Closed Bug 1717808 Opened 5 years ago Closed 5 years ago

Permanent Windows Assertion failure: mDataEnd == segment.End(), at /builds/worker/workspace/obj-build/dist/include/mozilla/BufferList.h:233 when Gecko 91 merges to Beta on 2021-07-12

Categories

(Core :: IPC, defect)

Product:
Core
Component:
IPC
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
91 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- unaffected
firefox89 --- unaffected
firefox90 --- unaffected
firefox91 + verified

People

(Reporter: aryx, Assigned: nika)

References

(Regression)

Details

(Keywords: regression)

Crash Data

Attachments

(1 file)

Bug 1717808 - aIter must be valid after extracting last segment of a BufferList,
48 bytes, text/x-phabricator-request
Details | Review

Either from bug 1706374 or bug 1713148.

 INFO - REFTEST INFO | Running with e10s: True
 INFO - REFTEST INFO | Running with fission: False
 INFO - REFTEST INFO | Application command: Z:\task_1624444163\build\application\firefox\firefox.exe -marionette --wait-for-browser -profile C:\Users\task_1624444163\AppData\Local\Temp\tmp2ni7lnni.mozrunner
 INFO - 1624446093411	Marionette	INFO	Marionette enabled
 INFO - 1624446093625	Marionette	TRACE	Received observer notification toplevel-window-ready
 INFO - JavaScript error: resource://gre/modules/XULStore.jsm, line 66: Error: Can't find profile directory.
 INFO - console.warn: SearchSettings: "get: No settings file exists, new profile?" (new NotFoundError("Could not open the file at C:\\Users\\task_1624444163\\AppData\\Local\\Temp\\tmp2ni7lnni.mozrunner\\search.json.mozlz4", (void 0)))
 INFO - 1624446099015	Marionette	TRACE	Received observer notification marionette-startup-requested
 INFO - 1624446099015	Marionette	TRACE	Waiting until startup recorder finished recording startup scripts...
 INFO - 1624446099059	Marionette	TRACE	All scripts recorded.
 INFO - 1624446099064	Marionette	INFO	Listening on port 2828
 INFO - 1624446099065	Marionette	DEBUG	Marionette is listening
 INFO - 1624446099431	Marionette	DEBUG	Accepted connection 0 from 127.0.0.1:50078
 INFO - 1624446099446	Marionette	DEBUG	Closed connection 0
 INFO - 1624446099447	Marionette	DEBUG	Accepted connection 1 from 127.0.0.1:50079
 INFO - 1624446099481	Marionette	DEBUG	1 -> [0,1,"WebDriver:NewSession",{"strictFileInteractability":true}]
 INFO - 1624446099525	Marionette	DEBUG	1 <- [1,1,null,{"sessionId":"0d19e468-3a63-4801-9e89-e3a6fa9ec80c","capabilities":{"browserName":"firefox","browserVersion":"91.0" ... .mozrunner","moz:shutdownTimeout":300000,"moz:useNonSpecCompliantPointerOrigin":false,"moz:webdriverClick":true,"proxy":{}}}]
 INFO - 1624446099574	Marionette	DEBUG	1 -> [0,2,"Addon:Install",{"path":"Z:\\task_1624444163\\build\\tests\\reftest\\specialpowers","temporary":true}]
 INFO - 1624446099629	Marionette	DEBUG	1 <- [1,2,null,{"value":"special-powers@mozilla.org"}]
 INFO - 1624446099640	Marionette	DEBUG	1 -> [0,3,"Addon:Install",{"path":"Z:\\task_1624444163\\build\\tests\\reftest\\reftest","temporary":true}]
 INFO - 1624446099711	Marionette	TRACE	Received observer notification toplevel-window-ready
 INFO - 1624446099716	Marionette	DEBUG	1 <- [1,3,null,{"value":"reftest@mozilla.org"}]
 INFO - 1624446099735	Marionette	DEBUG	1 -> [0,4,"WebDriver:DeleteSession",{}]
 INFO - 1624446099748	Marionette	DEBUG	1 <- [1,4,null,{"value":null}]
 INFO - 1624446099758	Marionette	DEBUG	Closed connection 1
 INFO - REFTEST INFO | Reading manifest file://Z:\task_1624444163\build\tests\reftest\tests\testing\crashtest\crashtests.list
 INFO - REFTEST INFO | Dumping JSON representation of sandbox
