Closed Bug 1421793 Opened 2 years ago Closed 2 years ago

Assertion failure: mShutdown (Shutdown must be called before dtor.), at /builds/worker/workspace/build/src/netwerk/base/nsPACMan.cpp:351

Categories

(Core :: Networking, defect, P3)

defect

Tracking

()

RESOLVED FIXED
mozilla59
Tracking Status
firefox-esr52 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- fixed

People

(Reporter: jkratzer, Assigned: xeonchen)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase-wanted, Whiteboard: [necko-triaged])

Attachments

(1 file)

Found while fuzzing mozilla-central rev 5b33b070378a.

I don't currently have a working testcase but will update once one becomes available.

OS|Linux|0.0.0 Linux 4.4.0-1041-aws #50-Ubuntu SMP Wed Nov 15 22:18:17 UTC 2017 x86_64
CPU|amd64|family 6 model 63 stepping 2|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::net::nsPACMan::~nsPACMan|hg:hg.mozilla.org/mozilla-central:mfbt/LinkedList.h:5b33b070378a|452|0x1c
0|1|libxul.so|mozilla::net::nsPACMan::~nsPACMan|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsPACMan.cpp:5b33b070378a|365|0x5
0|2|libxul.so|mozilla::net::nsPACMan::Release|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsPACMan.cpp:5b33b070378a|674|0x15
0|3|libxul.so|RefPtr<mozilla::net::nsPACMan>::operator=|hg:hg.mozilla.org/mozilla-central:mfbt/RefPtr.h:5b33b070378a|41|0x5
0|4|libxul.so|mozilla::net::nsProtocolProxyService::SetupPACThread|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsProtocolProxyService.cpp:5b33b070378a|1170|0x8
0|5|libxul.so|mozilla::net::nsProtocolProxyService::ConfigureFromPAC|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsProtocolProxyService.cpp:5b33b070378a|1189|0x5
0|6|libxul.so|mozilla::net::nsProtocolProxyService::PrefsChanged|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsProtocolProxyService.cpp:5b33b070378a|817|0xd
0|7|libxul.so|mozilla::net::nsProtocolProxyService::Init|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsProtocolProxyService.cpp:5b33b070378a|531|0xe
0|8|libxul.so|nsProtocolProxyServiceConstructor|hg:hg.mozilla.org/mozilla-central:netwerk/build/nsNetModule.cpp:5b33b070378a|66|0x14
0|9|libxul.so|nsComponentManagerImpl::CreateInstanceByContractID|hg:hg.mozilla.org/mozilla-central:xpcom/components/nsComponentManager.cpp:5b33b070378a|1086|0x1d
0|10|libxul.so|nsComponentManagerImpl::GetServiceByContractID|hg:hg.mozilla.org/mozilla-central:xpcom/components/nsComponentManager.cpp:5b33b070378a|1447|0x8
0|11|libxul.so|nsGetServiceByContractIDWithError::operator()|hg:hg.mozilla.org/mozilla-central:xpcom/components/nsComponentManagerUtils.cpp:5b33b070378a|292|0x5
0|12|libxul.so|mozilla::PeerConnectionMedia::InitProxy|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCOMPtr.h:5b33b070378a|1227|0x10
0|13|libxul.so|mozilla::PeerConnectionMedia::Init|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp:5b33b070378a|389|0x5
0|14|libxul.so|mozilla::PeerConnectionImpl::Initialize|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:5b33b070378a|686|0xb
0|15|libxul.so|mozilla::PeerConnectionImpl::Initialize|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:5b33b070378a|747|0x13
0|16|libxul.so|mozilla::dom::PeerConnectionImplBinding::initialize|s3:gecko-generated-sources:47469b29578be718fc7ce54fa5b35d449fbf20aaad454603cff0b282eb4ad3bca031b6f26ffd38d93ed5fe1c1ba0c2b7233fbcfdf5e3c877fde046e5d2c60d61/dom/bindings/PeerConnectionImplBinding.cpp:|81|0xe
0|17|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:5b33b070378a|3042|0x9
0|18|libxul.so|js::CallJSNative|hg:hg.mozilla.org/mozilla-central:js/src/jscntxtinlines.h:5b33b070378a|291|0x6
0|19|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|473|0xf
0|20|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd
0|21|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|528|0xf
0|22|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb
0|23|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|495|0xf
0|24|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd
0|25|libxul.so|js::Call|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|541|0x5
0|26|libxul.so|JS::Call|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5b33b070378a|3036|0x1c
0|27|libxul.so|mozilla::dom::RTCPeerConnectionJSImpl::__Init|s3:gecko-generated-sources:ed472734003fe20ddf756e2026dbfc81490ffe0d74e17f05ad1ef0721a6a894bd38588fc9804e2f242ed5e5e3cd138ee25f15fa4071093397cd017d2a1107f02/dom/bindings/RTCPeerConnectionBinding.cpp:|7827|0x5
0|28|libxul.so|mozilla::dom::RTCPeerConnection::Constructor|s3:gecko-generated-sources:ed472734003fe20ddf756e2026dbfc81490ffe0d74e17f05ad1ef0721a6a894bd38588fc9804e2f242ed5e5e3cd138ee25f15fa4071093397cd017d2a1107f02/dom/bindings/RTCPeerConnectionBinding.cpp:|9224|0x30
