1398487 - Tab crashes when trying to upload mp4 video to web.whatsapp.com under Ubuntu Linux, in nsFileStreamBase::Close(), with MOZ_RELEASE_ASSERT((run->regs_mask[elm] & (1U << bit)) == 0)

Status: RESOLVED DUPLICATE of bug 1398635

(Core :: Networking: File, defect)

Description

[Jens]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20170909100226

Steps to reproduce:

1. Go to https://web.whatsapp.com/
2. In a group I went to Attach => Fotos and Videos
3. Selected the attached Video


Actual results:

4. web.whatsapp.com tried to show a preview, then the firefox's tab crashed was shown.

The crash is reproducable.

Here's the link to the report: https://crash-stats.mozilla.com/report/index/243ba667-00e7-41f1-a6c3-3ec910170909


Expected results:

Should not crash ;) Other videos work.

Comment 1

[Jens]

Setting tracking for FF57 since web.whatsapp.com is quite popular and video sharing within it should not crash the tab.

Comment 2

[Jens]

Here's another crash report: https://crash-stats.mozilla.com/report/index/8bfb708a-fddb-4542-b35e-b4c010170909

Comment 3

[Jens]

Here's the video (was too big with 11 MB for uploading to BMO): https://seacloud.cc/f/42203d9e22fa4fcfb7db/?dl=1

Comment 4

[Tanner Filip [:tanner]]

The same happens to me when uploading a file to VirusTotal. 1f0766bd-2c55-41df-aee5-a61f70170910

Comment 5

[Tanner Filip [:tanner]]

Forgot to add version - Nightly, build 20170909100226.

Comment 6

[Tanner Filip [:tanner]]

Not quite sure if this is right, but...


11:00.35 INFO: Last good revision: 57a5ce8cbf6057413f3f5d20f8bef6ebb8e84eae
11:00.35 INFO: First bad revision: d7af87f6458ef1cfbc5b456aedf3df22369a3adb
11:00.35 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=57a5ce8cbf6057413f3f5d20f8bef6ebb8e84eae&tochange=d7af87f6458ef1cfbc5b456aedf3df22369a3adb

To test I uploaded a different randomly-generated, ~20MB file to VirusTotal. It was generated with `dd if=/dev/urandom of=rand bs=1M count=20` each time. It always crashed on calculating the checksum.

Comment 7

[Julien Cristau [:jcristau]]

This seems to hit the "MOZ_DIAGNOSTIC_ASSERT((run->regs_mask[elm] & (1U << bit)) == 0)" in mozjemalloc, which means it'll go away on beta in this form, but this still look fishy.

Comment 8

[Julien Cristau [:jcristau]]

:glandium tells me this assertion basically means "double free"

Comment 9

[Mats Palmgren (inactive)]

Does the crash also occur in Safe Mode, or a fresh profile?

Comment 10

[Mats Palmgren (inactive)]

The regression range in comment 6 only includes bug 1398376, which seems
unlikely to be the cause of this, although I guess it's possible with
binary extensions that use nsIPresShell/nsPresContext in some way, since
the vtable has changed.  I think we stopped supporting binary extensions
a long time ago though.

Comment 11

[Daniel Holbert [:dholbert]]

I'm skeptical of the regression range in comment 6 -- I think it's close, but probably slightly later than correct.  It's got bug 1398376 which made it into the Sept 9th or 10th version of Nightly.  But the oldest crash report for this signature start with 20170908220146  (Sept 8th Nightly), which means this must've regressed at least ~1 day earlier:

https://crash-stats.mozilla.com/signature/?signature=free.cold.32%20%7C%20_PR_Putfd%20%7C%20pt_Close.cold.7&date=%3E%3D2017-08-01T20%3A08%3A00.000Z&date=%3C2017-09-14T20%3A08%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#reports

Comment 12

[Daniel Holbert [:dholbert]]

Here's a pushlog from Sept 6th to Sept 9th, which almost certainly contains the regressing changeset:
https://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2017-09-06&enddate=2017-09-09

In that range, I would place my bet on bug 1397627 (e.g. "Bug 1397627 - nsIAsyncFileMetadata interface, r=asuth").  It looks like that bug is known to have caused other file-upload issues, e.g. bug 1398556.  (If we're lucky, maybe this is even the same underlying problem?)

Comment 13

[Daniel Holbert [:dholbert]]

(tentatively marking this as a regression from bug 1397627, per comment 12.  Apologies if this turns out to be incorrect.)
(Also: I'm on Ubuntu but I'm unable to reproduce in current Nightly, so far. I've been uploading ~20mb files at web.whatsapp.com)

Comment 14

[Andrea Marchesini [:baku]]

Duplicate of 1398635.

Comment 15

[Sylvestre Ledru [:Sylvestre]]

The duplicate is fixed in 57, not tracking.

Comment 16

[Daniel Holbert [:dholbert]]

(In reply to Andrea Marchesini [:baku] from comment #14)
> Duplicate of 1398635.

Thanks. I'll transfer the "regression from bug 1397627" status over to that bug. (Looks like that wasn't fully marked yet.)

Comment 17

[Daniel Holbert [:dholbert]]

(Transferring crash signature as well.)