 INFO - REFTEST INFO | {"isDebugBuild":false,"isCoverageBuild":false,"xulRuntime":{"widgetToolkit":"windows","OS":"WINNT","XPCOMABI":"x86_64-msvc"},"smallScreen":false,"d2d":false,"dwrite":true,"embeddedInFirefoxReality":false,"gpuProcess":true,"azureCairo":false,"azureSkia":true,"skiaContent":true,"azureSkiaGL":false,"contentSameGfxBackendAsCanvas":true,"remoteCanvas":false,"layersGPUAccelerated":false,"d3d11":false,"d3d9":false,"layersOpenGL":false,"swgl":false,"webrender":false,"layersOMTC":true,"advancedLayers":false,"layerChecksEnabled":true,"usesOverlayScrollbars":false,"Android":false,"cocoaWidget":false,"gtkWidget":false,"qtWidget":false,"winWidget":true,"is64Bit":true,"useDrawSnapshot":false,"unsupportedWithDrawSnapshot":false,"retainedDisplayList":true,"geckoview":false,"transparentScrollbars":false,"MinGW":false,"AddressSanitizer":true,"ThreadSanitizer":false,"webrtc":true,"jxl":false,"retainedDisplayLists":true,"compareRetainedDisplayLists":false,"release_or_beta":true,"http":{"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0","appName":"Mozilla","appVersion":"5.0","platform":"Windows","oscpu":"Windows NT 10.0; Win64; x64","misc":"rv:91.0"},"appleSilicon":false,"windowsDefaultTheme":true,"nativeThemePref":false,"gpuProcessForceEnabled":false,"prefs":{},"browserIsRemote":true,"browserIsFission":false,"asyncPan":true,"usesRepeatResampling":false,"verify":false,"fission":false,"serviceWorkerE10s":true}
 INFO - REFTEST SUITE-START | Running 3921 tests
 INFO - REFTEST TEST-START | data:text/html,
 INFO - REFTEST TEST-LOAD | data:text/html, | 0 / 3921 (0%)
 INFO - Assertion failure: mDataEnd == segment.End(), at /builds/worker/workspace/obj-build/dist/include/mozilla/BufferList.h:233
 INFO - #01: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x15e31de]
 INFO - #02: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x160302f]
 INFO - #03: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x1602e6a]
 INFO - #04: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x176a61f]
 INFO - #05: soundtouch::SoundTouch::operator=[Z:\task_1624444163\build\application\firefox\xul.dll +0x8a15a8c]
 INFO - #06: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x19ca9ed]
 INFO - #07: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x207d4af]
 INFO - #08: soundtouch::SoundTouch::operator=[Z:\task_1624444163\build\application\firefox\xul.dll +0x891601f]
 INFO - #09: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x39224d0]
 INFO - #10: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x47bb4a1]
 INFO - #11: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x62e9d6a]
 INFO - #12: XRE_GetBootstrap[Z:\task_1624444163\build\application\firefox\xul.dll +0xd894b93]
 INFO - #13: XRE_GetBootstrap[Z:\task_1624444163\build\application\firefox\xul.dll +0xd881b0d]
 INFO - #14: XRE_GetBootstrap[Z:\task_1624444163\build\application\firefox\xul.dll +0xd8673f0]
 INFO - #15: XRE_GetBootstrap[Z:\task_1624444163\build\application\firefox\xul.dll +0xd8951d6]
 INFO - #16: XRE_GetBootstrap[Z:\task_1624444163\build\application\firefox\xul.dll +0xd897649]
 INFO - #17: XRE_GetBootstrap[Z:\task_1624444163\build\application\firefox\xul.dll +0xda152ea]
 INFO - #18: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x5b57243]
 INFO - #19: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x6ce2c41]
 INFO - #20: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x6ce4971]
 INFO - #21: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x6cc9ef2]
 INFO - #22: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x6cc7a3c]
 INFO - #23: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x6cce66e]
 INFO - #24: soundtouch::SoundTouch::operator=[Z:\task_1624444163\build\application\firefox\xul.dll +0x9cfeeb3]
