Open Bug 933820 Opened 6 years ago Updated 6 years ago

IPC: ###!!! ABORT: actor has been |delete|d: file PRemoteOpenFileParent.cpp


(Core :: IPC, defect, critical)

Gonk (Firefox OS)
Not set




(Reporter: posidron, Unassigned)


(Blocks 1 open bug)


(Keywords: crash)


(1 file)

Attached file fuzzing-session
Tested with an opt/non-debug build of
When was the field changed? During the write of the outgoing message to the child (Send__delete__), or the read of the incoming message from the child (PRemoteOpenFileConstructor)?
from the child, I am right now only fuzzing if the condition of XRE_GetProcessType() == GeckoProcessType_Content is true.
So the message is being modified as it leaves the child; ie. the actor ID being passed in the constructor is modified?
Field: [unsigned long long] of value: 0 -> changed to: 0
Field: [int] of value: -7 -> changed to: 1

If one of these is the actor ID, then yes.

I currently have no possibility to know which kind of field of a message got modified, if you can explain me how to do that in GDB, let me know and I will attach this kind of information in upcoming bug reports.

PS: GDB mostly hangs forever when doing a "bt full" that's why the information is cut off at the end.
You need to log in before you can comment on or make changes to this bug.