1619329 - AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadBound.h:135:3 in AssertIsCorrectThread

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect, P1)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 51efc4b931f7.

==18551==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f5c8cc070a1 bp 0x7fffd6c12850 sp 0x7fffd6c12830 T0)
==18551==The signal is caused by a WRITE memory access.
==18551==Hint: address points to the zero page.
    #0 0x7f5c8cc070a0 in AssertIsCorrectThread /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadBound.h:135:3
    #1 0x7f5c8cc070a0 in mozilla::ThreadBound<mozilla::dom::RemoteWorkerChild::LauncherBoundData>::Accessor<false>::Accessor(mozilla::ThreadBound<mozilla::dom::RemoteWorkerChild::LauncherBoundData>&) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadBound.h:100:20
    #2 0x7f5c8cc0d1a4 in mozilla::dom::RemoteWorkerChild::ErrorPropagation(mozilla::dom::ErrorValue const&) /builds/worker/workspace/build/src/dom/workers/remoteworkers/RemoteWorkerChild.cpp:619:3
    #3 0x7f5c8cc20ff7 in mozilla::dom::RemoteWorkerChild::SharedWorkerOp::Exec(mozilla::dom::SelfHolder&) /builds/worker/workspace/build/src/dom/workers/remoteworkers/RemoteWorkerChild.cpp:919:17
    #4 0x7f5c8cc209fe in mozilla::dom::RemoteWorkerChild::SharedWorkerOp::MaybeStart(mozilla::dom::RemoteWorkerChild*, mozilla::Variant<mozilla::dom::RemoteWorkerChild::Pending, mozilla::dom::RemoteWorkerChild::Running, mozilla::dom::RemoteWorkerChild::PendingTerminated, mozilla::dom::RemoteWorkerChild::Terminated>&)::'lambda'()::operator()() /builds/worker/workspace/build/src/dom/workers/remoteworkers/RemoteWorkerChild.cpp:861:17
    #5 0x7f5c8cc206ac in mozilla::detail::RunnableFunction<mozilla::dom::RemoteWorkerChild::SharedWorkerOp::MaybeStart(mozilla::dom::RemoteWorkerChild*, mozilla::Variant<mozilla::dom::RemoteWorkerChild::Pending, mozilla::dom::RemoteWorkerChild::Running, mozilla::dom::RemoteWorkerChild::PendingTerminated, mozilla::dom::RemoteWorkerChild::Terminated>&)::'lambda'()>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:557:5
    #6 0x7f5c84f7ddad in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/workspace/build/src/xpcom/threads/SchedulerGroup.cpp:282:20
    #7 0x7f5c84fb2328 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1220:14
    #8 0x7f5c84fbd18c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:481:10
    #9 0x7f5c86223def in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:87:21
    #10 0x7f5c861167c7 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #11 0x7f5c861167c7 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #12 0x7f5c861167c7 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #13 0x7f5c8d2ad738 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #14 0x7f5c90e29b76 in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:926:20
    #15 0x7f5c861167c7 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #16 0x7f5c861167c7 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #17 0x7f5c861167c7 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #18 0x7f5c90e29238 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:761:34
    #19 0x555b12564f83 in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #20 0x555b12564f83 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:303:18
    #21 0x7f5ca7c0fb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadBound.h:135:3 in AssertIsCorrectThread

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: worker.js

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: prefs.js

Comment 3

[Jason Kratzer [:jkratzer]]

BugMon:Unable to reproduce bug on rev 51efc4b931f7

Comment 4

[Jason Kratzer [:jkratzer]]

BugMon:Unable to reproduce bug on rev 51efc4b931f7

Comment 5

[Jason Kratzer [:jkratzer]]

Please note, the testcase reproduces but takes up to 60 seconds or more and BugMon cannot currently handle this condition.

Comment 6

[Jens Stutte [:jstutte]]

Hi Andrew, are you able to get to this soon?

Comment 7

[Andrew Sutherland [:asuth] (he/him)]

Attachment: Bug 1619329 - Error propagation on main thread needs to be dispatched. r=perry

Comment 8

[Andrew Sutherland [:asuth] (he/him)]

Patch up.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a19376112fb6
Error propagation on main thread needs to be dispatched. r=dom-workers-and-storage-reviewers,sg

Comment 10

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/a19376112fb6