1690350 - Assertion failure: mObservers.Length() == 0, at /builds/worker/checkouts/gecko/hal/Hal.cpp:177

Status: RESOLVED FIXED

(Core :: Hardware Abstraction Layer (HAL), defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 57bcdf857d44 (built with --enable-debug).

Assertion failure: mObservers.Length() == 0, at /builds/worker/checkouts/gecko/hal/Hal.cpp:177

    #0 0x7febf2c8d7a2 in ~ObserversManager /builds/worker/checkouts/gecko/hal/Hal.cpp:177:25
    #1 0x7febf2c8d7a2 in mozilla::StaticAutoPtr<mozilla::hal::ScreenConfigurationObserversManager>::Assign(mozilla::hal::ScreenConfigurationObserversManager*) /builds/worker/workspace/obj-build/dist/include/mozilla/StaticPtr.h:93:5
    #2 0x7febf2c8c79d in operator= /builds/worker/workspace/obj-build/dist/include/mozilla/StaticPtr.h:59:5
    #3 0x7febf2c8c79d in mozilla::hal::Shutdown() /builds/worker/checkouts/gecko/hal/Hal.cpp:475:33
    #4 0x7febf63488d0 in ~nsAppShell /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:111:3
    #5 0x7febf63488d0 in nsAppShell::~nsAppShell() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:110:27
    #6 0x7febf62ce5ec in nsBaseAppShell::Release() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:21:1
    #7 0x7febf6375195 in nsAppShellShutdown /builds/worker/checkouts/gecko/widget/nsAppShellSingleton.h:52:36
    #8 0x7febf6375195 in nsWidgetGtk2ModuleDtor() /builds/worker/checkouts/gecko/widget/gtk/nsWidgetFactory.cpp:70:3
    #9 0x7febf1bad537 in CallUnloadFuncs /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:8974:5
    #10 0x7febf1bad537 in mozilla::xpcom::StaticComponents::Shutdown() /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:12571:3
    #11 0x7febf1bbf049 in nsComponentManagerImpl::Shutdown() /builds/worker/checkouts/gecko/xpcom/components/nsComponentManager.cpp:857:3
    #12 0x7febf1c31c28 in mozilla::ShutdownXPCOM(nsIServiceManager*) /builds/worker/checkouts/gecko/xpcom/build/XPCOMInit.cpp:732:55
    #13 0x7febf7b1309c in XRE_TermEmbedding() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:212:3
    #14 0x7febf251b9ee in mozilla::ipc::ScopedXREEmbed::Stop() /builds/worker/checkouts/gecko/ipc/glue/ScopedXREEmbed.cpp:90:5
    #15 0x7febf7b13792 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:737:16
    #16 0x55baa39fcf76 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #17 0x55baa39fcf76 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:306:18
    #18 0x7fec077340b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210202214809-5ff587e0026f.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 2319a64a3cd8ef4ac0b5a3204da43f8c12bb48fc (20200205055433)
End: babdc3b3a30001ae014cc9180992549c5e4d5045 (20210202033500)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20210220093316-398870af9cb5) but not with tip (mozilla-central 20220218215229-b21fa00b5f33.)
The bug appears to have been fixed in the following build range:

Start: b9b52c74b762163c0dcdc6cc9673f3f02f95584e (20220215195043)
End: 66f2b55fec3b8db001fbad75f38c82f928d2dcdc (20220215202517)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=b9b52c74b762163c0dcdc6cc9673f3f02f95584e&tochange=66f2b55fec3b8db001fbad75f38c82f928d2dcdc
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Mayank Bansal]

Adding dependency per comment #2 , and closing as FIXED.