1714224 - Assertion failure: mFlagSyncLooping, at src/dom/xhr/XMLHttpRequestMainThread.cpp:3631

Status: VERIFIED FIXED

(Core :: DOM: Networking, defect, P2)

Description

[Tyson Smith [:tsmith]]

First found while fuzzing m-c 20210601-83f4bfe5ea71 (--enable-debug --enable-fuzzing)

This issues is being hit frequently since it was first found. A reduced test case is not available at the moment.

Assertion failure: mFlagSyncLooping, at src/dom/xhr/XMLHttpRequestMainThread.cpp:3631

#0 0x7fe1a9de8bd4 in mozilla::dom::XMLHttpRequestMainThread::HandleSyncTimeoutTimer() src/dom/xhr/XMLHttpRequestMainThread.cpp:3631:3
#1 0x7fe1a9de899b in mozilla::dom::XMLHttpRequestMainThread::Notify(nsITimer*) src/dom/xhr/XMLHttpRequestMainThread.cpp:3545:5
#2 0x7fe1a5993ceb in operator() src/xpcom/threads/nsTimerImpl.cpp:560:44
#3 0x7fe1a5993ceb in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at src/xpcom/threads/nsTimerImpl.cpp:560:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:561:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:564:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:565:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:308:16
#4 0x7fe1a5993ceb in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at src/xpcom/threads/nsTimerImpl.cpp:559:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:560:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:561:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:564:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:565:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:317:14
#5 0x7fe1a5993ceb in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at src/xpcom/threads/nsTimerImpl.cpp:559:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:560:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:561:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:564:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:565:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:901:12
#6 0x7fe1a5993ceb in match<(lambda at src/xpcom/threads/nsTimerImpl.cpp:559:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:560:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:561:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:564:7), (lambda at src/xpcom/threads/nsTimerImpl.cpp:565:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:856:12
#7 0x7fe1a5993ceb in nsTimerImpl::Fire(int) src/xpcom/threads/nsTimerImpl.cpp:558:22
#8 0x7fe1a596b45d in nsTimerEvent::Run() src/xpcom/threads/TimerThread.cpp:252:11
#9 0x7fe1a595a6b2 in mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:143:20
#10 0x7fe1a598569e in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:482:16
#11 0x7fe1a59631a9 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:785:26
#12 0x7fe1a5962018 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:621:15
#13 0x7fe1a5962293 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:405:36
#14 0x7fe1a5988f09 in operator() src/xpcom/threads/TaskController.cpp:141:37
#15 0x7fe1a5988f09 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
#16 0x7fe1a5974dbf in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1159:16
#17 0x7fe1a597ba4a in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:548:10
#18 0x7fe1a6261e44 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:107:5
#19 0x7fe1a61ca1b7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:335:10
#20 0x7fe1a61ca0d2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:328:3
#21 0x7fe1a61ca0d2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:310:3
#22 0x7fe1a9ffda78 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#23 0x7fe1ab9cae03 in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:911:20
#24 0x7fe1a6262d8a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:235:9
#25 0x7fe1a61ca1b7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:335:10
#26 0x7fe1a61ca0d2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:328:3
#27 0x7fe1a61ca0d2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:310:3
#28 0x7fe1ab9caa1e in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:743:34
#29 0x5578d1535c56 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#30 0x5578d1535c56 in main src/browser/app/nsBrowserApp.cpp:313:18
#31 0x7fe1bb92e0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#32 0x5578d1512a5c in _start (/home/worker/builds/m-c-20210601213358-fuzzing-debug/firefox-bin+0x15a5c)

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/4Km0CboqyZuXQhEe_3lO9A/index.html

Comment 2

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210603094827-3350b68026ed.
The bug appears to have been introduced in the following build range:

Start: 6d57af4432d48bd8d0980ab664da45bea7e6cc24 (20210601121453)
End: f76f82499fc989313e4a674645aac7637eb95850 (20210601144826)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=6d57af4432d48bd8d0980ab664da45bea7e6cc24&tochange=f76f82499fc989313e4a674645aac7637eb95850

Comment 4

[Kershaw Chang [:kershaw]]

Attachment: Bug 1714224 - Cancel sync timeout timer after mFlagSyncLooping is set to false, r=smaug

Comment 5

[Kershaw Chang [:kershaw]]

This is a regression.
See the code before bug 1712930 below, CancelSyncTimeoutTimer should be always called after SpinEventLoopUntil.

    if (NS_SUCCEEDED(rv)) {
      nsAutoSyncOperation sync(mSuspendedDoc,
                               SyncOperationBehavior::eSuspendInput);
      if (!SpinEventLoopUntil([&]() { return !mFlagSyncLooping; })) {
        rv = NS_ERROR_UNEXPECTED;
      }

      // Time expired... We should throw.
      if (syncTimeoutType == eTimerStarted && !mSyncTimeoutTimer) {
        rv = NS_ERROR_DOM_NETWORK_ERR;
      }

      CancelSyncTimeoutTimer();
    }

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fb0fcaa0982d
Cancel sync timeout timer after mFlagSyncLooping is set to false, r=smaug

Comment 7

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/fb0fcaa0982d

Comment 8

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210624023952-1f6c9c348681.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.