1736488 - Assertion failure crash: ClientMatchPrincipalInfo(mClientInfo.PrincipalInfo(), aServiceWorker.PrincipalInfo()), at /dom/clients/manager/ClientHandle.cpp:112

Status: NEW

(Core :: DOM: Service Workers, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev ee8efced380b (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build ee8efced380b --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Assertion failure: ClientMatchPrincipalInfo(mClientInfo.PrincipalInfo(), aServiceWorker.PrincipalInfo()), at /dom/clients/manager/ClientHandle.cpp:112

    =================================================================
    ==683914==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f02e76b67fe bp 0x7ffccfecf8f0 sp 0x7ffccfecf240 T0)
    ==683914==The signal is caused by a WRITE memory access.
    ==683914==Hint: address points to the zero page.
        #0 0x7f02e76b67fe in mozilla::dom::ClientHandle::Control(mozilla::dom::ServiceWorkerDescriptor const&) /dom/clients/manager/ClientHandle.cpp:111:3
        #1 0x7f02e9818bfc in operator() /dom/serviceworkers/ServiceWorkerManager.cpp:555:33
        #2 0x7f02e9818bfc in operator()<nsTHashtable<nsBaseHashtableET<nsIDHashKey, mozilla::UniquePtr<mozilla::dom::ServiceWorkerManager::ControlledClientData> > >::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:836:18
        #3 0x7f02e9818bfc in operator()<PLDHashTable::EntryHandle> /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:437:18
        #4 0x7f02e9818bfc in WithEntryHandle<(lambda at /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:436:9)> /builds/worker/workspace/obj-build/dist/include/PLDHashTable.h:603:12
        #5 0x7f02e9818bfc in WithEntryHandle<(lambda at /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:835:15)> /builds/worker/workspace/obj-build/dist/include/nsTHashtable.h:434:25
        #6 0x7f02e9818bfc in WithEntryHandle<(lambda at /dom/serviceworkers/ServiceWorkerManager.cpp:506:7)> /builds/worker/workspace/obj-build/dist/include/nsBaseHashtable.h:834:18
        #7 0x7f02e9818bfc in mozilla::dom::ServiceWorkerManager::StartControllingClient(mozilla::dom::ClientInfo const&, mozilla::dom::ServiceWorkerRegistrationInfo*, bool) /dom/serviceworkers/ServiceWorkerManager.cpp:504:29
        #8 0x7f02e9811502 in mozilla::dom::ServiceWorkerManager::IsAvailable(nsIPrincipal*, nsIURI*, nsIChannel*) /dom/serviceworkers/ServiceWorkerManager.cpp:2227:7
        #9 0x7f02e981047e in mozilla::dom::ServiceWorkerInterceptController::ShouldPrepareForIntercept(nsIURI*, nsIChannel*, bool*) /dom/serviceworkers/ServiceWorkerInterceptController.cpp:70:21
        #10 0x7f02e2a18939 in mozilla::net::HttpBaseChannel::ShouldIntercept(nsIURI*) /netwerk/protocol/http/HttpBaseChannel.cpp:3761:31
        #11 0x7f02e2b82bef in mozilla::net::nsHttpChannel::Connect() /netwerk/protocol/http/nsHttpChannel.cpp:705:7
        #12 0x7f02e2b7d2ed in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14
        #13 0x7f02e2b7d2ed in mozilla::net::nsHttpChannel::CallOrWaitForResume(std::function<nsresult (mozilla::net::nsHttpChannel*)> const&) /netwerk/protocol/http/nsHttpChannel.cpp:8659:10
        #14 0x7f02e2b81b9c in mozilla::net::nsHttpChannel::ContinueOnBeforeConnect(bool, nsresult, bool) /netwerk/protocol/http/nsHttpChannel.cpp:693:10
        #15 0x7f02e2b80e04 in mozilla::net::nsHttpChannel::MaybeUseHTTPSRRForUpgrade(bool, nsresult) /netwerk/protocol/http/nsHttpChannel.cpp:621:12
        #16 0x7f02e2b7e6f6 in mozilla::net::nsHttpChannel::OnBeforeConnect() /netwerk/protocol/http/nsHttpChannel.cpp:540:10
        #17 0x7f02e2b7d2ed in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14
        #18 0x7f02e2b7d2ed in mozilla::net::nsHttpChannel::CallOrWaitForResume(std::function<nsresult (mozilla::net::nsHttpChannel*)> const&) /netwerk/protocol/http/nsHttpChannel.cpp:8659:10
        #19 0x7f02e2b7cf60 in mozilla::net::nsHttpChannel::PrepareToConnect() /netwerk/protocol/http/nsHttpChannel.cpp:410:10
        #20 0x7f02e2b7d2ed in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14
        #21 0x7f02e2b7d2ed in mozilla::net::nsHttpChannel::CallOrWaitForResume(std::function<nsresult (mozilla::net::nsHttpChannel*)> const&) /netwerk/protocol/http/nsHttpChannel.cpp:8659:10
        #22 0x7f02e2bc7837 in mozilla::net::nsHttpChannel::BeginConnect() /netwerk/protocol/http/nsHttpChannel.cpp:6238:8
        #23 0x7f02e2bce8ba in mozilla::net::nsHttpChannel::OnProxyAvailable(nsICancelable*, nsIChannel*, nsIProxyInfo*, nsresult) /netwerk/protocol/http/nsHttpChannel.cpp:6538:10
        #24 0x7f02e207897c in mozilla::net::nsAsyncResolveRequest::DoCallback() /netwerk/base/nsProtocolProxyService.cpp:412:18
        #25 0x7f02e2073306 in Run /netwerk/base/nsProtocolProxyService.cpp:273:20
        #26 0x7f02e2073306 in operator() /netwerk/base/nsProtocolProxyService.cpp:255:14
