Assertion failure: ObserverCount() == mEarlyRunners.Length() (observers, except pending selection scrolls, should have been unregistered), at /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:1185

NEW
Unassigned

Status

()

Core
Layout
P3
normal
2 months ago
7 days ago

People

(Reporter: jkratzer, Unassigned)

Tracking

(Blocks: 1 bug, {assertion, testcase})

52 Branch
assertion, testcase
Points:
---
Bug Flags:
in-testsuite ?

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

2 months ago
Created attachment 8930986 [details]
trigger.html

Testcase found while fuzzing mozilla-central rev 5378dcb45044.

==31186==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f9884d72968 bp 0x7ffd38988370 sp 0x7ffd38988340 T0)
==31186==The signal is caused by a WRITE memory access.
==31186==Hint: address points to the zero page.
    #0 0x7f9884d72967 in nsRefreshDriver::~nsRefreshDriver() /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:1182:3
    #1 0x7f9884d72cad in nsRefreshDriver::~nsRefreshDriver() /builds/worker/workspace/build/src/layout/base/nsRefreshDriver.cpp:1181:1
    #2 0x7f9880de7369 in mozilla::layers::TransactionIdAllocator::Release() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/layers/TransactionIdAllocator.h:21:3
    #3 0x7f98830a533f in RefPtr<nsRefreshDriver>::operator=(decltype(nullptr)) /builds/worker/workspace/build/src/gfx/gl/../../mfbt/RefPtr.h:168:5
    #4 0x7f9884efed1e in nsPresContext::~nsPresContext() /builds/worker/workspace/build/src/layout/base/nsPresContext.cpp:421:3
    #5 0x7f9884f0e43d in nsRootPresContext::~nsRootPresContext() /builds/worker/workspace/build/src/layout/base/nsPresContext.cpp:3197:1
    #6 0x7f987eec7866 in SnowWhiteKiller::~SnowWhiteKiller() /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2729:25
    #7 0x7f987eec6d5c in nsCycleCollector::FreeSnowWhite(bool) /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2917:3
    #8 0x7f987eece628 in nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:3925:3
    #9 0x7f987eecdd7f in nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:3746:9
    #10 0x7f987eecda54 in nsCycleCollector::ShutdownCollect() /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:3687:10
    #11 0x7f987eed1f03 in nsCycleCollector_shutdown(bool) /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:4373:23
    #12 0x7f987f088dfc in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/workspace/build/src/xpcom/build/XPCOMInit.cpp:973:3
    #13 0x7f9887c09c19 in XRE_TermEmbedding() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:224:3
    #14 0x7f987fc023a5 in mozilla::ipc::ScopedXREEmbed::Stop() /builds/worker/workspace/build/src/ipc/glue/ScopedXREEmbed.cpp:108:5
    #15 0x7f9887c0a414 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:707:16
    #16 0x4ec36e in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30
    #17 0x4ec5c9 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:280:18
    #18 0x7f989e33582f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
    #19 0x41e424 in _start (/home/forb1dden/builds/mc-asan-debug/firefox+0x41e424)
Flags: in-testsuite?

Updated

2 months ago
Priority: -- → P3

Comment 1

a month ago
3 failures in 889 pushes (0.003 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* mozilla-inbound: 2
* autoland: 1

Platform breakdown:
* windows7-32: 3

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1419802&startday=2017-12-04&endday=2017-12-10&tree=all

Comment 2

21 days ago
3 failures in 147 pushes (0.02 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* mozilla-inbound: 1
* mozilla-central: 1
* autoland: 1

Platform breakdown:
* windows7-32: 2
* android-4-4-armv7-api16: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1419802&startday=2017-12-25&endday=2017-12-31&tree=all
(Reporter)

Comment 3

12 days ago
Created attachment 8941190 [details]
trigger.html

Additional testcase.

Comment 4

7 days ago
1 failures in 788 pushes (0.001 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* autoland: 1

Platform breakdown:
* windows7-32: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1419802&startday=2018-01-08&endday=2018-01-14&tree=all
You need to log in before you can comment on or make changes to this bug.