Open Bug 963976 Opened 6 years ago Updated 6 years ago

Faulty crash: "ABORT: Inserting duplicate item" under PCompositorParent::RegisterID

Categories

(Core :: IPC, defect)

x86_64
Linux
defect
Not set

Tracking

()

People

(Reporter: bjacob, Unassigned)

References

(Depends on 1 open bug, Blocks 1 open bug)

Details

Attachments

(1 file)

Attached file Faulty session
Found by Christoph Diehl's "Faulty" fuzzer, see bug 777067
This is going to end up in IPC code I believe.
Component: Graphics → IPC
The problem is at:

#6  0x00007fffefa9ae27 in IDMap<mozilla::ipc::IProtocol>::AddWithID (this=0x7fffcd892260, data=0x7fffc9e3bb80, 
    id=-2) at /hack/mozilla-central/ipc/chromium/src/base/id_map.h:58
58          DCHECK(data_.find(id) == data_.end()) << "Inserting duplicate item";

Since this is generic IPC code that is used, in particular, in the parent process, the problem is a generic "IPC code should not crash parent process on bad pickles" similar to bug 963978.
Classification: PCompositor, generic "IPC code aborting in DEBUG builds on bad pickles" bug, easy.
This should be fixed by whatever global solution we can agree on in bug 963978
Depends on: picky-with-pickles
You need to log in before you can comment on or make changes to this bug.