        #27 0x7f02e2073306 in std::_Function_handler<nsresult (mozilla::net::nsAsyncResolveRequest*, nsIProxyInfo*, bool), mozilla::net::nsAsyncResolveRequest::ProcessLocally(mozilla::net::nsProtocolInfo&, nsIProxyInfo*, bool)::'lambda'(mozilla::net::nsAsyncResolveRequest*, nsIProxyInfo*, bool)>::_M_invoke(std::_Any_data const&, mozilla::net::nsAsyncResolveRequest*&&, nsIProxyInfo*&&, bool&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:301:9
        #28 0x7f02e1ff91c4 in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14
        #29 0x7f02e1ff91c4 in mozilla::net::nsAsyncResolveRequest::AsyncApplyFilters::Finish() /netwerk/base/nsProtocolProxyService.cpp:606:10
        #30 0x7f02e1ff8ab5 in mozilla::net::nsAsyncResolveRequest::AsyncApplyFilters::ProcessNextFilter() /netwerk/base/nsProtocolProxyService.cpp:516:14
        #31 0x7f02e1ff82a7 in mozilla::net::nsAsyncResolveRequest::AsyncApplyFilters::AsyncProcess(mozilla::net::nsAsyncResolveRequest*) /netwerk/base/nsProtocolProxyService.cpp:492:19
        #32 0x7f02e2008440 in mozilla::net::nsAsyncResolveRequest::ProcessLocally(mozilla::net::nsProtocolInfo&, nsIProxyInfo*, bool) /netwerk/base/nsProtocolProxyService.cpp:264:33
        #33 0x7f02e2005cd1 in mozilla::net::nsProtocolProxyService::AsyncResolveInternal(nsIChannel*, unsigned int, nsIProtocolProxyCallback*, nsICancelable**, bool, nsISerialEventTarget*) /netwerk/base/nsProtocolProxyService.cpp:1580:15
        #34 0x7f02e20084f9 in mozilla::net::nsProtocolProxyService::AsyncResolve2(nsIChannel*, unsigned int, nsIProtocolProxyCallback*, nsISerialEventTarget*, nsICancelable**) /netwerk/base/nsProtocolProxyService.cpp:1598:10
        #35 0x7f02e2baa7a9 in mozilla::net::nsHttpChannel::ResolveProxy() /netwerk/protocol/http/nsHttpChannel.cpp
        #36 0x7f02e2bc4a29 in mozilla::net::nsHttpChannel::MaybeResolveProxyAndBeginConnect() /netwerk/protocol/http/nsHttpChannel.cpp:5929:29
        #37 0x7f02e2c30b0b in operator() /netwerk/protocol/http/nsHttpChannel.cpp:5897:20
        #38 0x7f02e2c30b0b in std::_Function_handler<void (), mozilla::net::nsHttpChannel::AsyncOpenFinal(mozilla::TimeStamp)::$_44>::_M_invoke(std::_Any_data const&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:316:2
        #39 0x7f02e2e3611c in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14
        #40 0x7f02e2e3611c in Exec /netwerk/url-classifier/AsyncUrlChannelClassifier.cpp:531:23
        #41 0x7f02e2e3611c in CompleteClassification /netwerk/url-classifier/AsyncUrlChannelClassifier.cpp:755:20
        #42 0x7f02e2e3611c in operator() /netwerk/url-classifier/AsyncUrlChannelClassifier.cpp:912:38
        #43 0x7f02e2e3611c in mozilla::detail::RunnableFunction<mozilla::net::AsyncUrlChannelClassifier::CheckChannel(nsIChannel*, std::function<void ()>&&)::$_0::operator()() const::'lambda'()>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #44 0x7f02e1ca0362 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:467:16
        #45 0x7f02e1c66af3 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:770:26
        #46 0x7f02e1c63ed8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:606:15
        #47 0x7f02e1c64600 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:390:36
        #48 0x7f02e1ca99a1 in operator() /xpcom/threads/TaskController.cpp:123:37
        #49 0x7f02e1ca99a1 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:531:5
        #50 0x7f02e1c85d87 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1151:16
        #51 0x7f02e1c910ec in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:467:10
        #52 0x7f02e314598f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #53 0x7f02e2fc7a01 in RunInternal /ipc/chromium/src/base/message_loop.cc:331:10
        #54 0x7f02e2fc7a01 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #55 0x7f02e2fc7a01 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #56 0x7f02e9a7c217 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #57 0x7f02ee0af5f7 in nsAppStartup::Run() /toolkit/components/startup/nsAppStartup.cpp:295:30
        #58 0x7f02ee2de58e in XREMain::XRE_mainRun() /toolkit/xre/nsAppRunner.cpp:5298:22
        #59 0x7f02ee2e06b9 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:5483:8
        #60 0x7f02ee2e1423 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /toolkit/xre/nsAppRunner.cpp:5542:21
        #61 0x55781b5d906a in do_main /browser/app/nsBrowserApp.cpp:225:22
        #62 0x55781b5d906a in main /browser/app/nsBrowserApp.cpp:395:16
        #63 0x7f0303ad50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
        #64 0x55781b529cf9 in _start (/home/jkratzer/builds/mc-asan/firefox+0x5ccf9)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /dom/clients/manager/ClientHandle.cpp:111:3 in mozilla::dom::ClientHandle::Control(mozilla::dom::ServiceWorkerDescriptor const&)
    ==683914==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20211018160929-ee8efced380b) but not with tip (mozilla-central 20211019042159-1e37fc4a7f53.)
The bug appears to have been fixed in the following build range:

