Open Bug 933820 Opened 6 years ago Updated 6 years ago

IPC: ###!!! ABORT: actor has been |delete|d: file PRemoteOpenFileParent.cpp

Categories

(Core :: IPC, defect, critical)

ARM
Gonk (Firefox OS)
defect
Not set
critical

Tracking

()

People

(Reporter: posidron, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Attachments

(1 file)

Attached file fuzzing-session
Tested with an opt/non-debug build of https://github.com/posidron/mozilla-central/commit/26121cb
When was the field changed? During the write of the outgoing message to the child (Send__delete__), or the read of the incoming message from the child (PRemoteOpenFileConstructor)?
from the child, I am right now only fuzzing if the condition of XRE_GetProcessType() == GeckoProcessType_Content is true.
So the message is being modified as it leaves the child; ie. the actor ID being passed in the constructor is modified?
Field: [unsigned long long] of value: 0 -> changed to: 0
Field: [int] of value: -7 -> changed to: 1

If one of these is the actor ID, then yes.

I currently have no possibility to know which kind of field of a message got modified, if you can explain me how to do that in GDB, let me know and I will attach this kind of information in upcoming bug reports.

PS: GDB mostly hangs forever when doing a "bt full" that's why the information is cut off at the end.
You need to log in before you can comment on or make changes to this bug.