0|29|libxul.so|mozilla::dom::RTCPeerConnectionBinding::_constructor|s3:gecko-generated-sources:ed472734003fe20ddf756e2026dbfc81490ffe0d74e17f05ad1ef0721a6a894bd38588fc9804e2f242ed5e5e3cd138ee25f15fa4071093397cd017d2a1107f02/dom/bindings/RTCPeerConnectionBinding.cpp:|5264|0x32
0|30|libxul.so|js::CallJSNative|hg:hg.mozilla.org/mozilla-central:js/src/jscntxtinlines.h:5b33b070378a|291|0x6
0|31|libxul.so|js::CallJSNativeConstructor|hg:hg.mozilla.org/mozilla-central:js/src/jscntxtinlines.h:5b33b070378a|324|0xf
0|32|libxul.so|InternalConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|580|0xf
0|33|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|3090|0xf
0|34|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb
0|35|libxul.so|js::ExecuteKernel|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|706|0x5
0|36|libxul.so|EvalKernel|hg:hg.mozilla.org/mozilla-central:js/src/builtin/Eval.cpp:5b33b070378a|324|0x1a
0|37|libxul.so|js::IndirectEval|hg:hg.mozilla.org/mozilla-central:js/src/builtin/Eval.cpp:5b33b070378a|417|0x10
0|38|||||0x33823a391ae1
0|39|||||0x7f4f991868c8
0|40|||||0x33823a391e22
0|41|||||0x7f4f98716650
0|42|||||0x33823a2af826
0|43|||||0x7f4f98716ae0
0|44|||||0x33823a2af826
0|45|||||0x7f4f96224850
0|46|||||0x33823a2afadd
0|47|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5b33b070378a|101|0x22
0|48|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|3127|0xb
0|49|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb
0|50|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|495|0xf
0|51|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd
0|52|libxul.so|js::jit::DoCallFallback|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineIC.cpp:5b33b070378a|2551|0x13
0|53|||||0x33823a2c7106
0|54|||||0x7f4fa1bef260
0|55|||||0x33823a2afadd
0|56|libxul.so|js::jit::EnterBaselineAtBranch|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineJIT.cpp:5b33b070378a|151|0x18
0|57|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|2049|0x10
0|58|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb
0|59|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|495|0xf
0|60|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd
0|61|libxul.so|js::jit::DoCallFallback|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineIC.cpp:5b33b070378a|2551|0x13
0|62|||||0x33823a2c7106
0|63|||||0x7f4f969e2da8
0|64|||||0x33823a2af826
0|65|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5b33b070378a|101|0x22
0|66|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|3127|0xb
0|67|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb
0|68|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|495|0xf
0|69|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd
0|70|libxul.so|js::Call|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|541|0x5
0|71|libxul.so|js::jit::InvokeFunction|hg:hg.mozilla.org/mozilla-central:js/src/jit/VMFunctions.cpp:5b33b070378a|112|0x5
0|72|libxul.so|js::jit::InvokeFromInterpreterStub|hg:hg.mozilla.org/mozilla-central:js/src/jit/VMFunctions.cpp:5b33b070378a|141|0x6
0|73|||||0x33823a2b24b2
0|74|||||0x7f4f9aac5fb8
0|75|||||0x33823a2afadd
0|76|libxul.so|js::jit::EnterBaselineAtBranch|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineJIT.cpp:5b33b070378a|151|0x18
0|77|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|2049|0x10
0|78|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb
0|79|libxul.so|js::ExecuteKernel|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|706|0x5
0|80|libxul.so|js::Execute|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|739|0x5
0|81|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5b33b070378a|4702|0x11
0|82|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5b33b070378a|4721|0x8
0|83|libxul.so|nsJSUtils::ExecutionContext::CompileAndExec|hg:hg.mozilla.org/mozilla-central:dom/base/nsJSUtils.cpp:5b33b070378a|266|0xc
0|84|libxul.so|mozilla::dom::ScriptLoader::EvaluateScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:5b33b070378a|2272|0x12
0|85|libxul.so|mozilla::dom::ScriptLoader::ProcessRequest|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:5b33b070378a|1914|0xb
0|86|libxul.so|mozilla::dom::ScriptLoader::ProcessScriptElement|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:5b33b070378a|1615|0xf
0|87|libxul.so|mozilla::dom::ScriptElement::MaybeProcessScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptElement.cpp:5b33b070378a|119|0x9
0|88|libxul.so|nsHtml5TreeBuilder::getUnusedStackNode|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeBuilder.cpp:5b33b070378a|3978|0x11
0|89|libxul.so|nsHtml5TreeBuilder::loadState|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeBuilder.cpp:5b33b070378a|4742|0x5
0|90|libxul.so|nsHtml5TreeBuilder::loadState|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeBuilder.cpp:5b33b070378a|4756|0xa
0|91|libxul.so|_fini|||0x24ae48
Should |mPACMan->Shutdown()| be invoked before the |mPACMan = nullptr|, after fail to init?

https://searchfox.org/mozilla-central/rev/be78e6ea9b10b1f5b2b3b013f01d86e1062abb2b/netwerk/base/nsProtocolProxyService.cpp#1170
Flags: needinfo?(xeonchen)
Comment on attachment 8933559 [details]
Bug 1421793 - nsPACMan needs to be shutdown before dtor;

https://reviewboard.mozilla.org/r/204494/#review210052

thanks!
Attachment #8933559 - Flags: review?(schien) → review+
Assignee: nobody → xeonchen
Flags: needinfo?(xeonchen)
Priority: -- → P3
Whiteboard: [necko-triaged]
Jason, I've pushed a treeherder task to try, would you see if it has fixed the issue? Thanks.

[1] https://treeherder.mozilla.org/#/jobs?repo=try&revision=589eb05c30b3
Flags: needinfo?(jkratzer)
(In reply to Gary Chen [:xeonchen] (needinfo plz) from comment #4)
> Jason, I've pushed a treeherder task to try, would you see if it has fixed
> the issue? Thanks.
> 
> [1] https://treeherder.mozilla.org/#/jobs?repo=try&revision=589eb05c30b3

Gary, unfortunately since I cannot reproduce the issue using the current nightly build, there's no way for me to confirm if your Treeherder build corrects the issue.
Flags: needinfo?(jkratzer)
(In reply to Jason Kratzer [:jkratzer] from comment #5)
> (In reply to Gary Chen [:xeonchen] (needinfo plz) from comment #4)
> > Jason, I've pushed a treeherder task to try, would you see if it has fixed
> > the issue? Thanks.
> > 
> > [1] https://treeherder.mozilla.org/#/jobs?repo=try&revision=589eb05c30b3
> 
> Gary, unfortunately since I cannot reproduce the issue using the current
> nightly build, there's no way for me to confirm if your Treeherder build
> corrects the issue.

That's fine, I believe the patch fixes the issue :)
Pushed by gachen@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/243f87297824
nsPACMan needs to be shutdown before dtor; r=schien
https://hg.mozilla.org/mozilla-central/rev/243f87297824
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
You need to log in before you can comment on or make changes to this bug.