841916 - ABORT: IPDL error [PPluginScriptableObjectChild]: "Error deserializing 'Variant'"

Status: RESOLVED WORKSFORME

(Core Graveyard :: Plug-ins, defect, P2)

Description

[Jesse Ruderman]

Attachment: testcase (takes about a minute)

###!!! ABORT: IPDL error [PPluginScriptableObjectChild]: "Error deserializing 'Variant'". abort()ing as a result.: file PPluginScriptableObjectChild.cpp, line 1252

###!!! ASSERTION: Cannot call AnnotateCrashReport in child processes from non-main thread.: 'Error', file toolkit/crashreporter/nsExceptionHandler.cpp, line 1490


I have the "Java Plugin" shim that comes with Mac OS X 10.8, but not Java.  So the plugin is just trying to draw a "Missing Java" thing, repeatedly.

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Benjamin Smedberg]

Probably the same as bug 839750, but this has a testcase.

Comment 3

[Georg Fritzsche [:gfritzsche]]

(In reply to Jesse Ruderman from comment #0)
> Created attachment 714597 [details]
> testcase (takes about a minute)

Did you use any specific build config?
It's been running here for >15 minutes without incidents, so there must be timing or functional differences.

Comment 4

[Jesse Ruderman]

I can reproduce using an empty profile and the build from https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-central-macosx64-debug/1361281414/

Comment 5

[Jesse Ruderman]

Attachment: extra-evil testcase (takes about a minute)

I can reproduce with this one in a non-optimized, local debug build.

Comment 6

[Georg Fritzsche [:gfritzsche]]

Weird, with both opt & non-opt debug build i'm only sometimes/intermittently hitting bug 841914:

###!!! [Parent][AsyncChannel] Error: Route error: message sent to unknown actor ID
###!!! [Parent][RPCChannel] Error: Route error: message sent to unknown actor ID
###!!! ASSERTION: Bad type!: 'actor->Type() == Proxy', file /Users/georg/moz/mozilla-central-2/dom/plugins/ipc/PluginScriptableObjectChild.cpp, line 63

Comment 7

[Georg Fritzsche [:gfritzsche]]

Ok, i actually hit this once now on the non-opt debug build, but it's far from reproducible for me :(

Comment 8

[Jesse Ruderman]

If you want to fix bug 841914 first, that's ok with me :)

Comment 9

[Al Billings [:abillings - ex-MoCo]]

Georg, can you suggest a security rating here?

Comment 10

[Georg Fritzsche [:gfritzsche]]

(In reply to Al Billings [:abillings] from comment #9)
> Georg, can you suggest a security rating here?

Going over the severity rating description in the wiki i'd think sec-low to sec-moderate:
Apparently a Java bug leading to a bad state in the plugin-container which should be rather hard to use in a controlled exploit.

But i am familiar with the security approaches here, so please take that with a grain of salt.

Comment 11

[Al Billings [:abillings - ex-MoCo]]

I will call it a "sec-moderate" as it doesn't seem like a low but I could be wrong.

Comment 12

[Georg Fritzsche [:gfritzsche]]

(In reply to Georg Fritzsche [:gfritzsche] from comment #7)
> Ok, i actually hit this once now on the non-opt debug build, but it's far
> from reproducible for me :(

This is weird: While the testcase still reproduces "often", it sometimes switches to the assertion from bug 841914 for multiple consecutive runs.
Trying to add tracing seems to change the timing too much and it doesn't reproduce anymore.

There is a new trace on bug 845735 though which reproduces intermittently on try; maybe this helps out here too.

Comment 13

[Georg Fritzsche [:gfritzsche]]

Jesse, as i understood it you were triggering this and bug 841914 consistently.
Would you mind re-checking if they still occur with bug 831768 having landed?

Comment 14

[Jesse Ruderman]

WFM.  (I let each testcase run for a few minutes, using a Tinderbox build built from 126563fd3ba1.)

Comment 15

[Georg Fritzsche [:gfritzsche]]

(In reply to Jesse Ruderman from comment #14)
> WFM.

Cool, thanks Jesse :)