Closed Bug 962604 Opened 6 years ago Closed 6 years ago
crash using IPDL from the wrong thread with e10s with IPDL message PJava
Script::Get (firefox nightly)
This is weird. This is the worker thread. I suspect that we're calling a method on a dead actor or on a channel that has already been deleted, in which case IPC is not the right component but we don't have a better place to put it. Is this a debug build? Poison-on-free would probably crash in a more useful spot.
> Poison-on-free would probably crash in a more useful spot. Or ASAN, though that's not available on Windows.
When we navigate to about:config, we're switching the tab to be in-process. If no other tabs are open at the time, that means that the child will get shut down. So a use-after-free makes sense. I'll audit the CPOW code to see if anything pops out. If nothing does, then we can try poisoning.
(In reply to Benjamin Smedberg [:bsmedberg] from comment #1) > Is this a debug build? Poison-on-free would probably crash in a more useful > spot. Yes, this is a debug build.
Benjamin is right. The problem is that we're sending a CPOW message after the child process has exited. The rules for IPDL is that you're not allowed to send any messages after the ActorDestroyed method is called on an actor. Once that's happened, the MessageChannel has been destroyed and any attempt to send an urgent message will use freed memory.
Assignee: nobody → wmccloskey
Status: NEW → ASSIGNED
I made the changes to FORWARD and className. For DOMInstanceOf, I realized that there's no reason it can't behave like the other normal methods. So now it gets passed a JSContext and it throws an exception if things go wrong. InstanceOf still has to act like an XPCOM method, so I left that one alone.
Comment on attachment 8370468 [details] [diff] [review] cpow-crash-fix v2 Review of attachment 8370468 [details] [diff] [review]: ----------------------------------------------------------------- Looks good, thanks.
Attachment #8370468 - Flags: review?(mrbkap) → review+
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.