Created attachment 648488 [details] callstack In this scenario the Write|Datatype|() functions of Pickle were hooked to use abnormal values. Let me know if you need further information.
I should perhaps mention that WriteBool() wasn't touched, the value comes from the outside.
We're correctly sanitizing values in the parent process --- we detect that the child has written invalid data to the pipe. However, after we detect that condition, the *parent* aborts. Instead, it should kill the child with fire.
this is a reproducible crash? Sounds similar to 780219 so, i'll minus. Please renom if you disagree.
blocking-basecamp: --- → -
Crash Signature: [@ mozalloc_abort(char const* const) | NS_DebugBreak | mozilla::Logger::~Logger()]
Summary: ABORT: file gecko/ipc/chromium/src/base/pickle.cc, line 86 → ABORT: file gecko/ipc/chromium/src/base/pickle.cc, line 86 (Pickle::ReadBool)
Is there a test case for this?
Abort in DCHECK() with a bool value. Marked as duplicate of bug 807738.
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 807738
You need to log in before you can comment on or make changes to this bug.