963976 - Faulty crash: "ABORT: Inserting duplicate item" under PCompositorParent::RegisterID

Status: NEW

(Core :: IPC, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: Faulty session

Found by Christoph Diehl's "Faulty" fuzzer, see bug 777067

Comment 1

[Ben Turner (not reading bugmail, use the needinfo flag!)]

This is going to end up in IPC code I believe.

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

The problem is at:

#6  0x00007fffefa9ae27 in IDMap<mozilla::ipc::IProtocol>::AddWithID (this=0x7fffcd892260, data=0x7fffc9e3bb80, 
    id=-2) at /hack/mozilla-central/ipc/chromium/src/base/id_map.h:58
58          DCHECK(data_.find(id) == data_.end()) << "Inserting duplicate item";

Since this is generic IPC code that is used, in particular, in the parent process, the problem is a generic "IPC code should not crash parent process on bad pickles" similar to bug 963978.

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

Classification: PCompositor, generic "IPC code aborting in DEBUG builds on bad pickles" bug, easy.

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

This should be fixed by whatever global solution we can agree on in bug 963978