Closed Bug 1741491 Opened 2 years ago Closed 2 years ago

Assertion failure: !isSome(), at /builds/worker/workspace/obj-build/dist/include/mozilla/Maybe.h:837

Categories

(Core :: DOM: Animation, defect)

x86_64
Linux
defect

Tracking

()

VERIFIED FIXED
96 Branch
Tracking Status
firefox96 --- verified

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug)

Details

(Keywords: testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Crash Data

Attachments

(2 files)

Testcase found while fuzzing mozilla-central rev 3890e2f0b025 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 3890e2f0b025 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html
Assertion failure: !isSome(), at /builds/worker/workspace/obj-build/dist/include/mozilla/Maybe.h:837

    ==777709==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f265eb9ba17 bp 0x7fffa3585de0 sp 0x7fffa3585d20 T777709)
    ==777709==The signal is caused by a WRITE memory access.
    ==777709==Hint: address points to the zero page.
        #0 0x7f265eb9ba17 in emplace<> /builds/worker/workspace/obj-build/dist/include/mozilla/Maybe.h:837:3
        #1 0x7f265eb9ba17 in nsStyledElement::InlineStyleDeclarationWillChange(mozilla::MutationClosureData&) /dom/base/nsStyledElement.cpp:91:25
        #2 0x7f266655ee34 in _$LT$style..gecko_bindings..structs..root..mozilla..DeclarationBlockMutationClosure$u20$as$u20$geckoservo..glue..ClosureHelper$GT$::invoke::hd9539a28c351d54d /servo/ports/geckolib/glue.rs:153:22
        #3 0x7f266655ee34 in geckoservo::glue::set_property_to_declarations::h8401a8ca3b80f999 /servo/ports/geckolib/glue.rs:4594:5
        #4 0x7f266655ee34 in Servo_DeclarationBlock_SetPropertyToAnimationValue /servo/ports/geckolib/glue.rs:4681:5
        #5 0x7f265ea455a2 in mozilla::dom::Animation::CommitStyles(mozilla::ErrorResult&) /dom/animation/Animation.cpp:785:18
        #6 0x7f265ee64943 in mozilla::dom::Animation_Binding::commitStyles(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/AnimationBinding.cpp:1330:24
        #7 0x7f2660066288 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3300:13
        #8 0x7f2663980b1f in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:387:13
        #9 0x7f266398022b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:474:12
        #10 0x7f2663981cfe in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:534:10
        #11 0x7f26639774f3 in CallFromStack /js/src/vm/Interpreter.cpp:538:10
        #12 0x7f26639774f3 in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3242:16
        #13 0x7f266396e2e3 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:356:13
        #14 0x7f2663980126 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:506:13
        #15 0x7f2663981cfe in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:534:10
        #16 0x7f2663981f01 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:551:8
        #17 0x7f2663b3a5b1 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #18 0x7f265fbdf9c4 in mozilla::dom::LifecycleAttributeChangedCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/CustomElementRegistryBinding.cpp:624:8
        #19 0x7f265eb96a4f in void mozilla::dom::LifecycleAttributeChangedCallback::Call<RefPtr<mozilla::dom::Element> >(RefPtr<mozilla::dom::Element> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/CustomElementRegistryBinding.h:588:12
        #20 0x7f265eb69f02 in Call<RefPtr<mozilla::dom::Element> > /builds/worker/workspace/obj-build/dist/include/mozilla/dom/CustomElementRegistryBinding.h:610:12
        #21 0x7f265eb69f02 in mozilla::dom::CustomElementCallback::Call() /dom/base/CustomElementRegistry.cpp:215:13
        #22 0x7f265eb71ea0 in mozilla::dom::CustomElementReactionsStack::InvokeReactions(AutoTArray<RefPtr<mozilla::dom::Element>, 3ul>*, nsIGlobalObject*) /dom/base/CustomElementRegistry.cpp:1521:19
        #23 0x7f265eb71af7 in mozilla::dom::CustomElementReactionsStack::PopAndInvokeElementQueue() /dom/base/CustomElementRegistry.cpp:1413:5
        #24 0x7f265e436077 in mozilla::dom::CustomElementReactionsStack::LeaveCEReactions(JSContext*, bool) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/CustomElementRegistry.h:286:7
        #25 0x7f265ef544ce in ~AutoCEReaction /builds/worker/workspace/obj-build/dist/include/mozilla/dom/CustomElementRegistry.h:578:22
        #26 0x7f265ef544ce in ~MaybeStorage /builds/worker/workspace/obj-build/dist/include/mozilla/Maybe.h:268:25
        #27 0x7f265ef544ce in mozilla::dom::CSS2Properties_Binding::set_fontFamily(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/CSS2PropertiesBinding.cpp:19094:1
        #28 0x7f2660063ef6 in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3248:8
        #29 0x7f2663980b1f in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:387:13
        #30 0x7f266398022b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:474:12
        #31 0x7f2663981cfe in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:534:10
        #32 0x7f2663982f2c in Call /js/src/vm/Interpreter.cpp:551:8
        #33 0x7f2663982f2c in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /js/src/vm/Interpreter.cpp:692:10
        #34 0x7f2663cf314b in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, js::PropertyResult const&, JS::ObjectOpResult&) /js/src/vm/NativeObject.cpp:2465:8
        #35 0x7f2663cf2136 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /js/src/vm/NativeObject.cpp:2499:14
        #36 0x7f2663a02fa6 in js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /js/src/vm/ObjectOperations-inl.h:299:10
        #37 0x7f2663ab99b4 in js::SetPropertyIgnoringNamedGetter(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<mozilla::Maybe<JS::PropertyDescriptor> >, JS::ObjectOpResult&) /js/src/proxy/BaseProxyHandler.cpp:174:14
        #38 0x7f266007af64 in mozilla::dom::DOMProxyHandler::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) const /dom/bindings/DOMJSProxyHandler.cpp:248:10
        #39 0x7f2663ae2760 in js::Proxy::setInternal(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /js/src/proxy/Proxy.cpp:542:19
        #40 0x7f2663ae2310 in js::Proxy::set(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /js/src/proxy/Proxy.cpp:550:10
        #41 0x7f26639758aa in SetProperty /js/src/vm/ObjectOperations-inl.h:296:12
