Open Bug 1614357 Opened 2 months ago Updated 3 days ago

AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:332:3 in MOZ_Crash

Categories

(Core :: DOM: Service Workers, defect, P2, critical)

defect

Tracking

()

Tracking Status
firefox75 --- wontfix

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase)

Attachments

(3 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev d3aa4a9e4dfd. Testcase must be served over HTTP in order to reproduce.

==31888==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7fa30a6544b0 bp 0x7ffeeded37b0 sp 0x7ffeeded37a0 T0)
==31888==The signal is caused by a WRITE memory access.
==31888==Hint: address points to the zero page.
    #0 0x7fa30a6544af in MOZ_Crash /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:332:3
    #1 0x7fa30a6544af in nsAutoOwningThread::AssertCurrentThreadOwnsMe(char const*) const /builds/worker/workspace/build/src/xpcom/base/nsISupportsImpl.cpp:40:5
    #2 0x7fa3123ab9b8 in AssertOwnership<36> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:59:5
    #3 0x7fa3123ab9b8 in mozilla::dom::RemoteWorkerManager::Release() /builds/worker/workspace/build/src/dom/workers/remoteworkers/RemoteWorkerManager.h:26:3
    #4 0x7fa3123c1d33 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:50:40
    #5 0x7fa3123c1d33 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:379:36
    #6 0x7fa3123c1d33 in ~RefPtr /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:81:7
    #7 0x7fa3123c1d33 in ~ /builds/worker/workspace/build/src/dom/workers/remoteworkers/RemoteWorkerManager.cpp:382:17
    #8 0x7fa3123c1d33 in mozilla::Maybe<mozilla::dom::RemoteWorkerManager::LaunchNewContentProcess(mozilla::dom::RemoteWorkerData const&)::$_19::operator()()::'lambda'(mozilla::ipc::LaunchError const&)>::reset() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:444:17
    #9 0x7fa3122595d2 in mozilla::MozPromise<RefPtr<mozilla::dom::ContentParent>, mozilla::ipc::LaunchError, false>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/MozPromise.h:403:21
    #10 0x7fa30a7f8358 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1220:14
    #11 0x7fa30a80316c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
    #12 0x7fa30ba54f6f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:87:21
    #13 0x7fa30b94e6d7 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #14 0x7fa30b94e6d7 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #15 0x7fa30b94e6d7 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #16 0x7fa312a23a08 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #17 0x7fa31631874b in nsAppStartup::Run() /builds/worker/workspace/build/src/toolkit/components/startup/nsAppStartup.cpp:272:30
    #18 0x7fa31652c501 in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4566:22
    #19 0x7fa31652e426 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4701:8
    #20 0x7fa31652f103 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4752:21
    #21 0x55e1d397a8ff in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:217:22
    #22 0x55e1d397a8ff in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:331:16
    #23 0x7fa32d2d2b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #24 0x55e1d38cfecc in _start (/home/forb1dden/builds/mc-asan/firefox+0x9becc)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:332:3 in MOZ_Crash
Flags: in-testsuite?
Attached file worker.js
Attached file prefs.js
Priority: -- → P2

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression

Fix optional because it's a crash from fuzzing tools.

You need to log in before you can comment on or make changes to this bug.