933820 - IPC: ###!!! ABORT: actor has been |delete|d: file PRemoteOpenFileParent.cpp

Status: RESOLVED INCOMPLETE

(Core :: IPC, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: fuzzing-session

Tested with an opt/non-debug build of https://github.com/posidron/mozilla-central/commit/26121cb

Comment 1

[Josh Matthews [:jdm]]

When was the field changed? During the write of the outgoing message to the child (Send__delete__), or the read of the incoming message from the child (PRemoteOpenFileConstructor)?

Comment 2

[Christoph Diehl [:posidron]]

from the child, I am right now only fuzzing if the condition of XRE_GetProcessType() == GeckoProcessType_Content is true.

Comment 3

[Josh Matthews [:jdm]]

So the message is being modified as it leaves the child; ie. the actor ID being passed in the constructor is modified?

Comment 4

[Christoph Diehl [:posidron]]

Field: [unsigned long long] of value: 0 -> changed to: 0
Field: [int] of value: -7 -> changed to: 1

If one of these is the actor ID, then yes.

I currently have no possibility to know which kind of field of a message got modified, if you can explain me how to do that in GDB, let me know and I will attach this kind of information in upcoming bug reports.

PS: GDB mostly hangs forever when doing a "bt full" that's why the information is cut off at the end.

Comment 5

[Andrei Purice]

Marking this issue as Resolved > Incomplete since the reporter cannot be contacted further to provide an answer if the issue is still occurring.
Please feel free to re-open or file a new bug if anyone is still encountering this issue.