 INFO - #25: soundtouch::SoundTouch::operator=[Z:\task_1624444163\build\application\firefox\xul.dll +0xc8d50d0]
 INFO - #26: soundtouch::SoundTouch::operator=[Z:\task_1624444163\build\application\firefox\xul.dll +0xc8d428b]
 INFO - #27: DumpCompleteHeap[Z:\task_1624444163\build\application\firefox\xul.dll +0x24f4e7b]
 INFO - #28: DumpCompleteHeap[Z:\task_1624444163\build\application\firefox\xul.dll +0x24f3917]
 INFO - #29: DumpCompleteHeap[Z:\task_1624444163\build\application\firefox\xul.dll +0x24eedba]
 INFO - #30: DumpCompleteHeap[Z:\task_1624444163\build\application\firefox\xul.dll +0x24f1f09]
 INFO - #31: soundtouch::SoundTouch::operator=[Z:\task_1624444163\build\application\firefox\xul.dll +0xc91a8cb]
 INFO - #32: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x701d97]
 INFO - #33: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x704bf2]
 INFO - #34: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x3c21f12]
 INFO - #35: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x3bc41c0]
 INFO - #36: VR_RuntimePath[Z:\task_1624444163\build\application\firefox\xul.dll +0x3bf3c29]
 INFO - #37: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x1bebfb]
 INFO - #38: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x35e737]
 INFO - #39: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x3b2cef]
 INFO - #40: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x373549]
 INFO - #41: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x36f93d]
 INFO - #42: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x370301]
 INFO - #43: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x3b9612]
 INFO - #44: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x396e59]
 INFO - #45: Ordinal0[Z:\task_1624444163\build\application\firefox\xul.dll +0x3a614d]
 INFO - #46: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x16e102f]
 INFO - #47: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x15fab56]
 INFO - #48: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x15fa926]
 INFO - #49: soundtouch::SoundTouch::operator=[Z:\task_1624444163\build\application\firefox\xul.dll +0x9399b4b]
 INFO - #50: soundtouch::SoundTouch::operator=[Z:\task_1624444163\build\application\firefox\xul.dll +0x957430b]
 INFO - #51: workerlz4_maxCompressedSize[Z:\task_1624444163\build\application\firefox\xul.dll +0xd5cb085]
 INFO - #52: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x15fab56]
 INFO - #53: soundtouch::SoundTouch::numChannels[Z:\task_1624444163\build\application\firefox\xul.dll +0x15fa926]
 INFO - #54: workerlz4_maxCompressedSize[Z:\task_1624444163\build\application\firefox\xul.dll +0xd5ca575]
 INFO - #55: Ordinal0[Z:\task_1624444163\build\application\firefox\firefox.exe +0x1f4a]
 INFO - #56: Ordinal0[Z:\task_1624444163\build\application\firefox\firefox.exe +0x14d5]
 INFO - #57: TargetNtUnmapViewOfSection[Z:\task_1624444163\build\application\firefox\firefox.exe +0xf9b08]
 INFO - #58: BaseThreadInitThunk[C:\Windows\System32\KERNEL32.DLL +0x13034]
 INFO - #59: RtlUserThreadStart[C:\Windows\SYSTEM32\ntdll.dll +0x71461]
ERROR - A content process crashed and MOZ_CRASHREPORTER_SHUTDOWN is set, shutting down
Flags: needinfo?(nika)
Crash Signature: application crashed [@ mozilla::BufferList<InfallibleAllocPolicy>::IterImpl::AdvanceAcrossSegments(mozilla::BufferList<InfallibleAllocPolicy> const&, unsigned long long)]
Summary: Permanent Windows asan Assertion failure: mDataEnd == segment.End(), at /builds/worker/workspace/obj-build/dist/include/mozilla/BufferList.h:233 when Gecko 91 merges to Beta on 2021-07-12 → Permanent Windows Assertion failure: mDataEnd == segment.End(), at /builds/worker/workspace/obj-build/dist/include/mozilla/BufferList.h:233 when Gecko 91 merges to Beta on 2021-07-12

