[Mono-osx] Mono runtime crash, probably in com.apple.security Security::cfArrayize

Jacob Page jpage at fender.com
Thu May 6 18:57:02 EDT 2010


I am now able to produce a crash consistently.  My OS version is 10.6.3.
When running this code under Mono 2.6.4:

    var testUrl = new Uri("https://mail.google.com/");
    var webClient = new WebClient();
    var dataStr = "dummy=data";
    client.UploadData(testUrl, Encoding.ASCII.GetBytes(dataStr));

I consistently get a crash with the following stack trace:

  at (wrapper managed-to-native)
Mono.Security.X509.OSX509Certificates.SecTrustCreateWithCertificates
(intptr,intptr,intptr&) <0x00004>
  at (wrapper managed-to-native)
Mono.Security.X509.OSX509Certificates.SecTrustCreateWithCertificates
(intptr,intptr,intptr&) <0x00004>
  at Mono.Security.X509.OSX509Certificates._TrustEvaluateSsl
(Mono.Security.X509.X509CertificateCollection) [0x000bd] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/System/System.Se
curity.Cryptography.X509Certificates/OSX509Certificates.cs:119
  at Mono.Security.X509.OSX509Certificates.TrustEvaluateSsl
(Mono.Security.X509.X509CertificateCollection) [0x00000] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/System/System.Se
curity.Cryptography.X509Certificates/OSX509Certificates.cs:90
  at System.Net.ServicePointManager/ChainValidationHelper.ValidateChain
(Mono.Security.X509.X509CertificateCollection) [0x00121] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/System/System.Ne
t/ServicePointManager.cs:454
  at
Mono.Security.Protocol.Tls.SslClientStream.OnRemoteCertificateValidation
2 (Mono.Security.X509.X509CertificateCollection) [0x0000d] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/Mono.Security/Mo
no.Security.Protocol.Tls/SslClientStream.cs:419
  at
Mono.Security.Protocol.Tls.SslStreamBase.RaiseRemoteCertificateValidatio
n2 (Mono.Security.X509.X509CertificateCollection) [0x00000] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/Mono.Security/Mo
no.Security.Protocol.Tls/SslStreamBase.cs:215
  at
Mono.Security.Protocol.Tls.SslClientStream.RaiseServerCertificateValidat
ion2 (Mono.Security.X509.X509CertificateCollection) [0x00000] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/Mono.Security/Mo
no.Security.Protocol.Tls/SslClientStream.cs:444
  at
Mono.Security.Protocol.Tls.Handshake.Client.TlsServerCertificate.validat
eCertificates (Mono.Security.X509.X509CertificateCollection) [0x0001f]
in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/Mono.Security/Mo
no.Security.Protocol.Tls.Handshake.Client/TlsServerCertificate.cs:198
  at
Mono.Security.Protocol.Tls.Handshake.Client.TlsServerCertificate.Process
AsTls1 () [0x00054] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/Mono.Security/Mo
no.Security.Protocol.Tls.Handshake.Client/TlsServerCertificate.cs:105
  at Mono.Security.Protocol.Tls.Handshake.HandshakeMessage.Process ()
[0x00037] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/Mono.Security/Mo
no.Security.Protocol.Tls.Handshake/HandshakeMessage.cs:105
  at (wrapper remoting-invoke-with-check)
Mono.Security.Protocol.Tls.Handshake.HandshakeMessage.Process () <IL
0x00032, 0x0009b>
  at
Mono.Security.Protocol.Tls.ClientRecordProtocol.ProcessHandshakeMessage
(Mono.Security.Protocol.Tls.TlsStream) [0x00039] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/Mono.Security/Mo
no.Security.Protocol.Tls/ClientRecordProtocol.cs:81
  at
Mono.Security.Protocol.Tls.RecordProtocol.InternalReceiveRecordCallback
(System.IAsyncResult) [0x00127] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/Mono.Security/Mo
no.Security.Protocol.Tls/RecordProtocol.cs:397
  at System.Net.Sockets.Socket/SocketAsyncResult.Complete () [0x00117]
in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/System/System.Ne
t.Sockets/Socket.cs:205
  at System.Net.Sockets.Socket/Worker.Receive () [0x00000] in
/private/tmp/monobuild/build/BUILD/mono-2.6.4/mcs/class/System/System.Ne
t.Sockets/Socket.cs:483
  at (wrapper runtime-invoke) object.runtime_invoke_void__this__
(object,intptr,intptr,intptr) <IL 0x0001c, 0x0008e>


-----Original Message-----
From: mono-osx-bounces at lists.ximian.com
[mailto:mono-osx-bounces at lists.ximian.com] On Behalf Of Jacob Page
Sent: Thursday, May 06, 2010 2:36 PM
To: Geoff Norton
Cc: Christopher Teague; mono-osx at lists.ximian.com
Subject: Re: [Mono-osx] Mono runtime crash,probably in
com.apple.security Security::cfArrayize

I don't think I can create an easy test case.  Our crashes only seem to
happen about 25% of the time, so it's probably timing-dependent.  My
suspicion is that the certificate chain doesn't load properly sometimes
due to the hard drive or some service on the Mac not being available at
the time.  That may mean that SecTrustCreateWithCertificates is getting
called in OSX509Certificates::_TrustEvaluateSsl with some bad data.

