Open Bug 1500116 Opened 2 years ago Updated 9 months ago

Assertion failure: !mPendingRequestCount, at /builds/worker/workspace/build/src/dom/indexedDB/IDBTransaction.cpp:102

Categories

(Core :: Storage: IndexedDB, defect, P3)

defect

Tracking

()

Tracking Status
firefox64 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Testcase found while fuzzing mozilla-central rev 8f709fd4aa46.  Please note that the testcase must be served via a local webserver in order to reproduce.

Assertion failure: !mPendingRequestCount, at /builds/worker/workspace/build/src/dom/indexedDB/IDBTransaction.cpp:102

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007f8b2f1c8890
rsi = 0x00007f8b46e6b8b0   rdi = 0x00007f8b46e6a680
rbp = 0x00007ffe47437fa0   rsp = 0x00007ffe47437f90
r8 = 0x00007f8b46e6b8b0    r9 = 0x00007f8b47fdc740
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007ffe47438068   r13 = 0x00007ffe47437fd8
r14 = 0x00007f8b2f1c8890   r15 = 0x00007ffe47438058
rip = 0x00007f8b371db65b
OS|Linux|0.0.0 Linux 4.15.0-36-generic #39-Ubuntu SMP Mon Sep 24 16:19:09 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|mozilla::dom::IDBTransaction::~IDBTransaction()|hg:hg.mozilla.org/mozilla-central:dom/indexedDB/IDBTransaction.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|103|0x18
0|1|libxul.so|mozilla::dom::IDBTransaction::~IDBTransaction()|hg:hg.mozilla.org/mozilla-central:dom/indexedDB/IDBTransaction.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|133|0x5
0|2|libxul.so|SnowWhiteKiller::MaybeKillObject(SnowWhiteKiller::SnowWhiteObject&)|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|2754|0xd
0|3|libxul.so|SnowWhiteKiller::~SnowWhiteKiller()|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|2740|0xb
0|4|libxul.so|nsCycleCollector::FreeSnowWhite(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|2956|0x5
0|5|libxul.so|nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*)|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|3996|0xd
0|6|libxul.so|nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|3817|0xf
0|7|libxul.so|nsCycleCollector::ShutdownCollect()|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|3757|0x15
0|8|libxul.so|nsCycleCollector::Shutdown(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|4061|0x8
0|9|libxul.so|nsCycleCollector_shutdown(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCycleCollector.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|4466|0x14
0|10|libxul.so|mozilla::ShutdownXPCOM(nsIServiceManager*)|hg:hg.mozilla.org/mozilla-central:xpcom/build/XPCOMInit.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|1012|0xa
0|11|libxul.so|XRE_TermEmbedding()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|227|0x7
0|12|libxul.so|mozilla::ipc::ScopedXREEmbed::Stop()|hg:hg.mozilla.org/mozilla-central:ipc/glue/ScopedXREEmbed.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|108|0x5
0|13|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|769|0x11
0|14|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|50|0x14
0|15|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:8f709fd4aa463ecfc38deda95ac9cc68b5095356|287|0x11
0|16|libc-2.27.so||||0x21b97
0|17|firefox-bin|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:8f709fd4aa463ecfc38deda95ac9cc68b5095356|164|0x5
Flags: in-testsuite?
Jan, could you please assess this?
Flags: needinfo?(jvarga)
Priority: -- → P3
Blocks: 1541370
Flags: needinfo?(jvarga)
You need to log in before you can comment on or make changes to this bug.