The stack in the linked run doesn't seem very useful here, but the stack from the shippable-opt failure makes a bit more sense.

 0  xul.dll!mozilla::BufferList<InfallibleAllocPolicy>::IterImpl::AdvanceAcrossSegments(mozilla::BufferList<InfallibleAllocPolicy> const&, unsigned int) [BufferList.h:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 273 + 0x92]
 1  xul.dll!Pickle::ExtractBuffers(PickleIterator*, unsigned int, mozilla::BufferList<InfallibleAllocPolicy>*, unsigned int) const [pickle.cc:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 416 + 0x11]
 2  xul.dll!static IPC::ParamTraits<JSStructuredCloneData>::Read(IPC::Message const*, PickleIterator*, JSStructuredCloneData*) [SerializedStructuredCloneBuffer.h:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 91 + 0x19]
 3  xul.dll!mozilla::dom::ipc::StructuredCloneData::ReadIPCParams(IPC::Message const*, PickleIterator*) [StructuredCloneData.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 390 + 0x8]
 4  xul.dll!mozilla::ipc::ReadIPDLParam<mozilla::dom::ipc::StructuredCloneData>(IPC::Message const*, PickleIterator*, mozilla::ipc::IProtocol*, mozilla::dom::ipc::StructuredCloneData*) [IPDLParamTraits.h:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 72 + 0x7]
 5  xul.dll!static mozilla::ipc::IPDLParamTraits<nsTArray<mozilla::dom::ipc::StructuredCloneData> >::Read(IPC::Message const*, PickleIterator*, mozilla::ipc::IProtocol*, nsTArray<mozilla::dom::ipc::StructuredCloneData>*) [IPDLParamTraits.h:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 204 + 0xb]
 6  xul.dll!mozilla::ipc::ReadIPDLParam<nsTArray<mozilla::dom::ipc::StructuredCloneData> >(IPC::Message const*, PickleIterator*, mozilla::ipc::IProtocol*, nsTArray<mozilla::dom::ipc::StructuredCloneData>*) [IPDLParamTraits.h:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 72 + 0xd]
 7  xul.dll!mozilla::dom::PBrowserChild::SendSyncMessage(nsTString<char16_t> const&, mozilla::dom::ClonedMessageData const&, nsTArray<mozilla::dom::ipc::StructuredCloneData>*) [PBrowserChild.cpp: : 841 + 0x9]
 8  xul.dll!mozilla::dom::BrowserChild::DoSendBlockingMessage(nsTSubstring<char16_t> const&, mozilla::dom::ipc::StructuredCloneData&, nsTArray<mozilla::dom::ipc::StructuredCloneData>*) [BrowserChild.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 3063 + 0xc]
 9  xul.dll!nsFrameMessageManager::SendSyncMessage(JSContext*, nsTSubstring<char16_t> const&, JS::Handle<JS::Value>, nsTArray<JS::Value>&, mozilla::ErrorResult&) [nsFrameMessageManager.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 530 + 0x1d]
10  xul.dll!mozilla::dom::ContentFrameMessageManager_Binding::sendSyncMessage(JSContext*, JS::Handle<JSObject *>, void*, JSJitMethodCallArgs const&) [MessageManagerBinding.cpp: : 2228 + 0x21]
11  xul.dll!mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) [BindingUtils.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 3297 + 0x11]
12  xul.dll!js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) [Interpreter.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 511 + 0x7e]
13  xul.dll!Interpret(JSContext*, js::RunState&) [Interpreter.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 3226 + 0x8d]
14  xul.dll!js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) [Interpreter.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 588 + 0x81]
15  xul.dll!mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) [EventListenerBinding.cpp: : 58 + 0xa7]
16  xul.dll!mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) [EventListenerManager.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 1305 + 0x242]
17  xul.dll!static mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) [EventDispatcher.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 480 + 0x1ea]
18  xul.dll!static mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget *>*) [EventDispatcher.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 1085 + 0x19]
19  xul.dll!nsDocumentViewer::LoadComplete(nsresult) [nsDocumentViewer.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 1087 + 0x14]
20  xul.dll!nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) [nsDocShell.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 6359 + 0x11]
21  xul.dll!nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) [nsDocShell.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 5749 + 0x14]
22  xul.dll!nsDocLoader::DoFireOnStateChange(nsIWebProgress* const, nsIRequest* const, int&, const nsresult) [nsDocLoader.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 1362 + 0x24]
23  xul.dll!nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) [nsDocLoader.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 968 + 0xc]
24  xul.dll!nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) [nsDocLoader.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 787 + 0xd]
25  xul.dll!nsDocLoader::OnStopRequest(nsIRequest*, nsresult) [nsDocLoader.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 670 + 0xd]
26  xul.dll!nsDocShell::OnStopRequest(nsIRequest*, nsresult) [nsDocShell.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 13515 + 0x8]
27  xul.dll!mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) [nsLoadGroup.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 614 + 0x12]
28  xul.dll!mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) [nsLoadGroup.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 518 + 0xc]
29  xul.dll!mozilla::dom::Document::UnblockOnload(bool) [Document.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 11277 + 0x48]
30  xul.dll!mozilla::dom::Document::DispatchContentLoadedEvents() [Document.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 7785 + 0x9]
31  xul.dll!mozilla::detail::RunnableMethodImpl<(anonymous namespace)::HangMonitorChild *,void ((anonymous namespace)::HangMonitorChild::*)() __attribute__((thiscall)),0,mozilla::RunnableKind::Standard>::Run() [nsThreadUtils.h:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 1203 + 0x12]
32  xul.dll!mozilla::SchedulerGroup::Runnable::Run() [SchedulerGroup.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 143 + 0xe]
33  xul.dll!mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&) [TaskController.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 805 + 0xa3]
34  xul.dll!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 1152 + 0x31]
35  xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [MessagePump.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 85 + 0x2c]
36  xul.dll!MessageLoop::RunHandler() [message_loop.cc:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 324 + 0x14]
37  xul.dll!MessageLoop::Run() [message_loop.cc:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 306 + 0x5]
38  xul.dll!nsBaseAppShell::Run() [nsBaseAppShell.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 137 + 0xc]
39  xul.dll!nsAppShell::Run() [nsAppShell.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 603 + 0x6]
40  xul.dll!XRE_RunAppShell() [nsEmbedFunctions.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 910 + 0xe]
41  xul.dll!mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) [MessagePump.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 235 + 0x5]
42  xul.dll!MessageLoop::RunHandler() [message_loop.cc:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 324 + 0x14]
43  xul.dll!MessageLoop::Run() [message_loop.cc:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 306 + 0x5]
44  xul.dll!XRE_InitChildProcess(int, char**, XREChildData const*) [nsEmbedFunctions.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 742 + 0xb]
45  xul.dll!mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) [Bootstrap.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 67 + 0xe]
46  firefox.exe!wmain(int, wchar_t**) [nsWindowsWMain.cpp:b742985baa1dcbbb567d3b3b4e85c43bf2ef0503 : 131 + 0x165]

