1499099 - Assertion failure: NS_ERROR_GET_MODULE(aResponse) == 34, at /builds/worker/workspace/build/src/dom/indexedDB/ActorsChild.cpp:4187

Status: RESOLVED FIXED

(Core :: Storage: IndexedDB, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 4a230b07f0cb.  Please note that testcase must be served via a local webserver.

Assertion failure: NS_ERROR_GET_MODULE(aResponse) == 34, at /builds/worker/workspace/build/src/dom/indexedDB/ActorsChild.cpp:4187

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007fdb203d5780
rsi = 0x00007fdb3a4ca8b0   rdi = 0x00007fdb3a4c9680
rbp = 0x00007fffead56740   rsp = 0x00007fffead566e0
r8 = 0x00007fdb3a4ca8b0    r9 = 0x00007fdb3b636740
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x0000000080004005   r13 = 0x00007fdb203d57b0
r14 = 0x00007fdb203de280   r15 = 0x00007fdb213f7438
rip = 0x00007fdb2a7fb44d
OS|Linux|0.0.0 Linux 4.15.0-36-generic #39-Ubuntu SMP Mon Sep 24 16:19:09 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|mozilla::dom::indexedDB::BackgroundFileRequestChild::HandleResponse(nsresult)|hg:hg.mozilla.org/mozilla-central:dom/indexedDB/ActorsChild.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|4188|0x5
0|1|libxul.so|mozilla::dom::indexedDB::BackgroundFileRequestChild::Recv__delete__(mozilla::dom::FileRequestResponse const&)|hg:hg.mozilla.org/mozilla-central:dom/indexedDB/ActorsChild.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|4271|0xc
0|2|libxul.so|mozilla::dom::PBackgroundFileRequestChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:f6582fec7037e3a107326051933aae2325a5d2a56e28a002a770b9e92b1e880de3c4808e1fe27e10c746ce1ed45fcbbaeba423a3437f642b703ee5ba69069674/ipc/ipdl/PBackgroundFileRequestChild.cpp:|95|0xc
0|3|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|2248|0x6
0|4|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|2175|0xb
0|5|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|2012|0xb
0|6|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|2045|0xc
0|7|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|337|0x15
0|8|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|1252|0x15
0|9|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|530|0x11
0|10|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|97|0xa
0|11|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|325|0x17
0|12|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|318|0x8
0|13|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|158|0xd
0|14|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|939|0x11
0|15|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|269|0x5
0|16|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|325|0x17
0|17|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|318|0x8
0|18|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|765|0x8
0|19|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|50|0x14
0|20|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|287|0x11
0|21|libc-2.27.so||||0x21b97
0|22|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:4a230b07f0cbf48e87dcb4265ea2d00893bb1b62|164|0x5

Comment 1

[Simon Giesecke [:sg] [he/him]]

I have a Pernosco session for a local reproduction at https://pernos.co/debug/R45C03BECACpuqPqOLNYIw/index.html#f{m[AQbt,A5o_,t[RA,ITs_,f{e[AQbt,AwM_,s{af2SdSoAA,bAYU,oDtWFpQ,uDsd3yg___

Comment 2

[Simon Giesecke [:sg] [he/him]]

I wonder if the assertion at https://searchfox.org/mozilla-central/rev/e878e5b81bb319c141900ce9cfcde732df5c8449/dom/indexedDB/ActorsChild.cpp#3928, which was originally introduced by https://hg.mozilla.org/mozilla-central/rev/ac51f970e85df6b96344c11f3e2f056fb30dfdb9 is correct. If it is, the parent-process code in https://searchfox.org/mozilla-central/rev/e878e5b81bb319c141900ce9cfcde732df5c8449/dom/filehandle/ActorsParent.cpp#1797 should be changed to set the failure code to NS_ERROR_DOM_FILEHANDLE_UNKNOWN_ERR in failure cases not yet handled there. Otherwise, it might just be removed.

Comment 3

[Jan Varga [:janv]]

I think there's a missing ClampResultCode call in: https://searchfox.org/mozilla-central/rev/e878e5b81bb319c141900ce9cfcde732df5c8449/dom/filehandle/ActorsParent.cpp#1762

It should match NormalTransactionOp::SendFailureResult

and it seems ClampResultCode needs to be introduced in dom/filehandle/ActorsParent.cpp first

Comment 4

[Simon Giesecke [:sg] [he/him]]

Attachment: Bug 1499099 - Clamp result codes to NS_ERROR_MODULE_DOM_FILEHANDLE result codes in ActorsParent. r=#dom-workers-and-storage

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c1049c646446
Clamp result codes to NS_ERROR_MODULE_DOM_FILEHANDLE result codes in ActorsParent. r=dom-workers-and-storage-reviewers,ttung

Comment 6

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/c1049c646446