Faulty abort: "bad Shmem" in PLayerTransactionParent::DeallocShmem under PLayerParent::DestroySubtree

RESOLVED FIXED in mozilla30

Status

()

RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: bjacob, Assigned: bjacob)

Tracking

(Blocks: 1 bug)

Trunk
mozilla30
x86_64
Linux
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments, 1 obsolete attachment)

Created attachment 8370786 [details]
Faulty session

Found by Christoph Diehl's "Faulty" fuzzer, see bug 777067
(Assignee)

Comment 1

5 years ago
Classification: PLayer, bad assertion, easy
(Assignee)

Comment 2

5 years ago
Created attachment 8374554 [details] [diff] [review]
Make IPDL-generated code not crash release builds on bad Shmems

This is similar to bug 968823, but this time in IPDL-generated code.
Attachment #8374554 - Flags: review?(bent.mozilla)
Hm, can we do this just for the parent process? I'd prefer to keep crashing the child.
Attachment #8374554 - Flags: review?(bent.mozilla) → review+
Comment on attachment 8374554 [details] [diff] [review]
Make IPDL-generated code not crash release builds on bad Shmems

Oops, hit the wrong button. Canceling review until I get an answer to my question above.
Attachment #8374554 - Flags: review+
(Assignee)

Comment 5

5 years ago
Created attachment 8381087 [details] [diff] [review]
Make IPDL-generated code not crash release builds on bad Shmems
Attachment #8381087 - Flags: review?(bent.mozilla)
(Assignee)

Updated

5 years ago
Attachment #8374554 - Attachment is obsolete: true
Comment on attachment 8381087 [details] [diff] [review]
Make IPDL-generated code not crash release builds on bad Shmems

Review of attachment 8381087 [details] [diff] [review]:
-----------------------------------------------------------------

The adopt looks good, shouldn't we do the same for dealloc too?
Attachment #8381087 - Flags: review?(bent.mozilla) → review+
(Assignee)

Comment 8

5 years ago
Regarding the adopt, I don't even know what it does, and this patch doesn't change it, so I'll leave it to you and other specialists :)
https://hg.mozilla.org/mozilla-central/rev/ceac6a4674d2
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.