843923 - ASAN: js/xpconnect/tests/unit/test_bug608142.js triggers heap-use-after-free error

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Christian Holler (:decoder)]

Attachment: ASan log

ASan Try run has detected that js/xpconnect/tests/unit/test_bug608142.js is failing under ASan. I was able to reproduce this locally with a debug build (mozilla-central 885cde564ff3) by running the following command in the objdir:

taskset -c 0 make -C js/xpconnect/tests xpcshell-tests

Without the taskset, the bug doesn't reproduce (it seems to be a thread race). I'll attach the symbolized ASan log.

Comment 1

[Andrew McCreight [:mccr8]]

That looks kind of bad.  Bug 608142 is "Disallow sending JS objects to a different thread", and in the log something in thread T8 is calling  nsXPCWrappedJS::Release() on an object that was freed on the main thread.

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Yeah this whole thing is just bad and we should make it go away.

Comment 3

[Bobby Holley (:bholley)]

yeah, I'm working on fixing bug 773610. Once we do that, we can rip out all the half-baked thread support.

Comment 4

[Doug Turner (:dougt)]

over to bobby.  Can you make sure that someone addresses this when you're done with bug 773610

Comment 5

[Christian Holler (:decoder)]

This is still happening on try: https://tbpl.mozilla.org/php/getParsedLog.php?id=23204529&tree=Try

Comment 6

[Andrew McCreight [:mccr8]]

This test is gone, I'm assuming as part of bholley's work to add runtime aborts for refcounting nsXPCWrappedJS off the main thread, so I'm going to mark this as fixed. I don't think we have any real way of backporting this, unfortunately.