Closed Bug 1421793 Opened 8 years ago Closed 8 years ago

Assertion failure: mShutdown (Shutdown must be called before dtor.), at /builds/worker/workspace/build/src/netwerk/base/nsPACMan.cpp:351

Categories

(Core :: Networking, defect, P3)

Product:
Core
Component:
Networking
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla59
Tracking Flags:
Tracking Status
firefox-esr52 --- wontfix
firefox57 --- wontfix
firefox58 --- wontfix
firefox59 --- fixed

People

(Reporter: jkratzer, Assigned: xeonchen)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase-wanted, Whiteboard: [necko-triaged])

Attachments

(1 file)

Bug 1421793 - nsPACMan needs to be shutdown before dtor;
59 bytes, text/x-review-board-request
schien
: review+
Details
Found while fuzzing mozilla-central rev 5b33b070378a. I don't currently have a working testcase but will update once one becomes available. OS|Linux|0.0.0 Linux 4.4.0-1041-aws #50-Ubuntu SMP Wed Nov 15 22:18:17 UTC 2017 x86_64 CPU|amd64|family 6 model 63 stepping 2|8 GPU||| Crash|SIGSEGV|0x0|0 0|0|libxul.so|mozilla::net::nsPACMan::~nsPACMan|hg:hg.mozilla.org/mozilla-central:mfbt/LinkedList.h:5b33b070378a|452|0x1c 0|1|libxul.so|mozilla::net::nsPACMan::~nsPACMan|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsPACMan.cpp:5b33b070378a|365|0x5 0|2|libxul.so|mozilla::net::nsPACMan::Release|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsPACMan.cpp:5b33b070378a|674|0x15 0|3|libxul.so|RefPtr<mozilla::net::nsPACMan>::operator=|hg:hg.mozilla.org/mozilla-central:mfbt/RefPtr.h:5b33b070378a|41|0x5 0|4|libxul.so|mozilla::net::nsProtocolProxyService::SetupPACThread|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsProtocolProxyService.cpp:5b33b070378a|1170|0x8 0|5|libxul.so|mozilla::net::nsProtocolProxyService::ConfigureFromPAC|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsProtocolProxyService.cpp:5b33b070378a|1189|0x5 0|6|libxul.so|mozilla::net::nsProtocolProxyService::PrefsChanged|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsProtocolProxyService.cpp:5b33b070378a|817|0xd 0|7|libxul.so|mozilla::net::nsProtocolProxyService::Init|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsProtocolProxyService.cpp:5b33b070378a|531|0xe 0|8|libxul.so|nsProtocolProxyServiceConstructor|hg:hg.mozilla.org/mozilla-central:netwerk/build/nsNetModule.cpp:5b33b070378a|66|0x14 0|9|libxul.so|nsComponentManagerImpl::CreateInstanceByContractID|hg:hg.mozilla.org/mozilla-central:xpcom/components/nsComponentManager.cpp:5b33b070378a|1086|0x1d 0|10|libxul.so|nsComponentManagerImpl::GetServiceByContractID|hg:hg.mozilla.org/mozilla-central:xpcom/components/nsComponentManager.cpp:5b33b070378a|1447|0x8 0|11|libxul.so|nsGetServiceByContractIDWithError::operator()|hg:hg.mozilla.org/mozilla-central:xpcom/components/nsComponentManagerUtils.cpp:5b33b070378a|292|0x5 0|12|libxul.so|mozilla::PeerConnectionMedia::InitProxy|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCOMPtr.h:5b33b070378a|1227|0x10 0|13|libxul.so|mozilla::PeerConnectionMedia::Init|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp:5b33b070378a|389|0x5 0|14|libxul.so|mozilla::PeerConnectionImpl::Initialize|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:5b33b070378a|686|0xb 0|15|libxul.so|mozilla::PeerConnectionImpl::Initialize|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:5b33b070378a|747|0x13 0|16|libxul.so|mozilla::dom::PeerConnectionImplBinding::initialize|s3:gecko-generated-sources:47469b29578be718fc7ce54fa5b35d449fbf20aaad454603cff0b282eb4ad3bca031b6f26ffd38d93ed5fe1c1ba0c2b7233fbcfdf5e3c877fde046e5d2c60d61/dom/bindings/PeerConnectionImplBinding.cpp:|81|0xe 0|17|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:5b33b070378a|3042|0x9 0|18|libxul.so|js::CallJSNative|hg:hg.mozilla.org/mozilla-central:js/src/jscntxtinlines.h:5b33b070378a|291|0x6 0|19|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|473|0xf 0|20|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd 0|21|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|528|0xf 0|22|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb 0|23|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|495|0xf 0|24|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd 0|25|libxul.so|js::Call|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|541|0x5 0|26|libxul.so|JS::Call|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5b33b070378a|3036|0x1c 0|27|libxul.so|mozilla::dom::RTCPeerConnectionJSImpl::__Init|s3:gecko-generated-sources:ed472734003fe20ddf756e2026dbfc81490ffe0d74e17f05ad1ef0721a6a894bd38588fc9804e2f242ed5e5e3cd138ee25f15fa4071093397cd017d2a1107f02/dom/bindings/RTCPeerConnectionBinding.cpp:|7827|0x5 0|28|libxul.so|mozilla::dom::RTCPeerConnection::Constructor|s3:gecko-generated-sources:ed472734003fe20ddf756e2026dbfc81490ffe0d74e17f05ad1ef0721a6a894bd38588fc9804e2f242ed5e5e3cd138ee25f15fa4071093397cd017d2a1107f02/dom/bindings/RTCPeerConnectionBinding.cpp:|9224|0x30 0|29|libxul.so|mozilla::dom::RTCPeerConnectionBinding::_constructor|s3:gecko-generated-sources:ed472734003fe20ddf756e2026dbfc81490ffe0d74e17f05ad1ef0721a6a894bd38588fc9804e2f242ed5e5e3cd138ee25f15fa4071093397cd017d2a1107f02/dom/bindings/RTCPeerConnectionBinding.cpp:|5264|0x32 0|30|libxul.so|js::CallJSNative|hg:hg.mozilla.org/mozilla-central:js/src/jscntxtinlines.h:5b33b070378a|291|0x6 0|31|libxul.so|js::CallJSNativeConstructor|hg:hg.mozilla.org/mozilla-central:js/src/jscntxtinlines.h:5b33b070378a|324|0xf 0|32|libxul.so|InternalConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|580|0xf 0|33|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|3090|0xf 0|34|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb 0|35|libxul.so|js::ExecuteKernel|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|706|0x5 0|36|libxul.so|EvalKernel|hg:hg.mozilla.org/mozilla-central:js/src/builtin/Eval.cpp:5b33b070378a|324|0x1a 0|37|libxul.so|js::IndirectEval|hg:hg.mozilla.org/mozilla-central:js/src/builtin/Eval.cpp:5b33b070378a|417|0x10 0|38|||||0x33823a391ae1 0|39|||||0x7f4f991868c8 0|40|||||0x33823a391e22 0|41|||||0x7f4f98716650 0|42|||||0x33823a2af826 0|43|||||0x7f4f98716ae0 0|44|||||0x33823a2af826 0|45|||||0x7f4f96224850 0|46|||||0x33823a2afadd 0|47|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5b33b070378a|101|0x22 0|48|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|3127|0xb 0|49|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb 0|50|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|495|0xf 0|51|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd 0|52|libxul.so|js::jit::DoCallFallback|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineIC.cpp:5b33b070378a|2551|0x13 0|53|||||0x33823a2c7106 0|54|||||0x7f4fa1bef260 0|55|||||0x33823a2afadd 0|56|libxul.so|js::jit::EnterBaselineAtBranch|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineJIT.cpp:5b33b070378a|151|0x18 0|57|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|2049|0x10 0|58|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb 0|59|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|495|0xf 0|60|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd 0|61|libxul.so|js::jit::DoCallFallback|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineIC.cpp:5b33b070378a|2551|0x13 0|62|||||0x33823a2c7106 0|63|||||0x7f4f969e2da8 0|64|||||0x33823a2af826 0|65|libxul.so|EnterJit|hg:hg.mozilla.org/mozilla-central:js/src/jit/Jit.cpp:5b33b070378a|101|0x22 0|66|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|3127|0xb 0|67|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb 0|68|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|495|0xf 0|69|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|522|0xd 0|70|libxul.so|js::Call|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|541|0x5 0|71|libxul.so|js::jit::InvokeFunction|hg:hg.mozilla.org/mozilla-central:js/src/jit/VMFunctions.cpp:5b33b070378a|112|0x5 0|72|libxul.so|js::jit::InvokeFromInterpreterStub|hg:hg.mozilla.org/mozilla-central:js/src/jit/VMFunctions.cpp:5b33b070378a|141|0x6 