Start: ee8efced380b871deac4fba285955953a4a89ef5 (20211018160929)
End: 3b1b07d0c956f56825b69aebe8a7dbbd0d0ad41e (20211018214442)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ee8efced380b871deac4fba285955953a4a89ef5&tochange=3b1b07d0c956f56825b69aebe8a7dbbd0d0ad41e
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Markus Stange [:mstange]]

I hit this today in a local build when capturing a profile of Netflix, on mozilla-central revision 329de07e7a96.

Comment 4

[Markus Stange [:mstange]]

Ah, that was because bug 1731982 was briefly relanded before being backed out again.

Comment 5

[Chris Peterson [:cpeterson]]

All desktop platforms are affected.

Crash report: https://crash-stats.mozilla.org/report/index/29736fb1-0b2f-4440-bd4b-d20b10211110

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(ClientMatchPrincipalInfo(mClientInfo.PrincipalInfo(), aServiceWorker.PrincipalInfo()))

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::ClientHandle::Control dom/clients/manager/ClientHandle.cpp:111
1 xul.dll mozilla::dom::ServiceWorkerManager::StartControllingClient dom/serviceworkers/ServiceWorkerManager.cpp:504
2 xul.dll mozilla::dom::ServiceWorkerInterceptController::ShouldPrepareForIntercept dom/serviceworkers/ServiceWorkerInterceptController.cpp:89
3 xul.dll mozilla::net::HttpBaseChannel::ShouldIntercept netwerk/protocol/http/HttpBaseChannel.cpp:3708
4 xul.dll std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:693:30', nsresult, mozilla::net::nsHttpChannel*>::_Do_call 
5 xul.dll mozilla::net::nsHttpChannel::CallOrWaitForResume netwerk/protocol/http/nsHttpChannel.cpp:8671
6 xul.dll mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/netwerk/protocol/http/nsHttpChannel.cpp:5650:11'>::Run xpcom/threads/nsThreadUtils.h:531
7 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:771
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1175
9 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:85

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 5 desktop browser crashes on Mac on beta

:hsingh, could you consider increasing the severity of this top-crash bug?

For more information, please visit auto_nag documentation.

Comment 7

[Harveer Singh]

I have extracted below from the comments on the assertion failure.

  // We should never have a cross-origin controller.  Since this would be
  // same-origin policy violation we do a full release assertion here.

Since, this is on service workers. I am asking for further information from asuth. I am not sure if there could be any usecase for a cross-origin controller.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit auto_nag documentation.

Comment 9

[Andrew Sutherland [:asuth] (he/him)]

(In reply to Harveer Singh from comment #7)

Since, this is on service workers. I am asking for further information from asuth. I am not sure if there could be any usecase for a cross-origin controller.

It's not possible / forbidden. There are a surprising number of Fenix crashes on release starting around May 15th that seem to be distributed over install times in a way that suggests it's not just a few bad devices. Date-wise, v113 was released on May 9th and the .0.1 on May 12th so this likely corresponds to changes occurring in Fx113. Boosting this to P2.