1671957 - Assertion failure: mObservers.IsEmpty(), at /builds/worker/checkouts/gecko/dom/gamepad/GamepadPlatformService.cpp:33

Status: RESOLVED WORKSFORME

(Core :: DOM: Device Interfaces, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Testcase found while fuzzing mozilla-central rev cb4114308a0e (built with --enable-debug).

Assertion failure: mObservers.IsEmpty(), at /builds/worker/checkouts/gecko/dom/gamepad/GamepadPlatformService.cpp:33

    #0 0x7fb7894c432f in ~MonitoringState /builds/worker/checkouts/gecko/dom/gamepad/GamepadPlatformService.cpp:33:3
    #1 0x7fb7894c432f in mozilla::dom::GamepadPlatformService::~GamepadPlatformService() /builds/worker/checkouts/gecko/dom/gamepad/GamepadPlatformService.cpp:74:64
    #2 0x7fb7894cc501 in mozilla::dom::GamepadPlatformService::Release() /builds/worker/checkouts/gecko/dom/gamepad/GamepadPlatformService.h:36:3
    #3 0x7fb7894c95b4 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:50:40
    #4 0x7fb7894c95b4 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:381:36
    #5 0x7fb7894c95b4 in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:81:7
    #6 0x7fb7894c95b4 in mozilla::dom::GamepadEventChannelParent::ActorDestroy(mozilla::ipc::IProtocol::ActorDestroyReason) /builds/worker/checkouts/gecko/dom/gamepad/ipc/GamepadEventChannelParent.cpp:66:1
    #7 0x7fb786a548cd in mozilla::ipc::IProtocol::DestroySubtree(mozilla::ipc::IProtocol::ActorDestroyReason) /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:602:3
    #8 0x7fb786d2a494 in mozilla::dom::PGamepadEventChannelParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PGamepadEventChannelParent.cpp:153:20
    #9 0x7fb7870f5edc in mozilla::ipc::PBackgroundParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundParent.cpp:3715:32
    #10 0x7fb786a471be in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2150:25
    #11 0x7fb786a4397f in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2074:9
    #12 0x7fb786a44d86 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1922:3
    #13 0x7fb786a459ab in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1953:13
    #14 0x7fb786157001 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1197:14
    #15 0x7fb78615cb0a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #16 0x7fb786a4dbf6 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:332:5
    #17 0x7fb7869bf233 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #18 0x7fb7869bf14d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #19 0x7fb7869bf14d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #20 0x7fb78615370e in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:442:10
    #21 0x7fb79baaaabb in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #22 0x7fb79c01c608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477:8

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20201018211631-cb4114308a0e.
The bug appears to have been introduced in the following build range:

Start: 9b65a57811817731548ade4e221e593331b7bfae (20201007203227)
End: b7881b7504732f8e9b9aa832921a2e2fff4e32dc (20201007203332)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=9b65a57811817731548ade4e221e593331b7bfae&tochange=b7881b7504732f8e9b9aa832921a2e2fff4e32dc

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
The bug appears to have been fixed in the following build range:

Start: 117da9de7f6661628916d0e8b672e5d01bba855b (20201202232349)
End: ec6a64b639a82e957376c09a71aef7ce62b3a5aa (20201202232422)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=117da9de7f6661628916d0e8b672e5d01bba855b&tochange=ec6a64b639a82e957376c09a71aef7ce62b3a5aa
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Setting regressed_by field after analyzing regression range found by bugmon.