1655740 - Assertion failure: spec.LowerCaseEqualsLiteral("about:blank") || StringBeginsWith(spec, "blob:"_ns) || StorageAllowedForWindow(aInnerWindow) == StorageAccess::eAllow, at /builds/worker/checkouts/gecko/dom/clients/manager/ClientSource.cpp:269

Status: RESOLVED FIXED

(Core :: DOM: Service Workers, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev eba7e3ce9382 (built with --enable-debug). Testcase must be served via HTTP in order to reproduce.

Assertion failure: spec.LowerCaseEqualsLiteral("about:blank") || StringBeginsWith(spec, "blob:"_ns) || StorageAllowedForWindow(aInnerWindow) == StorageAccess::eAllow, at /builds/worker/checkouts/gecko/dom/clients/manager/ClientSource.cpp:269

==29745==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f5cadf5ae9f bp 0x7ffc1156d6d0 sp 0x7ffc1156d670 T29745)
==29745==The signal is caused by a WRITE memory access.
==29745==Hint: address points to the zero page.
    #0 0x7f5cadf5ae9e in AnnotateMozCrashReason /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:42:19
    #1 0x7f5cadf5ae9e in mozilla::dom::ClientSource::WindowExecutionReady(nsPIDOMWindowInner*) /builds/worker/checkouts/gecko/dom/clients/manager/ClientSource.cpp:267:5
    #2 0x7f5cac6a4199 in nsGlobalWindowInner::ExecutionReady() /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:1814:23
    #3 0x7f5cac6ce2f1 in nsGlobalWindowOuter::SetNewDocument(mozilla::dom::Document*, nsISupports*, bool, mozilla::dom::WindowGlobalChild*) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:2388:26
    #4 0x7f5caf4723c6 in nsDocumentViewer::InitInternal(nsIWidget*, nsISupports*, mozilla::dom::WindowGlobalChild*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, bool, bool, bool) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:905:22
    #5 0x7f5caf471fba in nsDocumentViewer::Init(nsIWidget*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::dom::WindowGlobalChild*) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:694:10
    #6 0x7f5cb04702f4 in nsDocShell::SetupNewViewer(nsIContentViewer*, mozilla::dom::WindowGlobalChild*) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:7934:7
    #7 0x7f5cb046f887 in nsDocShell::Embed(nsIContentViewer*, mozilla::dom::WindowGlobalChild*) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5372:17
    #8 0x7f5cb045169d in nsDocShell::CreateContentViewer(nsTSubstring<char> const&, nsIRequest*, nsIStreamListener**) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:7746:3
    #9 0x7f5cb04500f9 in nsDSURIContentListener::DoContent(nsTSubstring<char> const&, bool, nsIRequest*, nsIStreamListener**, bool*) /builds/worker/checkouts/gecko/docshell/base/nsDSURIContentListener.cpp:182:20
    #10 0x7f5cabe01e58 in nsDocumentOpenInfo::TryContentListener(nsIURIContentListener*, nsIChannel*) /builds/worker/checkouts/gecko/uriloader/base/nsURILoader.cpp:597:18
    #11 0x7f5cabe00e8a in nsDocumentOpenInfo::DispatchContent(nsIRequest*, nsISupports*) /builds/worker/checkouts/gecko/uriloader/base/nsURILoader.cpp:276:9
    #12 0x7f5cabe005db in nsDocumentOpenInfo::OnStartRequest(nsIRequest*) /builds/worker/checkouts/gecko/uriloader/base/nsURILoader.cpp:154:8
    #13 0x7f5caae1c04d in mozilla::net::HttpChannelChild::DoOnStartRequest(nsIRequest*, nsISupports*) /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelChild.cpp:727:20
    #14 0x7f5caae2418d in mozilla::net::HttpChannelChild::OnStartRequest(mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, mozilla::net::HttpChannelOnStartRequestArgs const&) /builds/worker/checkouts/gecko/netwerk/protocol/http/HttpChannelChild.cpp:602:3
    #15 0x7f5cab01ffb0 in mozilla::net::ChannelEventQueue::FlushQueue() /builds/worker/checkouts/gecko/netwerk/ipc/ChannelEventQueue.cpp:90:12
    #16 0x7f5cab053cc0 in mozilla::net::ChannelEventQueue::ResumeInternal()::CompleteResumeRunnable::Run() /builds/worker/checkouts/gecko/netwerk/ipc/ChannelEventQueue.cpp:148:17
    #17 0x7f5caa876142 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:146:20
    #18 0x7f5caa87c194 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:242:16
    #19 0x7f5caa879f5d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:512:26
    #20 0x7f5caa878d44 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:371:15
    #21 0x7f5caa878f36 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:168:36
    #22 0x7f5caa880bc9 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:86:37
    #23 0x7f5caa880bc9 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_5>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #24 0x7f5caa8948f9 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1234:14
    #25 0x7f5caa89a41a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #26 0x7f5cab1a6564 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:109:5
    #27 0x7f5cab117823 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #28 0x7f5cab11773d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #29 0x7f5cab11773d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #30 0x7f5caf15c6a8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #31 0x7f5cb096ef33 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #32 0x7f5cab1a7337 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #33 0x7f5cab117823 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #34 0x7f5cab11773d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #35 0x7f5cab11773d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #36 0x7f5cb096ea27 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #37 0x5590bd30ffb8 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #38 0x5590bd30ffb8 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
    #39 0x7f5cc5e60b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310

UndefinedBehaviorSanitizer can not provide additional info.

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Unable to reproduce bug using the following builds:
> mozilla-central 20200804091327-7cb90fa4f485
> mozilla-central 20200728094725-eba7e3ce9382
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 2

[Jens Stutte [:jstutte]]

It seems we downgraded this from diagnostic assert in April due to its spiking volume. Maybe having a reproducible testcase helps us to solve this now?

Comment 3

[Jason Kratzer [:jkratzer]]

(In reply to Jens Stutte [:jstutte] (REO for FF 81) from comment #2)

It seems we downgraded this from diagnostic assert in April due to its spiking volume. Maybe having a reproducible testcase helps us to solve this now?

Looks like this bug was fixed in the following bisection range, though I'm not quite sure how those changes are related.

https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=2ce43b1fe3db5a3121cb01e5ea3045da7b85b1c9&tochange=1e2a698cb1870ac8fc161f1e0c23111d071384c1

Comment 4

[Jens Stutte [:jstutte]]

(In reply to Jason Kratzer [:jkratzer] from comment #3)

Looks like this bug was fixed in the following bisection range, though I'm not quite sure how those changes are related.

https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=2ce43b1fe3db5a3121cb01e5ea3045da7b85b1c9&tochange=1e2a698cb1870ac8fc161f1e0c23111d071384c1

I can see some relation between IsThirdParty* functions and StorageAllowedForWindow. Let's see if it is still fixed, then I'll just close this.

Comment 5

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1655740 using build mozilla-central 20210115035053-0f5e4a3c6f0a. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 6

[Jens Stutte [:jstutte]]

Fixed by bug 1652244, apparently.