Closed
Bug 1444588
Opened 7 years ago
Closed 7 years ago
Usage of ClearOnShutDown introduced in bug 1425462 is not safe.
Categories
(Core :: DOM: Core & HTML, defect)
Core
DOM: Core & HTML
Tracking
()
RESOLVED
FIXED
mozilla61
Tracking | Status | |
---|---|---|
firefox-esr52 | --- | unaffected |
firefox59 | --- | unaffected |
firefox60 | --- | fixed |
firefox61 | --- | fixed |
People
(Reporter: emilio, Assigned: tjr)
References
Details
(Keywords: csectype-race, sec-moderate)
Attachments
(1 file)
(deleted),
patch
|
bholley
:
review+
jcristau
:
approval-mozilla-beta+
|
Details | Diff | Splinter Review |
I just got one of these in a try run of mine:
https://treeherder.mozilla.org/logviewer.html#?job_id=167151568&repo=try&lineNumber=9952
looks related to the work done in bug 1425462... ClearOnShutdown is supposed to be main-thread only, and IIUC this can run from arbitrary threads:
https://searchfox.org/mozilla-central/rev/44fa24847e4e73ce8932de4c8cf47559302e4ba2/toolkit/components/resistfingerprinting/nsRFPService.cpp#300
Which means ClearOnShutdown can race.
Reporter | ||
Updated•7 years ago
|
Flags: needinfo?(tom)
Assignee | ||
Comment 1•7 years ago
|
||
Should be fixed in the first patch of Bug 1443943 - should land that next week; unless you think it needs a fix ASAP.
Flags: needinfo?(tom)
Reporter | ||
Comment 2•7 years ago
|
||
(In reply to Tom Ritter [:tjr] from comment #1)
> Should be fixed in the first patch of Bug 1443943 - should land that next
> week; unless you think it needs a fix ASAP.
This is causing a bunch of intermittents in browser tests, but yeah, if that lands soon I guess it's fine... One problem is, I guess that means that the race would be shipped in 60, maybe we should avoid that.
Assignee | ||
Comment 3•7 years ago
|
||
(In reply to Emilio Cobos Álvarez [:emilio] from comment #2)
> (In reply to Tom Ritter [:tjr] from comment #1)
> > Should be fixed in the first patch of Bug 1443943 - should land that next
> > week; unless you think it needs a fix ASAP.
>
> This is causing a bunch of intermittents in browser tests, but yeah, if that
> lands soon I guess it's fine... One problem is, I guess that means that the
> race would be shipped in 60, maybe we should avoid that.
There are a collection of Jitter bugs that are going to be uplifted to Beta, this is one of them.
Updated•7 years ago
|
Group: core-security → dom-core-security
Updated•7 years ago
|
Keywords: csectype-race,
sec-moderate
Comment 4•7 years ago
|
||
We're going to land the first patch in bug 1443943 separately in this bug.
Blocks: 1443943
Updated•7 years ago
|
Assignee: nobody → tom
Comment 5•7 years ago
|
||
Before, we would initialize LRUCache on the first instance of
calling the Timer Precision Reduction functions. We would both
allocate and initialize it, and call ClearOnShutdown.
ClearOnShutdown can only be called on the Main Thread, but it
just so happened that we always did that, so there was no
problem. Now that we are not calling precision reduction for
system callers, we were initializing on a non-main-thread and
we need to avoid that.
In the future, we could reduce memory use IF we are not using
the timer precision reduction functions by figuring out how
to initialize this lazily but still on the main thread. For
now, because we are using the timer precision reduction
functions, doing so would not save us any memory.
Attachment #8958524 -
Flags: review+
Comment 6•7 years ago
|
||
https://hg.mozilla.org/integration/autoland/rev/65c4485ac92180077f8054ac4c51972115733ff5
https://hg.mozilla.org/mozilla-central/rev/65c4485ac921
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox61:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Updated•7 years ago
|
status-firefox59:
--- → unaffected
status-firefox60:
--- → affected
status-firefox-esr52:
--- → unaffected
Comment 7•7 years ago
|
||
Please request Beta approval on this when you're comfortable doing so.
Flags: needinfo?(tom)
Assignee | ||
Comment 8•7 years ago
|
||
Comment on attachment 8958524 [details] [diff] [review]
Move LRUCache Initialization to startup rather than lazily. r=baku
Approval Request Comment
[Feature/Bug causing the regression]: The initial version of Jitter that landed (Bug
1425462) had a bug.
[User impact if declined]: Crashes.
[Is this code covered by automated tests?]: Indirectly, yes. In fact, they caught it.
[Has the fix been verified in Nightly?]: Yes, it's baked for a few days
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: This blocks Bug 1443943 and Bug 1440195 which we also need to uplift.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: There is always a risk I got the patch wrong, but it's been reviewed and people seem to think it's good.
[String changes made/needed]: None
Flags: needinfo?(tom)
Attachment #8958524 -
Flags: approval-mozilla-beta?
Comment 9•7 years ago
|
||
Comment on attachment 8958524 [details] [diff] [review]
Move LRUCache Initialization to startup rather than lazily. r=baku
sec fix, needed for other uplifts, beta60+
Attachment #8958524 -
Flags: approval-mozilla-beta? → approval-mozilla-beta+
Comment 10•7 years ago
|
||
uplift |
Updated•7 years ago
|
Group: dom-core-security → core-security-release
Updated•7 years ago
|
Group: core-security-release
Updated•6 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•