Thanks for the report. Can you create a PoC that triggers the GC sweep automatically? That will allow our automated tools to run it directly.

Does your automated tools run with gc exposed? content_shell seems to run like that. (From a worker can I call "self.gc();"?)

I can reproduce with forced gc with this new attached file. (I've tried it on the latest tag 58.0.2990.2 compiled with is_debug=true)
Run with: ./chrome --js-flags=--expose-gc ./dcheckgc.html

Deleted: dcheckgc.html 197 bytes

dcheckgc.html 197 bytes View Download

Thanks for the report. I'm not sure if ClusterFuzz has any builds with debug enabled, but I think we can manually look at this. Over to the Blink GC team - haraken@, can you please take a look and triage? I'm tentatively assigning a low impact, but if there's a potential UAF that will need to be escalated.

THis heaf uaf looks high severity, looks like it was triaged incorrectly. haraken@, can you please take a look.

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://clusterfuzz.com/testcase?key=6752495685861376.

nhiroki: Would you mind taking a look at this? This crash seems related to the timing when MessagePort::close() is called on workers.

> Run with: ./chrome --js-flags=--expose-gc ./dcheckgc.html

I tried this on Linux debug build (62.0.3167.0, master@{#489216}), but couldn't reproduce.

ngg@tresorit.com: Thank you for the detailed report and sorry for our late action. Are you still able to reproduce this?

We commit ourselves to a 60 day deadline for fixing for high severity vulnerabilities, and have exceeded it here. If you're unable to look into this soon, could you please find another owner or remove yourself so that this gets back into the security triage queue?

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sorry I didn't reply, I was on vacation. I'll be able to check this on Monday.

nhiroki: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I couldn't reproduce the issue now, but I don't know if the bug was really fixed or just my repro test case is not good enough now.
I tried to git bisect, but I couldn't compile chrome versions before http://crrev.com/d3b69783

nhiroki: Uh oh! This issue still open and hasn't been updated in the last 28 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Friendly security sheriff ping: if you're not able to reproduce now, can we mark this as fixed? If so, it would be good to identify an exact rev where it was fixed.

nhiroki/haraken: could you ptal at the comment in #20? Thanks!

Sorry for my delayed reply. I'll do the bisect and share the update later (maybe next week because of BlinkOn).

(I'd really appreciate it if someone could do the bisect on behalf of me)

This bug requires manual review: M62 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Merge is not necessary.

The NextAction date has arrived: 2017-09-25

I'll do a manual bisect to find how/when this was fixed. Assigning to me so I don't forget.

FWIW the original bug report sounds weird to me. MessagePort implements HasPendingActivity, which as far as I understand it should ensure it doesn't get garbage collected as long as that method returns true. And the logic in that method is identical to the DCHECK in the destructor. So not sure how (modulo garbage collection bugs) the garbage collector could call the destructor in a way to trigger that DCHECK...

There was an issue with pending activities in workers (see my other already fixed bugreport here: https://bugs.chromium.org/p/chromium/issues/detail?id=683406). It's possible the fix for that fixed this as well.

The fix to this bisected to https://codereview.chromium.org/2665733002 which is  issue 686563  - I think this can be duped into that, perhaps?

Lacking exact context here but M57 launched the wrapper tracing GC infrastructure which has been hardened over the last couple of months including fixing issues with HasPendingActivity.

Long story short, it could be this CL :)

Yeah, so this was caused by the same issue as my other bug. Thanks for clarifying.

Yup I think this is the same issue as  issue 683406  which we've already rewarded on. We'll discuss this at the next VRP panel but I would guess it will be considered already rewarded, as it's the same root cause.

(marking this as reward-0 since we already the other bug)

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot