---| overview

Vulnerability: Chrome Null Pointer in InspectDataSource::StartDataRequest
Date: 03/14/2012
Author: @HeyderAndrade (heyder.andrade[at]gmail[dot]com)
Chrome Version: =< 21.0.1180.57 stable
Operating System Tested: Win XP SP2, WIN7, Mac OS X 10.6.8 (10K549),Linux Ubuntu 12.04
Architecture: x86 and Amd64

---| steps will reproduce this crash

1. Open the browser and visit any site that has an SSL certificate signed by a CA not trusted.
an ssl error will be showed, DON'T click "proceed anayway".
2. Open a new tab and access chrome://inspect

ps. I believe it should work with any ssl error, but i tested only  with no valid CA error.

---| original OSX Crash Report

 Process:         Google Chrome [767]
 Path:            /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
 Identifier:      com.google.Chrome
 Version:         21.0.1180.57 (1180.57)
 Code Type:       X86 (Native)
 Parent Process:  launchd [158]

 Date/Time:       2012-08-08 22:53:09.442 -0300
 OS Version:      Mac OS X 10.6.8 (10K549)
 Report Version:  6

 Interval Since Last Report:          19713 sec
 Crashes Since Last Report:           1
 Per-App Interval Since Last Report:  19374 sec
 Per-App Crashes Since Last Report:   1
 Anonymous UUID:                      B5BA5F00-E166-4923-9393-E0FC63561975

 Exception Type:  EXC_BAD_ACCESS (SIGBUS)
 Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000000
 Crashed Thread:  0  CrBrowserMain  Dispatch queue: com.apple.main-thread

---| source code

This vulnerability lies in the function call DCHECK (line 118 of the inspect_ui.cc)
the render_process_host can be NULL.

 file:     browser/ui/webui/inspect_ui.cc
 line:     188
 function: DCHECK(render_process_host);

---| source code fix

if (!render_process_host->HasConnection())
  continue;


---| timeline of disclosure

- discovery vulnerability  		- Ago 08, 2012
- code.google.com report   	- Aug 15, 2012
- Chromium community fix   	- Oct 11, 2012
- This disclosure          			- Mar 14, 2013

---| references

https://chromiumcodereview.appspot.com/11066114/ (for some reason this issue was removed)
https://code.google.com/p/chromium/issues/detail?id=142979 (no public)


Starting program: /home/user/chrome-linux/chrome --debug https://caixa.gov.br
[Thread debugging using libthread_db enabled]
[New Thread 0xb2735b70 (LWP 10475)]
[New Thread 0xb1f34b70 (LWP 10476)]
[New Thread 0xb1733b70 (LWP 10477)]
[New Thread 0xb280db70 (LWP 10478)]
[New Thread 0xb0666b70 (LWP 10479)]
[New Thread 0xafe65b70 (LWP 10480)]
[New Thread 0xaf664b70 (LWP 10481)]
[New Thread 0xaee63b70 (LWP 10482)]
[New Thread 0xae662b70 (LWP 10483)]
[New Thread 0xade61b70 (LWP 10484)]
[New Thread 0xad660b70 (LWP 10485)]
[New Thread 0xace5fb70 (LWP 10486)]
[New Thread 0xace3eb70 (LWP 10487)]
[New Thread 0xace1db70 (LWP 10488)]
[New Thread 0xacdfcb70 (LWP 10489)]
[New Thread 0xac4eeb70 (LWP 10490)]
[Thread 0xac4eeb70 (LWP 10490) exited]
[New Thread 0xac4eeb70 (LWP 10491)]
[New Thread 0xab0fbb70 (LWP 10492)]
[New Thread 0xaa8fab70 (LWP 10497)]
[New Thread 0xaa0f9b70 (LWP 10498)]
[New Thread 0xa9282b70 (LWP 10515)]
[Thread 0xa9282b70 (LWP 10515) exited]
[New Thread 0xa97abb70 (LWP 10516)]
[New Thread 0xa978ab70 (LWP 10519)]
[New Thread 0xa9769b70 (LWP 10520)]

Program received signal SIGSEGV, Segmentation fault.
0xb40ea92b in (anonymous namespace)::InspectDataSource::StartDataRequest(std::string const&, bool, int) ()
#0  0xb40ea92b in (anonymous namespace)::InspectDataSource::StartDataRequest(std::string const&, bool, int) ()
#1  0xb40caf9b in base::internal::Invoker<4, base::internal::BindState<base::internal::RunnableAdapter<void (ChromeURLDataManager::DataSource::*)(std::string const&, bool, int)>, void ()(ChromeURLDataManager::DataSource*, std::string const&, bool, int), void ()(ChromeURLDataManager::DataSource*, std::string, bool, int)>, void ()(ChromeURLDataManager::DataSource*, std::string const&, bool, int)>::Run(base::internal::BindStateBase*) ()
#2  0xb498c220 in MessageLoop::RunTask(base::PendingTask const&) ()
#3  0xb498c8c2 in MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) ()
#4  0xb498cc31 in MessageLoop::DoWork() ()
#5  0xb49d58be in base::MessagePumpGlib::RunWithDispatcher(base::MessagePump::Delegate*, base::MessagePumpDispatcher*) ()
#6  0xb49d543c in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) ()
#7  0xb498846e in MessageLoop::RunInternal() ()
#8  0xb49a4ae9 in base::RunLoop::Run() ()
#9  0xb46513f5 in ChromeBrowserMainParts::MainMessageLoopRun(int*) ()
#10 0xb65262ec in content::BrowserMainLoop::RunMainMessageLoopParts() ()
#11 0xb6527280 in (anonymous namespace)::BrowserMainRunnerImpl::Run() ()
#12 0xb65247f3 in BrowserMain(content::MainFunctionParams const&) ()
#13 0xb48fb758 in content::RunNamedProcessTypeMain(std::string const&, content::MainFunctionParams const&, content::ContentMainDelegate*) ()
#14 0xb48fb8b0 in content::ContentMainRunnerImpl::Run() ()
#15 0xb48fa797 in content::ContentMain(int, char const**, content::ContentMainDelegate*) ()
#16 0xb3fbe60b in ChromeMain ()
#17 0xb3fbe5c2 in main ()

Thread 25 (Thread 0xa9769b70 (LWP 10520)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f36b86 in poll () from /lib/tls/i686/cmov/libc.so.6
#2  0xb2a96718 in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#3  0xb2a948a3 in __libc_res_nquery () from /lib/tls/i686/cmov/libresolv.so.2
#4  0xb2a94e8b in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#5  0xb2a95119 in __libc_res_nsearch () from /lib/tls/i686/cmov/libresolv.so.2
#6  0xabc80bd6 in _nss_dns_gethostbyname3_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#7  0xabc80f2b in _nss_dns_gethostbyname2_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#8  0xb2f5bb0d in gethostbyname2_r () from /lib/tls/i686/cmov/libc.so.6
#9  0xb2f1d010 in ?? () from /lib/tls/i686/cmov/libc.so.6
#10 0xb2f1ea65 in getaddrinfo () from /lib/tls/i686/cmov/libc.so.6
#11 0xb4a33e2a in net::SystemHostResolverProc(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#12 0xb4a23537 in net::(anonymous namespace)::CallSystemHostResolverProc::Resolve(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#13 0xb4a239a3 in net::HostResolverImpl::ProcTask::DoLookup(base::TimeTicks const&, unsigned int) ()
#14 0xb4a229b5 in base::internal::Invoker<3, base::internal::BindState<base::internal::RunnableAdapter<void (net::HostResolverImpl::ProcTask::*)(base::TimeTicks const&, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int), void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int)>::Run(base::internal::BindStateBase*) ()
#15 0xb49c2701 in base::(anonymous namespace)::WorkerThread::ThreadMain() ()
#16 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#17 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#18 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 24 (Thread 0xa978ab70 (LWP 10519)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f36b86 in poll () from /lib/tls/i686/cmov/libc.so.6
#2  0xb2a96718 in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#3  0xb2a948a3 in __libc_res_nquery () from /lib/tls/i686/cmov/libresolv.so.2
#4  0xb2a94e8b in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#5  0xb2a95119 in __libc_res_nsearch () from /lib/tls/i686/cmov/libresolv.so.2
#6  0xabc80bd6 in _nss_dns_gethostbyname3_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#7  0xabc80f2b in _nss_dns_gethostbyname2_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#8  0xb2f5bb0d in gethostbyname2_r () from /lib/tls/i686/cmov/libc.so.6
#9  0xb2f1d010 in ?? () from /lib/tls/i686/cmov/libc.so.6
#10 0xb2f1ea65 in getaddrinfo () from /lib/tls/i686/cmov/libc.so.6
#11 0xb4a33e2a in net::SystemHostResolverProc(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#12 0xb4a23537 in net::(anonymous namespace)::CallSystemHostResolverProc::Resolve(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#13 0xb4a239a3 in net::HostResolverImpl::ProcTask::DoLookup(base::TimeTicks const&, unsigned int) ()
#14 0xb4a229b5 in base::internal::Invoker<3, base::internal::BindState<base::internal::RunnableAdapter<void (net::HostResolverImpl::ProcTask::*)(base::TimeTicks const&, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int), void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int)>::Run(base::internal::BindStateBase*) ()
#15 0xb49c2701 in base::(anonymous namespace)::WorkerThread::ThreadMain() ()
#16 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#17 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#18 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 23 (Thread 0xa97abb70 (LWP 10516)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f36b86 in poll () from /lib/tls/i686/cmov/libc.so.6
#2  0xb2a96718 in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#3  0xb2a948a3 in __libc_res_nquery () from /lib/tls/i686/cmov/libresolv.so.2
#4  0xb2a94e8b in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#5  0xb2a95119 in __libc_res_nsearch () from /lib/tls/i686/cmov/libresolv.so.2
#6  0xabc80bd6 in _nss_dns_gethostbyname3_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#7  0xabc80f2b in _nss_dns_gethostbyname2_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#8  0xb2f5bb0d in gethostbyname2_r () from /lib/tls/i686/cmov/libc.so.6
#9  0xb2f1d010 in ?? () from /lib/tls/i686/cmov/libc.so.6
#10 0xb2f1ea65 in getaddrinfo () from /lib/tls/i686/cmov/libc.so.6
#11 0xb4a33e2a in net::SystemHostResolverProc(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#12 0xb4a23537 in net::(anonymous namespace)::CallSystemHostResolverProc::Resolve(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#13 0xb4a239a3 in net::HostResolverImpl::ProcTask::DoLookup(base::TimeTicks const&, unsigned int) ()
#14 0xb4a229b5 in base::internal::Invoker<3, base::internal::BindState<base::internal::RunnableAdapter<void (net::HostResolverImpl::ProcTask::*)(base::TimeTicks const&, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int), void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int)>::Run(base::internal::BindStateBase*) ()
#15 0xb49c2701 in base::(anonymous namespace)::WorkerThread::ThreadMain() ()
#16 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#17 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#18 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 21 (Thread 0xaa0f9b70 (LWP 10498)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365015 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b1d48 in base::ConditionVariable::Wait() ()
#3  0xb49be489 in base::SequencedWorkerPool::Inner::ThreadLoop(base::SequencedWorkerPool::Worker*) ()
#4  0xb49bec19 in base::SequencedWorkerPool::Worker::Run() ()
#5  0xb49bf733 in base::SimpleThread::ThreadMain() ()
#6  0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#7  0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#8  0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 20 (Thread 0xaa8fab70 (LWP 10497)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365342 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b24cc in base::ConditionVariable::TimedWait(base::TimeDelta const&) ()
#3  0xb49b36dd in base::WaitableEvent::TimedWait(base::TimeDelta const&) ()
#4  0xb498e11a in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ()
#5  0xb498846e in MessageLoop::RunInternal() ()
#6  0xb49a4ae9 in base::RunLoop::Run() ()
#7  0xb498775e in MessageLoop::Run() ()
#8  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#9  0xb49bfa91 in base::Thread::ThreadMain() ()
#10 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#11 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#12 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 19 (Thread 0xab0fbb70 (LWP 10492)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365015 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b1d48 in base::ConditionVariable::Wait() ()
#3  0xb49be489 in base::SequencedWorkerPool::Inner::ThreadLoop(base::SequencedWorkerPool::Worker*) ()
#4  0xb49bec19 in base::SequencedWorkerPool::Worker::Run() ()
#5  0xb49bf733 in base::SimpleThread::ThreadMain() ()
#6  0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#7  0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#8  0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 18 (Thread 0xac4eeb70 (LWP 10491)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365015 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b1d48 in base::ConditionVariable::Wait() ()
#3  0xb49b36f0 in base::WaitableEvent::TimedWait(base::TimeDelta const&) ()
#4  0xb49b3736 in base::WaitableEvent::Wait() ()
#5  0xb498e0c4 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb49bfa91 in base::Thread::ThreadMain() ()
#11 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#12 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#13 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 16 (Thread 0xacdfcb70 (LWP 10489)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365342 in pthread_cond_timedwait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b24cc in base::ConditionVariable::TimedWait(base::TimeDelta const&) ()
#3  0xb49b36dd in base::WaitableEvent::TimedWait(base::TimeDelta const&) ()
#4  0xb498e11a in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ()
#5  0xb498846e in MessageLoop::RunInternal() ()
#6  0xb49a4ae9 in base::RunLoop::Run() ()
#7  0xb498775e in MessageLoop::Run() ()
#8  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#9  0xb49bfa91 in base::Thread::ThreadMain() ()
#10 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#11 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#12 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 15 (Thread 0xace1db70 (LWP 10488)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f36b86 in poll () from /lib/tls/i686/cmov/libc.so.6
#2  0xb2a96718 in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#3  0xb2a948a3 in __libc_res_nquery () from /lib/tls/i686/cmov/libresolv.so.2
#4  0xb2a94e8b in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#5  0xb2a95119 in __libc_res_nsearch () from /lib/tls/i686/cmov/libresolv.so.2
#6  0xabc80bd6 in _nss_dns_gethostbyname3_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#7  0xabc80f2b in _nss_dns_gethostbyname2_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#8  0xb2f5bb0d in gethostbyname2_r () from /lib/tls/i686/cmov/libc.so.6
#9  0xb2f1d010 in ?? () from /lib/tls/i686/cmov/libc.so.6
#10 0xb2f1ea65 in getaddrinfo () from /lib/tls/i686/cmov/libc.so.6
#11 0xb4a33e2a in net::SystemHostResolverProc(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#12 0xb4a23537 in net::(anonymous namespace)::CallSystemHostResolverProc::Resolve(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#13 0xb4a239a3 in net::HostResolverImpl::ProcTask::DoLookup(base::TimeTicks const&, unsigned int) ()
#14 0xb4a229b5 in base::internal::Invoker<3, base::internal::BindState<base::internal::RunnableAdapter<void (net::HostResolverImpl::ProcTask::*)(base::TimeTicks const&, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int), void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int)>::Run(base::internal::BindStateBase*) ()
#15 0xb49c2701 in base::(anonymous namespace)::WorkerThread::ThreadMain() ()
#16 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#17 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#18 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 14 (Thread 0xace3eb70 (LWP 10487)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f36b86 in poll () from /lib/tls/i686/cmov/libc.so.6
#2  0xb2a96718 in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#3  0xb2a948a3 in __libc_res_nquery () from /lib/tls/i686/cmov/libresolv.so.2
#4  0xb2a94e8b in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#5  0xb2a95119 in __libc_res_nsearch () from /lib/tls/i686/cmov/libresolv.so.2
#6  0xabc80bd6 in _nss_dns_gethostbyname3_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#7  0xabc80f2b in _nss_dns_gethostbyname2_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#8  0xb2f5bb0d in gethostbyname2_r () from /lib/tls/i686/cmov/libc.so.6
#9  0xb2f1d010 in ?? () from /lib/tls/i686/cmov/libc.so.6
#10 0xb2f1ea65 in getaddrinfo () from /lib/tls/i686/cmov/libc.so.6
#11 0xb4a33e2a in net::SystemHostResolverProc(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#12 0xb4a23537 in net::(anonymous namespace)::CallSystemHostResolverProc::Resolve(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#13 0xb4a239a3 in net::HostResolverImpl::ProcTask::DoLookup(base::TimeTicks const&, unsigned int) ()
#14 0xb4a229b5 in base::internal::Invoker<3, base::internal::BindState<base::internal::RunnableAdapter<void (net::HostResolverImpl::ProcTask::*)(base::TimeTicks const&, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int), void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int)>::Run(base::internal::BindStateBase*) ()
#15 0xb49c2701 in base::(anonymous namespace)::WorkerThread::ThreadMain() ()
#16 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#17 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#18 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 13 (Thread 0xace5fb70 (LWP 10486)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f36b86 in poll () from /lib/tls/i686/cmov/libc.so.6
#2  0xb2a96718 in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#3  0xb2a948a3 in __libc_res_nquery () from /lib/tls/i686/cmov/libresolv.so.2
#4  0xb2a94e8b in ?? () from /lib/tls/i686/cmov/libresolv.so.2
#5  0xb2a95119 in __libc_res_nsearch () from /lib/tls/i686/cmov/libresolv.so.2
#6  0xabc80bd6 in _nss_dns_gethostbyname3_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#7  0xabc80f2b in _nss_dns_gethostbyname2_r () from /lib/tls/i686/cmov/libnss_dns.so.2
#8  0xb2f5bb0d in gethostbyname2_r () from /lib/tls/i686/cmov/libc.so.6
#9  0xb2f1d010 in ?? () from /lib/tls/i686/cmov/libc.so.6
#10 0xb2f1ea65 in getaddrinfo () from /lib/tls/i686/cmov/libc.so.6
#11 0xb4a33e2a in net::SystemHostResolverProc(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#12 0xb4a23537 in net::(anonymous namespace)::CallSystemHostResolverProc::Resolve(std::string const&, net::AddressFamily, int, net::AddressList*, int*) ()
#13 0xb4a239a3 in net::HostResolverImpl::ProcTask::DoLookup(base::TimeTicks const&, unsigned int) ()
#14 0xb4a229b5 in base::internal::Invoker<3, base::internal::BindState<base::internal::RunnableAdapter<void (net::HostResolverImpl::ProcTask::*)(base::TimeTicks const&, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int), void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks, unsigned int)>, void ()(net::HostResolverImpl::ProcTask*, base::TimeTicks const&, unsigned int)>::Run(base::internal::BindStateBase*) ()
#15 0xb49c2701 in base::(anonymous namespace)::WorkerThread::ThreadMain() ()
#16 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#17 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#18 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 12 (Thread 0xad660b70 (LWP 10485)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f40d37 in syscall () from /lib/tls/i686/cmov/libc.so.6
#2  0xb49e6410 in epoll_wait ()
#3  0xb49e5e75 in epoll_dispatch ()
#4  0xb49e42a7 in event_base_loop ()
#5  0xb495eda7 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb652797d in content::BrowserThreadImpl::IOThreadRun(MessageLoop*) ()
#11 0xb6529da3 in content::BrowserThreadImpl::Run(MessageLoop*) ()
#12 0xb49bfa91 in base::Thread::ThreadMain() ()
#13 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#14 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#15 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 11 (Thread 0xade61b70 (LWP 10484)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f40d37 in syscall () from /lib/tls/i686/cmov/libc.so.6
#2  0xb49e6410 in epoll_wait ()
#3  0xb49e5e75 in epoll_dispatch ()
#4  0xb49e42a7 in event_base_loop ()
#5  0xb495eda7 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb6527a1d in content::BrowserThreadImpl::CacheThreadRun(MessageLoop*) ()
#11 0xb6529db1 in content::BrowserThreadImpl::Run(MessageLoop*) ()
#12 0xb49bfa91 in base::Thread::ThreadMain() ()
#13 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#14 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#15 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 10 (Thread 0xae662b70 (LWP 10483)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365015 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b1d48 in base::ConditionVariable::Wait() ()
#3  0xb49b36f0 in base::WaitableEvent::TimedWait(base::TimeDelta const&) ()
#4  0xb49b3736 in base::WaitableEvent::Wait() ()
#5  0xb498e0c4 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb6527abd in content::BrowserThreadImpl::ProcessLauncherThreadRun(MessageLoop*) ()
#11 0xb6529dbf in content::BrowserThreadImpl::Run(MessageLoop*) ()
#12 0xb49bfa91 in base::Thread::ThreadMain() ()
#13 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#14 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#15 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 9 (Thread 0xaee63b70 (LWP 10482)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365015 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b1d48 in base::ConditionVariable::Wait() ()
#3  0xb49b36f0 in base::WaitableEvent::TimedWait(base::TimeDelta const&) ()
#4  0xb49b3736 in base::WaitableEvent::Wait() ()
#5  0xb498e0c4 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb6527b5d in content::BrowserThreadImpl::FileUserBlockingThreadRun(MessageLoop*) ()
#11 0xb6529dce in content::BrowserThreadImpl::Run(MessageLoop*) ()
#12 0xb49bfa91 in base::Thread::ThreadMain() ()
#13 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#14 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#15 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 8 (Thread 0xaf664b70 (LWP 10481)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f40d37 in syscall () from /lib/tls/i686/cmov/libc.so.6
#2  0xb49e6410 in epoll_wait ()
#3  0xb49e5e75 in epoll_dispatch ()
#4  0xb49e42a7 in event_base_loop ()
#5  0xb495eda7 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb6527bfd in content::BrowserThreadImpl::FileThreadRun(MessageLoop*) ()
#11 0xb6529dde in content::BrowserThreadImpl::Run(MessageLoop*) ()
#12 0xb49bfa91 in base::Thread::ThreadMain() ()
#13 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#14 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#15 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 7 (Thread 0xafe65b70 (LWP 10480)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365015 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b1d48 in base::ConditionVariable::Wait() ()
#3  0xb49b36f0 in base::WaitableEvent::TimedWait(base::TimeDelta const&) ()
#4  0xb49b3736 in base::WaitableEvent::Wait() ()
#5  0xb498e0c4 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb6527c9d in content::BrowserThreadImpl::WebKitThreadRun(MessageLoop*) ()
#11 0xb6529dee in content::BrowserThreadImpl::Run(MessageLoop*) ()
#12 0xb49bfa91 in base::Thread::ThreadMain() ()
#13 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#14 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#15 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 6 (Thread 0xb0666b70 (LWP 10479)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365015 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b1d48 in base::ConditionVariable::Wait() ()
#3  0xb49b36f0 in base::WaitableEvent::TimedWait(base::TimeDelta const&) ()
#4  0xb49b3736 in base::WaitableEvent::Wait() ()
#5  0xb498e0c4 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb6527d3d in content::BrowserThreadImpl::DBThreadRun(MessageLoop*) ()
#11 0xb6529dfe in content::BrowserThreadImpl::Run(MessageLoop*) ()
#12 0xb49bfa91 in base::Thread::ThreadMain() ()
#13 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#14 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#15 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 5 (Thread 0xb280db70 (LWP 10478)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3367f5b in read () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb4254037 in (anonymous namespace)::ShutdownDetector::ThreadMain() ()
#3  0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#4  0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#5  0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 4 (Thread 0xb1733b70 (LWP 10477)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb3365015 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0
#2  0xb49b1d48 in base::ConditionVariable::Wait() ()
#3  0xb49b36f0 in base::WaitableEvent::TimedWait(base::TimeDelta const&) ()
#4  0xb49b3736 in base::WaitableEvent::Wait() ()
#5  0xb498e0c4 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb49bfa91 in base::Thread::ThreadMain() ()
#11 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#12 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#13 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 3 (Thread 0xb1f34b70 (LWP 10476)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f3d971 in select () from /lib/tls/i686/cmov/libc.so.6
#2  0xb497f952 in base::files::(anonymous namespace)::InotifyReaderCallback(base::files::(anonymous namespace)::InotifyReader*, int, int) ()
#3  0xb497cc19 in base::internal::Invoker<3, base::internal::BindState<base::internal::RunnableAdapter<void (*)(base::files::(anonymous namespace)::InotifyReader*, int, int)>, void ()(base::files::(anonymous namespace)::InotifyReader*, int, int), void ()(base::files::(anonymous namespace)::InotifyReader*, int, int)>, void ()(base::files::(anonymous namespace)::InotifyReader*, int, int)>::Run(base::internal::BindStateBase*) ()
#4  0xb498c220 in MessageLoop::RunTask(base::PendingTask const&) ()
#5  0xb498c8c2 in MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) ()
#6  0xb498cc31 in MessageLoop::DoWork() ()
#7  0xb498e06b in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ()
#8  0xb498846e in MessageLoop::RunInternal() ()
#9  0xb49a4ae9 in base::RunLoop::Run() ()
#10 0xb498775e in MessageLoop::Run() ()
#11 0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#12 0xb49bfa91 in base::Thread::ThreadMain() ()
#13 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#14 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#15 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 2 (Thread 0xb2735b70 (LWP 10475)):
#0  0xb3d80430 in __kernel_vsyscall ()
#1  0xb2f40d37 in syscall () from /lib/tls/i686/cmov/libc.so.6
#2  0xb49e6410 in epoll_wait ()
#3  0xb49e5e75 in epoll_dispatch ()
#4  0xb49e42a7 in event_base_loop ()
#5  0xb495eda7 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ()
#6  0xb498846e in MessageLoop::RunInternal() ()
#7  0xb49a4ae9 in base::RunLoop::Run() ()
#8  0xb498775e in MessageLoop::Run() ()
#9  0xb49bfbb9 in base::Thread::Run(MessageLoop*) ()
#10 0xb49bfa91 in base::Thread::ThreadMain() ()
#11 0xb49bb148 in base::(anonymous namespace)::ThreadFunc(void*) ()
#12 0xb336096e in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#13 0xb2f44a4e in clone () from /lib/tls/i686/cmov/libc.so.6

Thread 1 (Thread 0xb2977990 (LWP 10468)):
#0  0xb40ea92b in (anonymous namespace)::InspectDataSource::StartDataRequest(std::string const&, bool, int) ()
#1  0xb40caf9b in base::internal::Invoker<4, base::internal::BindState<base::internal::RunnableAdapter<void (ChromeURLDataManager::DataSource::*)(std::string const&, bool, int)>, void ()(ChromeURLDataManager::DataSource*, std::string const&, bool, int), void ()(ChromeURLDataManager::DataSource*, std::string, bool, int)>, void ()(ChromeURLDataManager::DataSource*, std::string const&, bool, int)>::Run(base::internal::BindStateBase*) ()
#2  0xb498c220 in MessageLoop::RunTask(base::PendingTask const&) ()
#3  0xb498c8c2 in MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) ()
#4  0xb498cc31 in MessageLoop::DoWork() ()
#5  0xb49d58be in base::MessagePumpGlib::RunWithDispatcher(base::MessagePump::Delegate*, base::MessagePumpDispatcher*) ()
#6  0xb49d543c in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) ()
#7  0xb498846e in MessageLoop::RunInternal() ()
#8  0xb49a4ae9 in base::RunLoop::Run() ()
#9  0xb46513f5 in ChromeBrowserMainParts::MainMessageLoopRun(int*) ()
#10 0xb65262ec in content::BrowserMainLoop::RunMainMessageLoopParts() ()
#11 0xb6527280 in (anonymous namespace)::BrowserMainRunnerImpl::Run() ()
#12 0xb65247f3 in BrowserMain(content::MainFunctionParams const&) ()
#13 0xb48fb758 in content::RunNamedProcessTypeMain(std::string const&, content::MainFunctionParams const&, content::ContentMainDelegate*) ()
#14 0xb48fb8b0 in content::ContentMainRunnerImpl::Run() ()
#15 0xb48fa797 in content::ContentMain(int, char const**, content::ContentMainDelegate*) ()
#16 0xb3fbe60b in ChromeMain ()
#17 0xb3fbe5c2 in main ()
eax            0x4	4
ecx            0xb81187c0	-1206810688
edx            0x0	0
ebx            0xb8158ff4	-1206546444
esp            0xbfffdfa0	0xbfffdfa0
ebp            0xbfffe588	0xbfffe588
esi            0xbfffe4b0	-1073748816
edi            0xb8829880	-1199400832
eip            0xb40ea92b	0xb40ea92b <(anonymous namespace)::InspectDataSource::StartDataRequest(std::string const&, bool, int)+1899>
eflags         0x210286	[ PF SF IF RF ID ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51
=> 0xb40ea92b <_ZN12_GLOBAL__N_117InspectDataSource16StartDataRequestERKSsbi+1899>:	mov    (%edx),%eax
   0xb40ea92d <_ZN12_GLOBAL__N_117InspectDataSource16StartDataRequestERKSsbi+1901>:	mov    %edx,(%esp)
   0xb40ea930 <_ZN12_GLOBAL__N_117InspectDataSource16StartDataRequestERKSsbi+1904>:	call   *0x28(%eax)
   0xb40ea933 <_ZN12_GLOBAL__N_117InspectDataSource16StartDataRequestERKSsbi+1907>:	mov    %eax,-0x580(%ebp)
edx            0x0	0
eax            0x4	4
1: x/i $pc
=> 0xb40ea92b <_ZN12_GLOBAL__N_117InspectDataSource16StartDataRequestERKSsbi+1899>:	mov    (%edx),%eax