Looks like it's deserializing the reply payload from a StructuredCloneData here, and asserting when doing the final AdvanceAcrossSegments to align the buffer after calling ExtractBuffers (https://searchfox.org/mozilla-central/rev/9975889f5c0d5c59bd22121a454beba774cbae71/ipc/glue/SerializedStructuredCloneBuffer.h#92 => https://searchfox.org/mozilla-central/rev/9975889f5c0d5c59bd22121a454beba774cbae71/ipc/chromium/src/base/pickle.cc#416).

This gives me the impression that the code in ExtractBuffers isn't correctly updating the iterator in some edge case.

Flags: needinfo?(nika)
Assignee: nobody → nika
See Also: → 1718054

Hi Nika!

I ended up here because this bug is pinned from the following job failure https://treeherder.mozilla.org/jobs?repo=try&resultStatus=success%2Ctestfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=2122c2f72874d3fb2fa7b05788552a3dc0e2ff1d&selectedTaskRun=e5NsA0RhSqG9nppmwkPgjw.0 which seems to occur after a tab crash on a moz-extension:// page.

I was looking at a devtools perma failure which is also caused by a tab crash when opening a moz-extension:// page (Bug 1718054). And it seems there are various similar perma failures on beta sims right now. Do you think your work on this bug should fix the crash on moz-extension pages on Windows?

Flags: needinfo?(nika)

(clearing my ni since the bugs have been flagged as duplicates now)

Flags: needinfo?(nika)

When advancing to Beta, we stop adding sentinels after serialized data
in IPC::Message objects. These sentinels would cause all Extract calls
to not reach the end of the message buffer on Nightly. This patch fixes
an assertion failure which can occur when extract calls fully empty the
buffer, and the finished iterator is advanced by 0 bytes.

Pushed by nlayzell@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/c656a30a2cdb aIter must be valid after extracting last segment of a BufferList, r=glandium

https://hg.mozilla.org/mozilla-central/rev/c656a30a2cdb

Status: NEW → RESOLVED
Closed: 5 years ago
status-firefox91: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 91 Branch
Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: