1594117 - Assertion failure: !mPuppetWidget->HasLayerManager(), at /builds/worker/workspace/build/src/dom/ipc/BrowserChild.cpp:2684

Status: NEW

(Core :: Graphics, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 4d585c7edc76.

Assertion failure: !mPuppetWidget->HasLayerManager(), at /builds/worker/workspace/build/src/dom/ipc/BrowserChild.cpp:2684

rax = 0x000055b5e9450340   rdx = 0x00007f6d081079cb
rcx = 0x0000000000000b40   rbx = 0x00007fff2c52afb3
rsi = 0x00007f6d13aa28b0   rdi = 0x00007f6d13aa1680
rbp = 0x00007fff2c52aff0   rsp = 0x00007fff2c52af70
r8 = 0x00007f6d13aa28b0    r9 = 0x00007f6d14c0b780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007f6cf94be800   r13 = 0x00007fff2c52af90
r14 = 0x00007fff2c52af88   r15 = 0x00007fff2c52b0d0
rip = 0x00007f6d041bd4d8
OS|Linux|0.0.0 Linux 5.0.0-31-generic #33~18.04.1-Ubuntu SMP Tue Oct 1 10:20:39 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::BrowserChild::InitRenderingState(mozilla::layers::TextureFactoryIdentifier const&, mozilla::layers::LayersId const&, mozilla::layers::CompositorOptions const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|2679|0x4b
0|1|libxul.so|mozilla::dom::BrowserChild::RecvInitRendering(mozilla::layers::TextureFactoryIdentifier const&, mozilla::layers::LayersId const&, mozilla::layers::CompositorOptions const&, bool const&)|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|1229|0x13
0|2|libxul.so|mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:33bb006a55aa6228b3ccc1645a4f5a1cd062a0ec4b940b781a9a39325ad757abdc2ad55d676f944692042eecfee65ac121302b8c37e35367f3283310d35105ce/ipc/ipdl/PBrowserChild.cpp:|4486|0x21
0|3|libxul.so|mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:1f0c2e75b618a5986147dae66c5c36335c29d9195f9db8571d41bb8961afa05eb756ece0caaf47d91915b597e6c3893ff95cb4bf77e19058e17cf956bee1961c/ipc/ipdl/PContentChild.cpp:|7817|0x15
0|4|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|2208|0x6
0|5|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|2130|0xb
0|6|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|1972|0xb
0|7|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|2003|0xc
0|8|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|295|0x15
0|9|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|1225|0x15
0|10|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|486|0x11
0|11|libxul.so|mozilla::dom::ContentChild::ProvideWindowCommon(mozilla::dom::BrowserChild*, mozIDOMWindowProxy*, bool, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)|hg:hg.mozilla.org/mozilla-central:dom/ipc/ContentChild.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|1242|0x8e
0|12|libxul.so|mozilla::dom::BrowserChild::ProvideWindow(mozIDOMWindowProxy*, unsigned int, bool, bool, bool, nsIURI*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, bool, bool, nsDocShellLoadState*, bool*, mozilla::dom::BrowsingContext**)|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|955|0x19
0|13|libxul.so|nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, bool, nsDocShellLoadState*, mozilla::dom::BrowsingContext**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|810|0x2f
0|14|libxul.so|nsWindowWatcher::OpenWindow2(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsISupports*, bool, bool, bool, nsDocShellLoadState*, mozilla::dom::BrowsingContext**)|hg:hg.mozilla.org/mozilla-central:toolkit/components/windowwatcher/nsWindowWatcher.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|381|0xa
0|15|libxul.so|nsGlobalWindowOuter::OpenInternal(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, bool, bool, bool, bool, bool, nsIArray*, nsISupports*, nsDocShellLoadState*, bool, mozilla::dom::BrowsingContext**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|7276|0x5f
0|16|libxul.so|nsGlobalWindowOuter::OpenJS(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::BrowsingContext**)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|5787|0x18
0|17|libxul.so|nsGlobalWindowOuter::OpenOuter(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowOuter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|5751|0x1f
0|18|libxul.so|nsGlobalWindowInner::Open(nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|3797|0x29
0|19|libxul.so|mozilla::dom::Window_Binding::open|s3:gecko-generated-sources:e5c326c412ea702ebf7ae3b537201b7e6e63bf31da2968d3630a84879b95bfeaa10a251c4e9a41c98ee677ae5ac81233fddf3dc4f18149fa0a35200f450e0866/dom/bindings/WindowBinding.cpp:|2623|0x2d