All I can say for sure is that if our WebClient object performs an HTTPS
post within a certain window of time after the OS recovers from sleep
mode, the crash happens.  Another unfortunate attribute of this bug is
that it never occurs when you manually place the OS in sleep mode; it
only seems to happen after reaching a deeper level of sleep that I don't
know how to initiate manually.

-----Original Message-----
From: Geoff Norton [mailto:gnorton at novell.com] 
Sent: Thursday, May 06, 2010 1:14 PM
To: Jacob Page
Cc: mono-osx at lists.ximian.com; Christopher Teague
Subject: Re: [Mono-osx] Mono runtime crash, probably in
com.apple.security Security::cfArrayize

Could you send us a small test case which consistently shows this issue?

Thank you

Geoff

On 2010-05-06, at 4:07 PM, Jacob Page wrote:

> I found a related stack trace logged in the system console.  Maybe
this
> would also help track down the bug.
> 
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	Stacktrace:
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at (wrapper
> managed-to-native)
> Mono.Security.X509.OSX509Certificates.SecTrustCreateWithCertificates
> (intptr,intptr,intptr&) <0x00004>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at (wrapper
> managed-to-native)
> Mono.Security.X509.OSX509Certificates.SecTrustCreateWithCertificates
> (intptr,intptr,intptr&) <0x00004>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
> Mono.Security.X509.OSX509Certificates._TrustEvaluateSsl
> (Mono.Security.X509.X509CertificateCollection) <0x001b6>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
> Mono.Security.X509.OSX509Certificates.TrustEvaluateSsl
> (Mono.Security.X509.X509CertificateCollection) <0x00017>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
> System.Net.ServicePointManager/ChainValidationHelper.ValidateChain
> (Mono.Security.X509.X509CertificateCollection) <0x0035e>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
>
Mono.Security.Protocol.Tls.SslClientStream.OnRemoteCertificateValidation
> 2 (Mono.Security.X509.X509CertificateCollection) <0x0001f>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
>
Mono.Security.Protocol.Tls.SslStreamBase.RaiseRemoteCertificateValidatio
> n2 (Mono.Security.X509.X509CertificateCollection) <0x0001c>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
>
Mono.Security.Protocol.Tls.SslClientStream.RaiseServerCertificateValidat
> ion2 (Mono.Security.X509.X509CertificateCollection) <0x00013>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
>
Mono.Security.Protocol.Tls.Handshake.Client.TlsServerCertificate.validat
> eCertificates (Mono.Security.X509.X509CertificateCollection) <0x000b3>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
>
Mono.Security.Protocol.Tls.Handshake.Client.TlsServerCertificate.Process
> AsTls1 () <0x000bf>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
> Mono.Security.Protocol.Tls.Handshake.HandshakeMessage.Process ()
> <0x0004d>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at (wrapper
> remoting-invoke-with-check)
> Mono.Security.Protocol.Tls.Handshake.HandshakeMessage.Process ()
> <0x00053>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
>
Mono.Security.Protocol.Tls.ClientRecordProtocol.ProcessHandshakeMessage
> (Mono.Security.Protocol.Tls.TlsStream) <0x00087>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
>
Mono.Security.Protocol.Tls.RecordProtocol.InternalReceiveRecordCallback
> (System.IAsyncResult) <0x0024e>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
> System.Net.Sockets.Socket/SocketAsyncResult.Complete () <0x001c5>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at
> System.Net.Sockets.Socket/Worker.Receive () <0x00016>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]	  at (wrapper
> runtime-invoke) object.runtime_invoke_void__this__
> (object,intptr,intptr,intptr) <0x00040>
> 5/6/10 12:39:28 PM	[0x0-0x238238].OurApp[5537]
> /Applications/Fender
> FUSE.app/Contents/Resources/OurApp.app/Contents/MacOS/OurApp: line 43:
> 5550 Abort trap              "./bin/$APP_NAME" "$ASSEMBLY"
> 5/6/10 12:39:28 PM	com.apple.launchd.peruser.1065390232[114]
> ([0x0-0x238238].OurApp[5537]) Exited with exit code: 134
> 
> -----Original Message-----
> From: Jacob Page 
> Sent: Thursday, May 06, 2010 12:58 PM
> To: mono-osx at lists.ximian.com
> Cc: Christopher Teague
> Subject: Mono runtime crash, probably in com.apple.security
> Security::cfArrayize
> 
> We're trying to track down an issue wherein our OS X application
crashes
> after coming back from sleep mode.  In looking through the latest
crash
> dump, it appears that this may be due to a bug in Mono's TLS
certificate
> code.  Our application is doing an HTTPS web request once recovering
> from being idle due to sleep mode.
> 
> Here's the beginning of the crash dump:
> 
> * * * *
> 
> Process:         mono [5550]
> Path:
> /Library/Frameworks/Mono.framework/Versions/2.6.4/bin/mono
> Identifier:      mono
> Version:         ??? (???)
> Code Type:       X86 (Native)
> Parent Process:  sh [5537]
> 
> Date/Time:       2010-05-06 12:39:28.315 -0700
> OS Version:      Mac OS X 10.6.3 (10D573)
> Report Version:  6
> 
> Exception Type:  EXC_CRASH (SIGABRT)
> Exception Codes: 0x0000000000000000, 0x0000000000000000
> Crashed Thread:  17
> 
> Application Specific Information:
> abort() called
> 
> * * * *
> 
> And here's the stack trace for thread 17:
> 
> * * * *
> 
> Thread 17 Crashed:
> 0   libSystem.B.dylib             	0x903a84be
> __semwait_signal_nocancel + 10
> 1   libSystem.B.dylib             	0x903a83a2
> nanosleep$NOCANCEL$UNIX2003 + 166
> 2   libSystem.B.dylib             	0x904232f2
> usleep$NOCANCEL$UNIX2003 + 61
> 3   libSystem.B.dylib             	0x904449a8 abort + 105
> 4   <Our app>                    	0x00023a66
> mono_handle_native_sigsegv + 324 (mini-exceptions.c:1857)
> 5   <Our app>                    	0x001b8c70
> mono_sigsegv_signal_handler + 305 (mini.c:4848)
> 6   libSystem.B.dylib             	0x903a142b _sigtramp + 43
> 7   ???                           	0xffffffff 0 + 4294967295
> 8   com.apple.security            	0x95b7a94f
> Security::cfArrayize(void const*) + 35
> 9   com.apple.security            	0x95b7a784
> Security::KeychainCore::Trust::Trust(void const*, void const*) + 144
> 10  com.apple.security            	0x95b7a601
> SecTrustCreateWithCertificates + 98
> 11  ???                           	0x03eadff6 0 + 65724406
> 12  ???                           	0x03eadc1f 0 + 65723423
> 13  ???                           	0x03ead9a0 0 + 65722784
> 14  ???                           	0x03e87bbf 0 + 65567679
> 15  ???                           	0x03e87850 0 + 65566800
> 16  ???                           	0x03e87825 0 + 65566757
> 17  ???                           	0x03e877f4 0 + 65566708
> 18  ???                           	0x03e87114 0 + 65564948
> 19  ???                           	0x03e7f108 0 + 65532168
> 20  ???                           	0x03e303ee 0 + 65209326
> 21  ???                           	0x03e3036c 0 + 65209196
> 22  ???                           	0x03e7d550 0 + 65525072
> 23  ???                           	0x03e7c23f 0 + 65520191
> 24  ???                           	0x03e7a866 0 + 65513574
> 25  ???                           	0x03e7bfe7 0 + 65519591
> 26  ???                           	0x00c96389 0 + 13198217
> 27  <Our app>                    	0x001b8a3d
> mono_jit_runtime_invoke + 1306 (mini.c:4731)
> 28  <Our app>                    	0x00114d80 mono_runtime_invoke +
> 137 (object.c:2613)
> 29  <Our app>                    	0x00116fa4
> mono_runtime_invoke_array + 1737 (object.c:3783)
> 30  <Our app>                    	0x00119cf8 mono_message_invoke +
> 488 (object.c:5412)
> 31  <Our app>                    	0x0014a1a6 mono_async_invoke +
> 164 (threadpool.c:1015)
> 32  <Our app>                    	0x00148c83
> async_invoke_io_thread + 535 (threadpool.c:327)
> 33  <Our app>                    	0x0014d4c8 start_wrapper + 591
> (threads.c:666)
> 34  <Our app>                    	0x0018d8ba thread_start_routine
> + 201 (wthreads.c:286)
> 35  <Our app>                    	0x001aafc8 GC_start_routine +
> 106 (pthread_support.c:1390)
> 36  libSystem.B.dylib             	0x90368a19 _pthread_start + 345
> 37  libSystem.B.dylib             	0x9036889e thread_start + 34
> 
> * * * *
> 
> Let me know if you need any additional information.  If you know the
> cause of this crash, do you know of any workaround we can apply in the
> short term?
> 
> _______________________________________________
> Mono-osx mailing list
> Mono-osx at lists.ximian.com
> http://lists.ximian.com/mailman/listinfo/mono-osx

_______________________________________________
Mono-osx mailing list
Mono-osx at lists.ximian.com
http://lists.ximian.com/mailman/listinfo/mono-osx


More information about the Mono-osx mailing list