1445670 - Assertion failure: !mPendingRequest (mPendingRequest should be null.), at /builds/worker/workspace/build/src/dom/base/nsImageLoadingContent.cpp:1344

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: trigger.html

Testcase found while fuzzing mozilla-central rev c56ef1c14a55.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007f342f2482dd   rbx = 0x00007f34183fbb28
rsi = 0x00007f342f517770   rdi = 0x00007f342f516540
rbp = 0x00007fffc62de760   rsp = 0x00007fffc62de750
r8 = 0x00007f342f517770    r9 = 0x00007f34305e2740
r10 = 0x0000000000000039   r11 = 0x0000000000000000
r12 = 0x00000000ffffffff   r13 = 0x00007f340dd54e00
r14 = 0x00007fffc62de7d0   r15 = 0x0000000000000001
rip = 0x00007f341ec77399
OS|Linux|0.0.0 Linux 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsImageLoadingContent::SetBlockedRequest|hg:hg.mozilla.org/mozilla-central:dom/base/nsImageLoadingContent.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|1344|0x1f
0|1|libxul.so|nsImageLoadingContent::LoadImage|hg:hg.mozilla.org/mozilla-central:dom/base/nsImageLoadingContent.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|930|0x9
0|2|libxul.so|nsImageLoadingContent::LoadImage|hg:hg.mozilla.org/mozilla-central:dom/base/nsImageLoadingContent.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|878|0x1e
0|3|libxul.so|mozilla::dom::HTMLImageElement::LoadSelectedImage|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLImageElement.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|1016|0xf
0|4|libxul.so|mozilla::dom::ImageLoadTask::Run|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLImageElement.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|98|0x1f
0|5|libxul.so|mozilla::CycleCollectedJSContext::ProcessStableStateQueue|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|312|0x11
0|6|libxul.so|mozilla::CycleCollectedJSContext::AfterProcessTask|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|377|0x8
0|7|libxul.so|XPCJSContext::AfterProcessTask|hg:hg.mozilla.org/mozilla-central:js/xpconnect/src/XPCJSContext.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|1253|0xb
0|8|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|1056|0x9
0|9|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|517|0x11
0|10|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|97|0xa
0|11|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c56ef1c14a555023949ad727c86e3c2df995edd2|326|0x17
0|12|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c56ef1c14a555023949ad727c86e3c2df995edd2|319|0x8
0|13|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|157|0xd
0|14|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|893|0x11
0|15|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|269|0x5
0|16|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c56ef1c14a555023949ad727c86e3c2df995edd2|326|0x17
0|17|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c56ef1c14a555023949ad727c86e3c2df995edd2|319|0x8
0|18|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|719|0x8
0|19|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|50|0x14
0|20|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|280|0x11
0|21|libc-2.23.so||||0x20830
0|22|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:c56ef1c14a555023949ad727c86e3c2df995edd2|164|0x5

Comment 1

[Anne (:annevk)]

Looks like it can be null after all (re bug 1267075 comment 35). Boris, needinfo'ing you since you reviewed and suggested this assert.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Lovely.  As of that comment the member could not be null.  Some of the later patches in that bug added more codepaths that can reach SetBlockedRequest() on which it can be null...

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Make sure to clear out the pending request when our image gets blocked by the data document policy

Josh, you've dealt with image loading some.... Reviewers for this stuff are a bit sparse.  :(

Comment 4

[Josh Matthews [:jdm]]

Comment on attachment 8963473 [details] [diff] [review]
Make sure to clear out the pending request when our image gets blocked by the data document policy

Review of attachment 8963473 [details] [diff] [review]:
-----------------------------------------------------------------

I don't see a better solution for this.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ac90c20959de
Make sure to clear out the pending request when our image gets blocked by the data document policy.  r=jdm

Comment 6

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/ac90c20959de

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Is there a user impact which justifies backport consideration for 60, or can this ride the trains?

Comment 8

[Boris Zbarsky [:bzbarsky]]

So the way to trigger this is to have an image that has loaded, then start it loading a new URL, and before that finishes insert it into a non-rendered document (like an XHR responseXML).

And the failure mode is that the request finishes and the image starts pointing at the post-load data instead of the load just getting canceled.

I don't think there's any user impact here.