0|20|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|3218|0x24
0|21|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|456|0x15
0|22|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|548|0x15
0|23|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|617|0x10
0|24|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|621|0x15
0|25|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|423|0xb
0|26|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|589|0x13
0|27|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|617|0x10
0|28|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|634|0x8
0|29|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|2718|0x1f
0|30|libxul.so|mozilla::dom::NavigatorUserMediaErrorCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::MediaStreamError&, mozilla::ErrorResult&)|s3:gecko-generated-sources:33fce02a7d37486900cec11d138f709446f00a8e4cb151a1f6eb76782c3255b1791a5afb1c8f60d510e1613af327c7ba77155493bd1d6be4656ab06d4bc9582c/dom/bindings/NavigatorBinding.cpp:|266|0x5
0|31|libxul.so|mozilla::dom::NavigatorUserMediaErrorCallback::Call(mozilla::dom::MediaStreamError&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:7ba3f8bc8f32b2852a4adf1929d843a1692a7a8a67a8b7c726c2e31c61a484e857af005603be02888c058bddd4cdbe1fb06650f83fdb59a9350fb7f48bf13012/dist/include/mozilla/dom/NavigatorBinding.h:|233|0x15
0|32|libxul.so|mozilla::MediaManager::CallOnError(mozilla::dom::NavigatorUserMediaErrorCallback&, mozilla::dom::MediaStreamError&)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaManager.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|288|0x21
0|33|libxul.so|mozilla::dom::Navigator::MozGetUserMedia(mozilla::dom::MediaStreamConstraints const&, mozilla::dom::NavigatorUserMediaSuccessCallback&, mozilla::dom::NavigatorUserMediaErrorCallback&, mozilla::dom::CallerType, mozilla::ErrorResult&)::{lambda(RefPtr<mozilla::MediaMgrError> const&)#2}::operator()(RefPtr<mozilla::MediaMgrError> const&) const|||0x162
0|34|libxul.so|mozilla::MozPromise<RefPtr<mozilla::DOMMediaStream>, RefPtr<mozilla::MediaMgrError>, true>::ThenValue<mozilla::dom::Navigator::MozGetUserMedia(const mozilla::dom::MediaStreamConstraints&, mozilla::dom::NavigatorUserMediaSuccessCallback&, mozilla::dom::NavigatorUserMediaErrorCallback&, mozilla::dom::CallerType, mozilla::ErrorResult&)::<lambda(const RefPtr<mozilla::DOMMediaStream>&)>, mozilla::dom::Navigator::MozGetUserMedia(const mozilla::dom::MediaStreamConstraints&, mozilla::dom::NavigatorUserMediaSuccessCallback&, mozilla::dom::NavigatorUserMediaErrorCallback&, mozilla::dom::CallerType, mozilla::ErrorResult&)::<lambda(const RefPtr<mozilla::MediaMgrError>&)> >::DoResolveOrRejectInternal|hg:hg.mozilla.org/mozilla-central:xpcom/threads/MozPromise.h:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|730|0x6b
0|35|libxul.so|mozilla::MozPromise<RefPtr<mozilla::DOMMediaStream>, RefPtr<mozilla::MediaMgrError>, true>::ThenValueBase::ResolveOrRejectRunnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/MozPromise.h:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|402|0x5e
0|36|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|1225|0x15
0|37|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|486|0x11
0|38|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|88|0xa
0|39|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|315|0x17
0|40|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|290|0x8
0|41|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|137|0xd
0|42|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|934|0x11
0|43|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|238|0x5
0|44|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|315|0x17
0|45|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|290|0x8
0|46|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|769|0xc
0|47|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|56|0x14
0|48|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|272|0x12
0|49|libc-2.27.so||||0x21b97
0|50|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:4d585c7edc7683e4b35eca6b18c9a646a1b8a78d|203|0x5

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jimm, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jbonisteel, could you have a look please?

For more information, please visit auto_nag documentation.