781594 - ABORT: not reached: ipc/ipdl/PLayers.cpp, line 4069

Status: RESOLVED INCOMPLETE

(Core :: IPC, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: callstack

This crash occurred while launching Firefox on B2G and intercepting the pickle Write|Datatype| functions.

An interception only happened when XRE_GetProcessType() == GeckoProcessType_Content

Let me know if you need further information.

Comment 1

[Andrew Overholt [:overholt]]

Is this reproducible?

Comment 2

[Andrew Overholt [:overholt]]

Should this block?

Comment 3

[Christoph Diehl [:posidron]]

I will look at it in the next days, currently a bit busy with other projects.
But at that time the crash was reproducible.

Comment 4

[Christoph Diehl [:posidron]]

New IPDL calls have been added to B2G since the last time so the SEED is not correct anymore for this bug. 

Have tried to trigger the bug with new fuzzing runs but were not able to reproduce this particular crash.

Comment 5

[Andrew Overholt [:overholt]]

Thanks for the update, Christoph.  We can always re-nom this for B2G blocking status if the crash reappears.

Comment 6

[(no longer active)]

Is there a test case for this?

Comment 7

[Cervantes Yu [:cyu] [:cervantes]]

I can reproduce this crash in gdb by modifying mozilla::layers::Edit::mType. I think we need to call FatalError() instead of NS_RUNTIMEABORT() in mozilla::layers::Edit::MaybeDestroy().

Comment 8

[Andrei Purice]

Closing this as Resolved > Incomplete since the initial reporter can't be reach for a confirmation if the issue is still occurring and no other crashes have been reported in the last 6 months.