Open Bug 1547901 Opened 11 months ago Updated 6 months ago

Assertion failure: NS_ERROR_GET_MODULE(aResponse) == 34, at /builds/worker/workspace/build/src/dom/indexedDB/ActorsChild.cpp:3666

Categories

(Core :: Storage: IndexedDB, defect, P2)

defect

Tracking

()

Tracking Status
firefox68 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 420e18a75314.

Assertion failure: NS_ERROR_GET_MODULE(aResponse) == 34, at /builds/worker/workspace/build/src/dom/indexedDB/ActorsChild.cpp:3666

rax = 0x0000556f67132e40 rdx = 0x0000000000000000
rcx = 0x00007f8bb09bbccf rbx = 0x00007f8b870fe540
rsi = 0x00007f8bbb9038b0 rdi = 0x00007f8bbb902680
rbp = 0x00007ffcda650590 rsp = 0x00007ffcda650530
r8 = 0x00007f8bbb9038b0 r9 = 0x00007f8bbca6d740
r10 = 0x0000000000000000 r11 = 0x0000000000000000
r12 = 0x0000000080004005 r13 = 0x00007f8b870fe570
r14 = 0x00007f8b87395400 r15 = 0x00007f8b86ce1500
rip = 0x00007f8bacd4f807
OS|Linux|0.0.0 Linux 4.18.0-17-generic #18~18.04.1-Ubuntu SMP Fri Mar 15 15:27:12 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|mozilla::dom::indexedDB::BackgroundFileRequestChild::HandleResponse(nsresult)|hg:hg.mozilla.org/mozilla-central:dom/indexedDB/ActorsChild.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|3667|0x0
0|1|libxul.so|mozilla::dom::indexedDB::BackgroundFileRequestChild::Recv__delete__(mozilla::dom::FileRequestResponse const&)|hg:hg.mozilla.org/mozilla-central:dom/indexedDB/ActorsChild.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|3741|0x19
0|2|libxul.so|mozilla::dom::PBackgroundFileRequestChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:5a66fdab5610d537b0b4c636ffaf4f9182659f1221a5b5d3b5654cbcaa1a279d64874e838c6fd903352b9d41eb023a11d152c716bca1d4020ceacb17eb272c2a/ipc/ipdl/PBackgroundFileRequestChild.cpp:|95|0xc
0|3|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|2151|0x6
0|4|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|2078|0xb
0|5|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|1937|0xb
0|6|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|1968|0xc
0|7|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|1180|0x15
0|8|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|486|0x11
0|9|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|88|0xa
0|10|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:420e18a75314b8123b515d8a93cbacd145ecb03c|315|0x17
0|11|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:420e18a75314b8123b515d8a93cbacd145ecb03c|290|0x8
0|12|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|137|0xd
0|13|libxul.so|nsAppStartup::Run()|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|270|0xe
0|14|libxul.so|XREMain::XRE_mainRun()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|4578|0x11
0|15|libxul.so|XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|4716|0x8
0|16|libxul.so|XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|4797|0x5
0|17|firefox-bin|do_main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|212|0x22
0|18|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:420e18a75314b8123b515d8a93cbacd145ecb03c|291|0xd
0|19|libc-2.27.so|__libc_start_main|||0xe7
0|20|firefox-bin|_start|||0x29

Flags: in-testsuite?
Blocks: 1541370
Priority: -- → P2
You need to log in before you can comment on or make changes to this bug.