bug 807738.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 807738
You need to log in before you can comment on or make changes to this bug.