1724440 - Assertion failure: Request::mDisconnected, at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:524

Status: NEW

(Core :: Audio/Video, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev b19fdf435550 (built with: --enable-debug --enable-fuzzing). Testcase requires the GNOME_ACCESSIBILITY=1 environment variable set

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build b19fdf435550 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Assertion failure: Request::mDisconnected, at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:524

    ==2094972==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f3e990c534a bp 0x7f3ea81bf5d0 sp 0x7f3ea81bf5c0 T2094978)
    ==2094972==The signal is caused by a WRITE memory access.
    ==2094972==Hint: address points to the zero page.
        #0 0x7f3e990c534a in mozilla::MozPromise<bool, mozilla::MediaResult, true>::ThenValueBase::AssertIsDead() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:524:9
        #1 0x7f3e99303ea1 in mozilla::MozPromise<bool, mozilla::MediaResult, true>::AssertIsDead() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1113:13
        #2 0x7f3e993622b1 in mozilla::MozPromise<RefPtr<mozilla::MediaDataDecoder>, mozilla::MediaResult, true>::AssertIsDead() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1113:13
        #3 0x7f3e9611bac1 in mozilla::MozPromise<bool, nsresult, false>::AssertIsDead() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1113:13
        #4 0x7f3e95989662 in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::ResolveOrRejectRunnable::~ResolveOrRejectRunnable() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:481:23
        #5 0x7f3e95989760 in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::ResolveOrRejectRunnable::~ResolveOrRejectRunnable() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:479:34
        #6 0x7f3e95ae4cc7 in mozilla::Runnable::Release() /xpcom/threads/nsThreadUtils.cpp:62:1
        #7 0x7f3e95aff1d8 in ~nsCOMPtr /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:451:7
        #8 0x7f3e95aff1d8 in mozilla::TaskQueue::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/obj-build/dist/include/mozilla/TaskQueue.h:80:3
        #9 0x7f3e959890c6 in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::Dispatch(mozilla::MozPromise<bool, nsresult, false>*) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:577:24
        #10 0x7f3e961194c5 in mozilla::MozPromise<bool, nsresult, false>::DispatchAll() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1135:18
        #11 0x7f3e96119d99 in void mozilla::MozPromise<bool, nsresult, false>::Private::Resolve<bool const&>(bool const&, char const*) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1219:5
        #12 0x7f3e9611960c in mozilla::MozPromise<bool, nsresult, false>::DispatchAll() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1140:7
        #13 0x7f3e96119d99 in void mozilla::MozPromise<bool, nsresult, false>::Private::Resolve<bool const&>(bool const&, char const*) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1219:5
        #14 0x7f3e992c42fc in mozilla::MozPromise<bool, nsresult, false>::ChainTo(already_AddRefed<mozilla::MozPromise<bool, nsresult, false>::Private>, char const*) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1077:7
        #15 0x7f3e9951fa4d in InvokeCallbackMethod<true, (lambda at /dom/media/ipc/RemoteDecoderManagerChild.cpp:387:13), RefPtr<mozilla::MozPromise<bool, nsresult, false> > ((lambda at /dom/media/ipc/RemoteDecoderManagerChild.cpp:387:13)::*)(mozilla::MozPromise<mozilla::Tuple<nsresult, mozilla::ipc::Endpoint<mozilla::PRemoteDecoderManagerChild> >, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue &&) const, mozilla::MozPromise<mozilla::Tuple<nsresult, mozilla::ipc::Endpoint<mozilla::PRemoteDecoderManagerChild> >, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue, RefPtr<mozilla::MozPromise<bool, nsresult, false>::Private> > /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:648:10
        #16 0x7f3e9951fa4d in mozilla::MozPromise<mozilla::Tuple<nsresult, mozilla::ipc::Endpoint<mozilla::PRemoteDecoderManagerChild> >, mozilla::ipc::ResponseRejectReason, true>::ThenValue<mozilla::RemoteDecoderManagerChild::LaunchRDDProcessIfNeeded()::$_6::operator()() const::'lambda'(mozilla::MozPromise<mozilla::Tuple<nsresult, mozilla::ipc::Endpoint<mozilla::PRemoteDecoderManagerChild> >, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue&&)>::DoResolveOrRejectInternal(mozilla::MozPromise<mozilla::Tuple<nsresult, mozilla::ipc::Endpoint<mozilla::PRemoteDecoderManagerChild> >, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:914:7
        #17 0x7f3e967be325 in mozilla::MozPromise<mozilla::Tuple<nsresult, mozilla::ipc::Endpoint<mozilla::PRemoteDecoderManagerChild> >, mozilla::ipc::ResponseRejectReason, true>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:487:21
        #18 0x7f3e95ae19d5 in mozilla::SimpleTaskQueue::DrainTasks() /builds/worker/workspace/obj-build/dist/include/mozilla/TaskDispatcher.h:42:10
        #19 0x7f3e95af13a7 in nsThread::DrainDirectTasks() /xpcom/threads/nsThread.cpp:1352:16
        #20 0x7f3e95af0061 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1170:3
        #21 0x7f3e95af68ca in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:466:10
        #22 0x7f3e964188c4 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #23 0x7f3e96371f17 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #24 0x7f3e96371e32 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #25 0x7f3e96371e32 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #26 0x7f3e95aec6ff in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:390:10
        #27 0x7f3eaa3bdac7 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #28 0x7f3eab131608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
        #29 0x7f3eaacf9292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:524:9 in mozilla::MozPromise<bool, mozilla::MediaResult, true>::ThenValueBase::AssertIsDead()
    ==2094972==ABORTING

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Bugmon was unable to identify a testcase that reproduces this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Comment 3

[James Teh [:Jamie]]

I don't see any a11y frames in the stack, nor can I think of any reason a11y should be impacting this. While it's curious that a11y has to be enabled to reproduce this, I don't think this is actually related to the a11y engine. Most likely it's sensitive to timing.

Moving to audio/video given the references to Media, but please move elsewhere if my guess is incorrect.

Comment 4

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20210808090543-56e4a835369f.

Comment 5

[Bryce Seager van Dyk [:bryce] (he/him) - Not reading bugmail]

• The MediaResult in the promise suggests this is Media related.
• Fatal assert here. I.e. we're not disconnecting a then value that should be disconnected.
• Up the stack we have some code launching the RDD process.

My educated guess is we've got a ->Then call during RDD creation which doesn't get disconnected during a failure path.

Comment 6

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Comment 7

[Tyson Smith [:tsmith]]

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --repeat 10 --relaunch 1

I have added a new testcase. It is slightly less complex but is also not 100% (the original also was not).

The testcase does contain a try { window.printPreview()?.close() } catch (e) {} which seems to be needed and my only guess as to why is timing. I will attempt to get a Pernosco session for this since the fuzzers hit it a few times a day.

Comment 8

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/QP1fhCPy8AIFGPmlOitlOA/index.html

Comment 9

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1724440 using build mozilla-central 20210806095029-b19fdf435550. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.