Assertion failure: !mPendingRequest (mPendingRequest should be null.), at /builds/worker/workspace/build/src/dom/base/nsImageLoadingContent.cpp:1344

RESOLVED FIXED in Firefox 61

Status

()

defect
RESOLVED FIXED
2 years ago
5 months ago

People

(Reporter: jkratzer, Assigned: bzbarsky)

Tracking

(Blocks 1 bug, {assertion, testcase})

59 Branch
mozilla61
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox59 wontfix, firefox60 wontfix, firefox61 fixed)

Details

Attachments

(2 attachments)

Posted file trigger.html
Testcase found while fuzzing mozilla-central rev c56ef1c14a55.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007f342f2482dd   rbx = 0x00007f34183fbb28
rsi = 0x00007f342f517770   rdi = 0x00007f342f516540
rbp = 0x00007fffc62de760   rsp = 0x00007fffc62de750
r8 = 0x00007f342f517770    r9 = 0x00007f34305e2740
r10 = 0x0000000000000039   r11 = 0x0000000000000000
r12 = 0x00000000ffffffff   r13 = 0x00007f340dd54e00
r14 = 0x00007fffc62de7d0   r15 = 0x0000000000000001
rip = 0x00007f341ec77399
OS|Linux|0.0.0 Linux 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|nsImageLoadingContent::SetBlockedRequest|hg:hg.mozilla.org/mozilla-central:dom/base/nsImageLoadingContent.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|1344|0x1f
0|1|libxul.so|nsImageLoadingContent::LoadImage|hg:hg.mozilla.org/mozilla-central:dom/base/nsImageLoadingContent.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|930|0x9
0|2|libxul.so|nsImageLoadingContent::LoadImage|hg:hg.mozilla.org/mozilla-central:dom/base/nsImageLoadingContent.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|878|0x1e
0|3|libxul.so|mozilla::dom::HTMLImageElement::LoadSelectedImage|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLImageElement.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|1016|0xf
0|4|libxul.so|mozilla::dom::ImageLoadTask::Run|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLImageElement.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|98|0x1f
0|5|libxul.so|mozilla::CycleCollectedJSContext::ProcessStableStateQueue|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|312|0x11
0|6|libxul.so|mozilla::CycleCollectedJSContext::AfterProcessTask|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|377|0x8
0|7|libxul.so|XPCJSContext::AfterProcessTask|hg:hg.mozilla.org/mozilla-central:js/xpconnect/src/XPCJSContext.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|1253|0xb
0|8|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|1056|0x9
0|9|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|517|0x11
0|10|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|97|0xa
0|11|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c56ef1c14a555023949ad727c86e3c2df995edd2|326|0x17
0|12|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c56ef1c14a555023949ad727c86e3c2df995edd2|319|0x8
0|13|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|157|0xd
0|14|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|893|0x11
0|15|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|269|0x5
0|16|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c56ef1c14a555023949ad727c86e3c2df995edd2|326|0x17
0|17|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:c56ef1c14a555023949ad727c86e3c2df995edd2|319|0x8
0|18|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|719|0x8
0|19|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|50|0x14
0|20|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:c56ef1c14a555023949ad727c86e3c2df995edd2|280|0x11
0|21|libc-2.23.so||||0x20830
0|22|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:c56ef1c14a555023949ad727c86e3c2df995edd2|164|0x5
Flags: in-testsuite?
Looks like it can be null after all (re bug 1267075 comment 35). Boris, needinfo'ing you since you reviewed and suggested this assert.
Flags: needinfo?(bzbarsky)
Lovely.  As of that comment the member could not be null.  Some of the later patches in that bug added more codepaths that can reach SetBlockedRequest() on which it can be null...
Assignee: nobody → bzbarsky
Flags: needinfo?(bzbarsky)
Josh, you've dealt with image loading some.... Reviewers for this stuff are a bit sparse.  :(
Attachment #8963473 - Flags: review?(josh)
Comment on attachment 8963473 [details] [diff] [review]
Make sure to clear out the pending request when our image gets blocked by the data document policy

Review of attachment 8963473 [details] [diff] [review]:
-----------------------------------------------------------------

I don't see a better solution for this.
Attachment #8963473 - Flags: review?(josh) → review+
Pushed by bzbarsky@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ac90c20959de
Make sure to clear out the pending request when our image gets blocked by the data document policy.  r=jdm
https://hg.mozilla.org/mozilla-central/rev/ac90c20959de
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Is there a user impact which justifies backport consideration for 60, or can this ride the trains?
Blocks: 1267075
Flags: needinfo?(bzbarsky)
Flags: in-testsuite?
Flags: in-testsuite+
So the way to trigger this is to have an image that has loaded, then start it loading a new URL, and before that finishes insert it into a non-rendered document (like an XHR responseXML).

And the failure mode is that the request finishes and the image starts pointing at the post-load data instead of the load just getting canceled.

I don't think there's any user impact here.
Flags: needinfo?(bzbarsky)
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.