0|73|||||0x33823a2b24b2 0|74|||||0x7f4f9aac5fb8 0|75|||||0x33823a2afadd 0|76|libxul.so|js::jit::EnterBaselineAtBranch|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineJIT.cpp:5b33b070378a|151|0x18 0|77|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|2049|0x10 0|78|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|423|0xb 0|79|libxul.so|js::ExecuteKernel|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|706|0x5 0|80|libxul.so|js::Execute|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:5b33b070378a|739|0x5 0|81|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5b33b070378a|4702|0x11 0|82|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:5b33b070378a|4721|0x8 0|83|libxul.so|nsJSUtils::ExecutionContext::CompileAndExec|hg:hg.mozilla.org/mozilla-central:dom/base/nsJSUtils.cpp:5b33b070378a|266|0xc 0|84|libxul.so|mozilla::dom::ScriptLoader::EvaluateScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:5b33b070378a|2272|0x12 0|85|libxul.so|mozilla::dom::ScriptLoader::ProcessRequest|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:5b33b070378a|1914|0xb 0|86|libxul.so|mozilla::dom::ScriptLoader::ProcessScriptElement|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:5b33b070378a|1615|0xf 0|87|libxul.so|mozilla::dom::ScriptElement::MaybeProcessScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptElement.cpp:5b33b070378a|119|0x9 0|88|libxul.so|nsHtml5TreeBuilder::getUnusedStackNode|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeBuilder.cpp:5b33b070378a|3978|0x11 0|89|libxul.so|nsHtml5TreeBuilder::loadState|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeBuilder.cpp:5b33b070378a|4742|0x5 0|90|libxul.so|nsHtml5TreeBuilder::loadState|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeBuilder.cpp:5b33b070378a|4756|0xa 0|91|libxul.so|_fini|||0x24ae48
Should |mPACMan->Shutdown()| be invoked before the |mPACMan = nullptr|, after fail to init? https://searchfox.org/mozilla-central/rev/be78e6ea9b10b1f5b2b3b013f01d86e1062abb2b/netwerk/base/nsProtocolProxyService.cpp#1170
Flags: needinfo?(xeonchen)
Comment on attachment 8933559 [details] Bug 1421793 - nsPACMan needs to be shutdown before dtor; https://reviewboard.mozilla.org/r/204494/#review210052 thanks!
Attachment #8933559 - Flags: review?(schien) → review+
Assignee: nobody → xeonchen
Flags: needinfo?(xeonchen)
Priority: -- → P3
Whiteboard: [necko-triaged]
Jason, I've pushed a treeherder task to try, would you see if it has fixed the issue? Thanks. [1] https://treeherder.mozilla.org/#/jobs?repo=try&revision=589eb05c30b3
Flags: needinfo?(jkratzer)
(In reply to Gary Chen [:xeonchen] (needinfo plz) from comment #4) > Jason, I've pushed a treeherder task to try, would you see if it has fixed > the issue? Thanks. > > [1] https://treeherder.mozilla.org/#/jobs?repo=try&revision=589eb05c30b3 Gary, unfortunately since I cannot reproduce the issue using the current nightly build, there's no way for me to confirm if your Treeherder build corrects the issue.
Flags: needinfo?(jkratzer)
(In reply to Jason Kratzer [:jkratzer] from comment #5) > (In reply to Gary Chen [:xeonchen] (needinfo plz) from comment #4) > > Jason, I've pushed a treeherder task to try, would you see if it has fixed > > the issue? Thanks. > > > > [1] https://treeherder.mozilla.org/#/jobs?repo=try&revision=589eb05c30b3 > > Gary, unfortunately since I cannot reproduce the issue using the current > nightly build, there's no way for me to confirm if your Treeherder build > corrects the issue. That's fine, I believe the patch fixes the issue :)
Pushed by gachen@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/243f87297824 nsPACMan needs to be shutdown before dtor; r=schien
https://hg.mozilla.org/mozilla-central/rev/243f87297824
Status: NEW → RESOLVED
Closed: 8 years ago
status-firefox59: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
Blocks: fuzzing-uri
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: