#1028581 Crash of plugin container

Package:
firefox
Source:
firefox
Description:
Mozilla Firefox web browser
Submitter:
Jörg Sommer
Date:
2023-01-13 07:57:04 UTC
Severity:
normal
#1028581#5
Date:
2023-01-13 07:36:30 UTC
From:
To:
Hi,

I had a crash of the plugin container.

```text
           PID: 137826 (MainThread)
           UID: 1000 (joerg)
           GID: 1000 (joerg)
        Signal: 11 (SEGV)
     Timestamp: Fri 2023-01-13 08:24:01 CET (2min 33s ago)
  Command Line: /usr/lib/firefox/plugin-container /home/joerg/.mozilla/firefox/uiekjjuw.drm/gmp-widevinecdm/4.10.2557.0 {bb029f44-4277-46bf-94f4-88897ea89088} 129940 true gmplugin
    Executable: /usr/lib/firefox/plugin-container
 Control Group: /user.slice/user-1000.slice/user@1000.service/app.slice/ff-drm.service
          Unit: user@1000.service
     User Unit: ff-drm.service
         Slice: user-1000.slice
     Owner UID: 1000 (joerg)
       Boot ID: 4eb1e5e658834c91b62be64e2911c882
    Machine ID: 523cb54753234ed08c13ec497d0d3b64
      Hostname: zenbook
       Storage: /var/lib/systemd/coredump/core.MainThread.1000.4eb1e5e658834c91b62be64e2911c882.137826.1673594641000000.zst (present)
  Size on Disk: 1.2M
       Message: Process 137826 (MainThread) of user 1000 dumped core.

                Module libsystemd.so.0 from deb systemd-252.4-1.amd64
                Stack trace of thread 137826:
                #0  0x00007feff2c1f743 _ZN7mozilla21SetMediaPluginSandboxEPKc (libmozsandbox.so + 0x1c743)
                #1  0x00007fefec68ee88 n/a (libxul.so + 0x2c8ee88)
                #2  0x00007fefec692568 n/a (libxul.so + 0x2c92568)
                #3  0x00007fefec6d2084 n/a (libxul.so + 0x2cd2084)
                #4  0x00007fefead713de n/a (libxul.so + 0x13713de)
                #5  0x00007fefead78890 n/a (libxul.so + 0x1378890)
                #6  0x00007fefead7915e n/a (libxul.so + 0x137915e)
                #7  0x00007fefead79252 n/a (libxul.so + 0x1379252)
                #8  0x00007fefead2552d n/a (libxul.so + 0x132552d)
                #9  0x00007fefead2ca00 n/a (libxul.so + 0x132ca00)
                #10 0x00007fefead25a72 n/a (libxul.so + 0x1325a72)
                #11 0x00007fefead24f3e n/a (libxul.so + 0x1324f3e)
                #12 0x00007fefee47f702 n/a (libxul.so + 0x4a7f702)
                #13 0x00005643b7ed98a6 n/a (plugin-container + 0xf8a6)
                #14 0x00005643b7ed9463 n/a (plugin-container + 0xf463)
                #15 0x00007fefe984618a __libc_start_call_main (libc.so.6 + 0x2718a)
                #16 0x00007fefe9846245 __libc_start_main_impl (libc.so.6 + 0x27245)
                #17 0x00005643b7ed9791 _start (plugin-container + 0xf791)

                Stack trace of thread 137829:
                #0  0x00007fefe9927cb6 epoll_wait (libc.so.6 + 0x108cb6)
                #1  0x00007fefe8032814 n/a (libevent-2.1.so.7 + 0x2b814)
                #2  0x00007fefe80288a1 event_base_loop (libevent-2.1.so.7 + 0x218a1)
                #3  0x00007fefead258d1 n/a (libxul.so + 0x13258d1)
                #4  0x00007fefead24f3e n/a (libxul.so + 0x1324f3e)
                #5  0x00007fefead37531 n/a (libxul.so + 0x1337531)
                #6  0x00007fefead2106a n/a (libxul.so + 0x132106a)
                #7  0x00005643b7f53c2d _Z30set_alt_signal_stack_and_startP19PthreadCreateParams (plugin-container + 0x89c2d)
                #8  0x00007fefe98a7fd4 start_thread (libc.so.6 + 0x88fd4)
                #9  0x00007fefe992866c __clone3 (libc.so.6 + 0x10966c)
                ELF object binary architecture: AMD x86-64

[New LWP 137826]
[New LWP 137829]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/lib/firefox/plugin-container /home/joerg/.mozilla/firefox/uiekjjuw.drm/gmp'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007feff2c1f743 in mozilla::SetMediaPluginSandbox (aFilePath=aFilePath@entry=0x7fefe6c9e488 "/home/joerg/.mozilla/firefox/uiekjjuw.drm/gmp-widevinecdm/4.10.2557.0/libwidevinecdm.so") at ./security/sandbox/linux/Sandbox.cpp:667
667	./security/sandbox/linux/Sandbox.cpp: Inappropriate ioctl for device.
[Current thread is 1 (Thread 0x7fefe6e9b5c0 (LWP 137826))]
#0  0x00007feff2c1f743 in mozilla::SetMediaPluginSandbox(char const*) (aFilePath=aFilePath@entry=0x7fefe6c9e488 "/home/joerg/.mozilla/firefox/uiekjjuw.drm/gmp-widevinecdm/4.10.2557.0/libwidevinecdm.so") at ./security/sandbox/linux/Sandbox.cpp:667
        plugin = {mPath = "/home/joerg/.mozilla/firefox/uiekjjuw.drm/gmp-widevinecdm/4.10.2557.0/libwidevinecdm.so", mMaybeFd = {<mozilla::detail::AtomicBaseIncDec<int, (mozilla::MemoryOrdering)2>> = {<mozilla::detail::AtomicBase<int, (mozilla::MemoryOrdering)2>> = {mValue = std::atomic<int> = { -1 }}, <No data fields>}, <No data fields>}, mDup = false, mExpectError = true}
        files = <optimized out>
#1  0x00007fefec68ee88 in mozilla::gmp::(anonymous namespace)::LinuxSandboxStarter::Start (aLibPath=0x7fefe6c9e488 "/home/joerg/.mozilla/firefox/uiekjjuw.drm/gmp-widevinecdm/4.10.2557.0/libwidevinecdm.so", this=<optimized out>) at ./dom/media/gmp/GMPLoader.cpp:168
        libSpec = {type = 3872391192, value = {pathname = 0x7fefe6d00000 "", mac_named_fragment = {fsspec = 0x7fefe6d00000, name = 0x7fefe6c00000 ""}, mac_indexed_fragment = {fsspec = 0x7fefe6d00000, index = 3871342592}, pathname_u = 0x7fefe6d00000}}
        lib = <optimized out>
#2  mozilla::gmp::GMPLoader::Load(char const*, unsigned int, GMPPlatformAPI const*, mozilla::gmp::GMPAdapter*) (this=0x7fefe6c497f0, aUTF8LibPath=0x7fefe6c9e488 "/home/joerg/.mozilla/firefox/uiekjjuw.drm/gmp-widevinecdm/4.10.2557.0/libwidevinecdm.so", aUTF8LibPathLen=<optimized out>, aPlatformAPI=aPlatformAPI@entry=0x7fefe6c467c0, aAdapter=0x7fefe6c41660) at ./dom/media/gmp/GMPLoader.cpp:84
        libSpec = {type = 3872391192, value = {pathname = 0x7fefe6d00000 "", mac_named_fragment = {fsspec = 0x7fefe6d00000, name = 0x7fefe6c00000 ""}, mac_indexed_fragment = {fsspec = 0x7fefe6d00000, index = 3871342592}, pathname_u = 0x7fefe6d00000}}
        lib = <optimized out>
#3  0x00007fefec692568 in mozilla::gmp::GMPChild::RecvStartPlugin(nsTString<char16_t> const&) (this=this@entry=0x7fefe6c94420, aAdapter=...) at ./dom/media/gmp/GMPChild.cpp:553
        __FUNCTION__ = "RecvStartPlugin"
        libPath = {<nsTSubstring<char>> = {<mozilla::detail::nsTStringRepr<char>> = {static kMaxCapacity = <optimized out>, mData = 0x7fefe6c9e488 "/home/joerg/.mozilla/firefox/uiekjjuw.drm/gmp-widevinecdm/4.10.2557.0/libwidevinecdm.so", mLength = {static kMax = 2147483646, mLength = 87}, mDataFlags = 5, mClassFlags = mozilla::detail::StringClassFlags::NULL_TERMINATED}, <No data fields>}, <No data fields>}
        __func__ = "RecvStartPlugin"
        platformAPI = <optimized out>
        adapter = <optimized out>
#4  0x00007fefec6d2084 in mozilla::gmp::PGMPChild::OnMessageReceived(IPC::Message const&, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >&) (this=0x7fefe6c94420, msg__=<optimized out>, reply__=...) at ./build-browser/ipc/ipdl/PGMPChild.cpp:779
        adapter = {<nsTSubstring<char16_t>> = {<mozilla::detail::nsTStringRepr<char16_t>> = {static kMaxCapacity = <optimized out>, mData = 0x7fefe6c417e8 u"chromium", mLength = {static kMax = 1073741822, mLength = 8}, mDataFlags = 5, mClassFlags = mozilla::detail::StringClassFlags::NULL_TERMINATED}, <No data fields>}, <No data fields>}
        raiiObject761 = {mProfilingStack = 0x7fefe6c76078}
        reader__ = {message_ = @0x7fefe6c9ec00, iter_ = {iter_ = {mSegment = 0, mData = 0x7fefe6c4b858 "", mDataEnd = 0x7fefe6c4b858 "", mAbsoluteOffset = 56}}, actor_ = 0x7fefe6c94420}
        id__ = 2147483647
        writer__ = {message_ = <optimized out>, actor_ = <optimized out>}
        route__ = <optimized out>
#5  0x00007fefead713de in mozilla::ipc::MessageChannel::DispatchSyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >&) (this=0x7fefe6c94498, aProxy=0x7fefe6c414e0, aMsg=..., aReply=...) at ./ipc/glue/MessageChannel.cpp:1723
        blocked = {mVar = @0x7feff2a8e2b0, mPrev = 0x0, mNew = 0x7fefe6c94498}
        start = {mValue = 21941320244234}
        nestedLevel = <optimized out>
        dummy = 0x7fefe6c94498
        blockingVar = @0x7feff2a8e2b0: 0x7fefe6c94498
        rv = <optimized out>
        latencyMs = <optimized out>
#6  0x00007fefead78890 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) (this=0x7fefe6c94498, aProxy=0x7fefe6c414e0, aMsg=...) at ./ipc/glue/MessageChannel.cpp:1679
        unlock = {mMonitor = 0x7fefe6c6da50}
        setOnCxxStack = {mVar = @0x7fefe6c94530, mPrev = false, mNew = true}
        transaction = {mChan = 0x7fefe6c94498, mActive = true, mOutgoing = false, mNestedLevel = 2, mSeqno = 3, mTransaction = 3, mNext = 0x0, mReply = {mTuple = {<mozilla::detail::CompactPairHelper<IPC::Message*, mozilla::DefaultDelete<IPC::Message>, (mozilla::detail::StorageType)1, (mozilla::detail::StorageType)0>> = {<mozilla::DefaultDelete<IPC::Message>> = {<No data fields>}, mFirstA = 0x0}, <No data fields>}}}
        id = 3
        nojsapi = {<mozilla::detail::MaybeStorage<mozilla::dom::AutoNoJSAPI, false>> = {<mozilla::detail::MaybeStorageBase<mozilla::dom::AutoNoJSAPI, false>> = {mStorage = {val = {<mozilla::dom::ScriptSettingsStackEntry> = {mGlobalObject = {<nsCOMPtr_base> = {mRawPtr = 0x1}, <No data fields>}, mType = 3085833135, mOlder = 0x7fefe6c9ef80}, <JSAutoNullableRealm> = {cx_ = 0x9e, oldRealm_ = 0x7fefe6d00018}, mCx = 0x7fefe6d00000, mExecutionYield = {mExecutionGrantingManager = {mRawPtr = 0x7fefe6c00000}}}}}, mIsSome = 0 '\000'}, <mozilla::detail::Maybe_CopyMove_Enabler<mozilla::dom::AutoNoJSAPI, false, true, true>> = {<No data fields>}, <No data fields>}
        reply = {mTuple = {<mozilla::detail::CompactPairHelper<IPC::Message*, mozilla::DefaultDelete<IPC::Message>, (mozilla::detail::StorageType)1, (mozilla::detail::StorageType)0>> = {<mozilla::DefaultDelete<IPC::Message>> = {<No data fields>}, mFirstA = 0x0}, <No data fields>}}
#7  0x00007fefead7915e in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) (aTask=..., aProxy=0x7fefe6c414e0, this=0x7fefe6c94498) at ./ipc/glue/MessageChannel.cpp:1481
        msg = @0x7fefe6c6d338: {mTuple = {<mozilla::detail::CompactPairHelper<IPC::Message*, mozilla::DefaultDelete<IPC::Message>, (mozilla::detail::StorageType)1, (mozilla::detail::StorageType)0>> = {<mozilla::DefaultDelete<IPC::Message>> = {<No data fields>}, mFirstA = 0x0}, <No data fields>}}
#8  mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) (this=0x7fefe6c94498, aProxy=0x7fefe6c414e0, aTask=...) at ./ipc/glue/MessageChannel.cpp:1442
        msg = @0x7fefe6c6d338: {mTuple = {<mozilla::detail::CompactPairHelper<IPC::Message*, mozilla::DefaultDelete<IPC::Message>, (mozilla::detail::StorageType)1, (mozilla::detail::StorageType)0>> = {<mozilla::DefaultDelete<IPC::Message>> = {<No data fields>}, mFirstA = 0x0}, <No data fields>}}
#9  0x00007fefead79252 in mozilla::ipc::MessageChannel::MessageTask::Run() (this=0x7fefe6c6d2e0) at ./build-browser/dist/include/mozilla/ipc/MessageChannel.h:545
        proxy = {mRawPtr = 0x7fefe6c414e0}
        lock = {mMonitor = <optimized out>}
#10 0x00007fefead2552d in MessageLoop::RunTask(already_AddRefed<nsIRunnable>) (this=this@entry=0x7fff693beeb0, aTask=...) at ./ipc/chromium/src/base/message_loop.cc:504
        log = {mWillRunAgain = false}
#11 0x00007fefead2ca00 in MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&) (pending_task=..., this=0x7fff693beeb0) at ./build-browser/dist/include/mozilla/AlreadyAddRefed.h:52
        pending_task = {task = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}, delayed_run_time = {ticks_ = 0}, sequence_num = 0, nestable = true}
#12 MessageLoop::DoWork() (this=0x7fff693beeb0) at ./ipc/chromium/src/base/message_loop.cc:588
        pending_task = {task = {<nsCOMPtr_base> = {mRawPtr = 0x0}, <No data fields>}, delayed_run_time = {ticks_ = 0}, sequence_num = 0, nestable = true}
#13 0x00007fefead25a72 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) (this=0x7fefe6c03160, delegate=0x7fff693beeb0) at ./ipc/chromium/src/base/message_pump_default.cc:36
        did_work = <optimized out>
        raiiObject23 = {mProfilingStack = 0x7fefe6c76078}
        loop = <optimized out>
        hangMonitor = {mThread = {mRawPtr = 0x0}, static kNoTimeout = 0}
#14 0x00007fefead24f3e in MessageLoop::RunInternal() (this=0x7fff693beeb0) at ./build-browser/dist/include/mozilla/RefPtr.h:280
        save_state = {<MessageLoop::RunState> = {run_depth = 1, quit_received = false}, loop_ = 0x7fff693beeb0, previous_state_ = 0x0}
#15 MessageLoop::RunHandler() (this=0x7fff693beeb0) at ./ipc/chromium/src/base/message_loop.cc:374
        save_state = {<MessageLoop::RunState> = {run_depth = 1, quit_received = false}, loop_ = 0x7fff693beeb0, previous_state_ = 0x0}
#16 MessageLoop::Run() (this=this@entry=0x7fff693beeb0) at ./ipc/chromium/src/base/message_loop.cc:356
        save_state = {<MessageLoop::RunState> = {run_depth = 1, quit_received = false}, loop_ = 0x7fff693beeb0, previous_state_ = 0x0}
#17 0x00007fefee47f702 in XRE_InitChildProcess(int, char**, XREChildData const*) (aArgc=2, aArgv=0x7fff693bf258, aChildData=<optimized out>) at ./toolkit/xre/nsEmbedFunctions.cpp:743
        process = {mTuple = {<mozilla::detail::CompactPairHelper<mozilla::ipc::ProcessChild*, mozilla::DefaultDelete<mozilla::ipc::ProcessChild>, (mozilla::detail::StorageType)1, (mozilla::detail::StorageType)0>> = {<mozilla::DefaultDelete<mozilla::ipc::ProcessChild>> = {<No data fields>}, mFirstA = 0x7fefe6c943f0}, <No data fields>}}