        #42 0x7f26639758aa in SetObjectElementOperation /js/src/vm/Interpreter.cpp:1745:10
        #43 0x7f26639758aa in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:2997:12
        #44 0x7f266396e2e3 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:356:13
        #45 0x7f2663980126 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:506:13
        #46 0x7f2663981cfe in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:534:10
        #47 0x7f2663981f01 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:551:8
        #48 0x7f2663b3a5b1 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #49 0x7f265fd79037 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:62:8
        #50 0x7f26604712e6 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #51 0x7f266047106a in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /dom/events/EventListenerManager.cpp:1117:43
        #52 0x7f2660471d69 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1314:17
        #53 0x7f26604677d4 in HandleEvent /dom/events/EventListenerManager.h:394:5
        #54 0x7f26604677d4 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:348:17
        #55 0x7f2660466cf7 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:550:16
        #56 0x7f2660469558 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1085:11
        #57 0x7f2661bf5343 in nsDocumentViewer::LoadComplete(nsresult) /layout/base/nsDocumentViewer.cpp:1087:7
        #58 0x7f2663198b24 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /docshell/base/nsDocShell.cpp:6333:20
        #59 0x7f2663198613 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp:5722:7
        #60 0x7f26631994af in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp
        #61 0x7f265e331c5c in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /uriloader/base/nsDocLoader.cpp:1376:3
        #62 0x7f265e3311ea in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:974:14
        #63 0x7f265e32f570 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:793:9
        #64 0x7f265e33072d in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:676:5
        #65 0x7f26631b9a7d in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:13586:23
        #66 0x7f265d0dbefa in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:614:22
        #67 0x7f265d0dd4e3 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:518:10
        #68 0x7f265ec0e36d in mozilla::dom::Document::DoUnblockOnload() /dom/base/Document.cpp:11555:18
        #69 0x7f265ebeae3d in mozilla::dom::Document::UnblockOnload(bool) /dom/base/Document.cpp:11485:9
        #70 0x7f265ebfd406 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:7987:3
        #71 0x7f265ec729a6 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1147:12
        #72 0x7f265ec729a6 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1153:12
        #73 0x7f265ec729a6 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1200:13
        #74 0x7f265cee7cc2 in mozilla::SchedulerGroup::Runnable::Run() /xpcom/threads/SchedulerGroup.cpp:144:20
        #75 0x7f265cf17a4e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:468:16
        #76 0x7f265cef1366 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:771:26
        #77 0x7f265cef0028 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:607:15
        #78 0x7f265cef02a3 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:391:36
        #79 0x7f265cf1b046 in operator() /xpcom/threads/TaskController.cpp:124:37
        #80 0x7f265cf1b046 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #81 0x7f265cf05d53 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1175:16
        #82 0x7f265cf0cf3a in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:467:10
        #83 0x7f265d99a106 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #84 0x7f265d8b9747 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #85 0x7f265d8b9652 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #86 0x7f265d8b9652 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #87 0x7f2661849458 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #88 0x7f2663804013 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:917:20
        #89 0x7f265d99affa in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #90 0x7f265d8b9747 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #91 0x7f265d8b9652 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #92 0x7f265d8b9652 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #93 0x7f266380364b in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:749:34
        #94 0x55d3c4fc8e49 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #95 0x55d3c4fc8e49 in main /browser/app/nsBrowserApp.cpp:327:18
        #96 0x7f2673d950b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
        #97 0x55d3c4fa45dc in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x155dc)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Maybe.h:837:3 in emplace<>
    ==777709==ABORTING
Attached file Testcase

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20211116212601-0799fad6d9ec.
Failed to bisect testcase (Unable to launch the start build!):

Start: 42e7e98c701d3e8c8c66a5acca0f0aeeb5076661 (20201118041908)
End: 3890e2f0b0250c7d13367b969f483996ac1c2e81 (20211116093425)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Flags: needinfo?(emilio)
Crash Signature: [@ nsStyledElement::InlineStyleDeclarationWillChange ]
Attachment #9250993 - Attachment mime type: text/plain → text/html
Assignee: nobody → emilio
Flags: needinfo?(emilio)

The way CommitStyles called into servo caused it to call the closure
multiple times, and we were not dealing with that properly.

Handle the "was called" state internally.

Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/00f24d1721ea
Make sure we only record old style value once. r=smaug
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/31665 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 96 Branch

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20211118162628-20663c1b363c.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon
Upstream PR merged by moz-wptsync-bot

:emilio, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Flags: needinfo?(emilio)

Sorry, bug in the bot.

Flags: needinfo?(emilio)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: