968244 - Faulty abort: "bad Shmem" in PLayerTransactionParent::DeallocShmem under PLayerParent::DestroySubtree

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: Faulty session

Found by Christoph Diehl's "Faulty" fuzzer, see bug 777067

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

Classification: PLayer, bad assertion, easy

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: Make IPDL-generated code not crash release builds on bad Shmems

This is similar to bug 968823, but this time in IPDL-generated code.

Comment 3

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Hm, can we do this just for the parent process? I'd prefer to keep crashing the child.

Comment 4

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 8374554 [details] [diff] [review]
Make IPDL-generated code not crash release builds on bad Shmems

Oops, hit the wrong button. Canceling review until I get an answer to my question above.

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: Make IPDL-generated code not crash release builds on bad Shmems

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

https://tbpl.mozilla.org/?tree=Try&rev=3d38c02c9091

Comment 7

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 8381087 [details] [diff] [review]
Make IPDL-generated code not crash release builds on bad Shmems

Review of attachment 8381087 [details] [diff] [review]:
-----------------------------------------------------------------

The adopt looks good, shouldn't we do the same for dealloc too?

Comment 8

[Benoit Jacob [:bjacob] (mostly away)]

Regarding the adopt, I don't even know what it does, and this patch doesn't change it, so I'll leave it to you and other specialists :)

Comment 9

[Benoit Jacob [:bjacob] (mostly away)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ceac6a4674d2

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ceac6a4674d2