        uiMessageLoop = {<base::MessagePump::Delegate> = {_vptr.Delegate = 0x7feff25ae698 <vtable for MessageLoop+16>}, type_ = MessageLoop::TYPE_DEFAULT, id_ = 1, work_queue_ = std::queue wrapping: std::deque with 0 elements, delayed_work_queue_ = std::priority_queue wrapping: std::vector of length 0, capacity 0, deferred_non_nestable_work_queue_ = std::queue wrapping: std::deque with 0 elements, pump_ = {mRawPtr = 0x7fefe6c03160}, destruction_observers_ = {observers_ = std::vector of length 1, capacity 1 = {0x7fefe6c6dc98}, notify_depth_ = 0, type_ = base::ObserverList<MessageLoop::DestructionObserver, false>::NOTIFY_ALL}, nestable_tasks_allowed_ = false, exception_restoration_ = false, thread_name_ = "", incoming_queue_ = std::queue wrapping: std::deque with 0 elements, incoming_queue_lock_ = {<mozilla::OffTheBooksMutex> = {<mozilla::detail::MutexImpl> = {platformData_ = {0x0, 0x0, 0x3, 0x0, 0x0}}, <mozilla::BlockingResourceBase> = {static kResourceTypeName = <optimized out>}, <No data fields>}, <No data fields>}, state_ = 0x7fff693bedb0, run_depth_base_ = 1, shutting_down_ = false, transient_hang_timeout_ = 0, permanent_hang_timeout_ = 0, next_sequence_num_ = 0, mEventTarget = {mRawPtr = 0x7fefe6c6dc80}}
        raiiObject395 = {mProfilingStack = 0x0, static sProfilingStack = {<mozilla::detail::ThreadLocalNativeStorage<mozilla::baseprofiler::ProfilingStack*>> = {mValue = 0x0}, <No data fields>}}
        raiiObject397 = {<No data fields>}
        raiiObject398 = {mProfilingStack = 0x7fefe6c76078}
        exceptionHandlerIsSet = true
        parentPIDString = <optimized out>
        end = 0x7fff693bf6be ""
        parentPID = 129940
        messageChannelIdString = <optimized out>
        messageChannelId = {m0 = 3137511236, m1 = 17015, m2 = 18111, m3 = "\224\364\210\211~\250\220\210"}
        exitManager = {lock_ = {<mozilla::OffTheBooksMutex> = {<mozilla::detail::MutexImpl> = {platformData_ = {0x0, 0x0, 0x3, 0x0, 0x0}}, <mozilla::BlockingResourceBase> = {static kResourceTypeName = <optimized out>}, <No data fields>}, <No data fields>}, stack_ = std::stack wrapping: std::deque with 0 elements, next_manager_ = 0x0}
        rv = <optimized out>
        uiLoopType = <optimized out>
#18 0x00005643b7ed98a6 in content_process_main(mozilla::Bootstrap*, int, char**) (bootstrap=bootstrap@entry=0x7fefe6c49560, argc=5, argc@entry=6, argv=argv@entry=0x7fff693bf258) at ./ipc/app/../contentproc/plugin-container.cpp:57
        childData = {<No data fields>}
        rv = <optimized out>
#19 0x00005643b7ed9463 in main(int, char**) (argc=6, argv=0x7fff693bf258) at ./ipc/app/MozillaRuntimeMain.cpp:96
        unregisterRuntimeExceptionModule = {mExitFunction = {<No data fields>}, mExecuteOnDestruction = true}
        bootstrapResult = {mImpl = {mStorage = {static RawDataAlignment = 8, static RawDataSize = 16, rawData = {0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', 0 '\000', <optimized out>, <optimized out>, <optimized out>, <optimized out>, <optimized out>, <optimized out>, <optimized out>, <optimized out>}, tag = false}, static Strategy = <optimized out>}, static Strategy = <optimized out>}
        ret = <optimized out>
--- END ---
```

Regards, Jörg