1741625 - Assertion failure: aVar->CanSend() (Actor must still be open when sending), at /builds/worker/workspace/obj-build/ipc/ipdl/PLockRequestChild.cpp:280

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 3088b7d11351 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 3088b7d11351 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Assertion failure: aVar->CanSend() (Actor must still be open when sending), at /builds/worker/workspace/obj-build/ipc/ipdl/PLockRequestChild.cpp:280

    ==2556573==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fee397a2b59 bp 0x7fee238086f0 sp 0x7fee238086b0 T2556633)
    ==2556573==The signal is caused by a WRITE memory access.
    ==2556573==Hint: address points to the zero page.
        #0 0x7fee397a2b59 in mozilla::ipc::IPDLParamTraits<mozilla::dom::locks::PLockRequestChild*>::Write(IPC::Message*, mozilla::ipc::IProtocol*, mozilla::dom::locks::PLockRequestChild* const&) /builds/worker/workspace/obj-build/ipc/ipdl/PLockRequestChild.cpp:278:9
        #1 0x7fee3979e98a in mozilla::dom::locks::PLockManagerChild::SendPLockRequestConstructor(mozilla::dom::locks::PLockRequestChild*, mozilla::dom::locks::IPCLockRequest const&) /builds/worker/workspace/obj-build/ipc/ipdl/PLockManagerChild.cpp:143:5
        #2 0x7fee3cb9c9ee in mozilla::dom::locks::LockManagerChild::RequestLock(mozilla::dom::locks::LockRequest const&, mozilla::dom::LockOptions const&) /dom/locks/LockManagerChild.cpp:81:3
        #3 0x7fee3cb9c86b in mozilla::dom::LockManager::Request(nsTSubstring<char16_t> const&, mozilla::dom::LockOptions const&, mozilla::dom::LockGrantedCallback&, mozilla::ErrorResult&) /dom/locks/LockManager.cpp:149:11
        #4 0x7fee3ab6c0f4 in request /builds/worker/workspace/obj-build/dom/bindings/LockManagerBinding.cpp:631:64
        #5 0x7fee3ab6c0f4 in mozilla::dom::LockManager_Binding::request_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/LockManagerBinding.cpp:658:13
        #6 0x7fee3bac7058 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3300:13
        #7 0x7fee3f3e0e5f in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:387:13
        #8 0x7fee3f3e056b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:474:12
        #9 0x7fee3f3e203e in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:534:10
        #10 0x7fee3f3d7833 in CallFromStack /js/src/vm/Interpreter.cpp:538:10
        #11 0x7fee3f3d7833 in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3242:16
        #12 0x7fee3f3ce623 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:356:13
        #13 0x7fee3f3e0466 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:506:13
        #14 0x7fee3f3e203e in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:534:10
        #15 0x7fee3f3e2241 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:551:8
        #16 0x7fee3f7bfb00 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /js/src/vm/SelfHosting.cpp:1538:10
        #17 0x7fee3f576aeb in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /js/src/vm/AsyncFunction.cpp:152:8
        #18 0x7fee3f6b570e in AsyncFunctionPromiseReactionJob /js/src/builtin/Promise.cpp:2000:12
        #19 0x7fee3f6b570e in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /js/src/builtin/Promise.cpp:2160:12
        #20 0x7fee3f3e0e5f in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:387:13
        #21 0x7fee3f3e056b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:474:12
        #22 0x7fee3f3e203e in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:534:10
        #23 0x7fee3f3e2241 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:551:8
        #24 0x7fee3f59a8f1 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #25 0x7fee3adb495c in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:35:8
        #26 0x7fee388493a5 in mozilla::dom::PromiseJobCallback::Call(mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:89:12
        #27 0x7fee388486db in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:102:12
        #28 0x7fee388486db in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /xpcom/base/CycleCollectedJSContext.cpp:213:18
        #29 0x7fee388335a8 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /xpcom/base/CycleCollectedJSContext.cpp:674:17
        #30 0x7fee3bed188b in LeaveMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:243:7
        #31 0x7fee3bed188b in ~nsAutoMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:395:13
        #32 0x7fee3bed188b in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /dom/events/EventListenerManager.cpp:1125:3
        #33 0x7fee3bed2529 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1314:17
        #34 0x7fee3bec7f94 in HandleEvent /dom/events/EventListenerManager.h:394:5
        #35 0x7fee3bec7f94 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:348:17
        #36 0x7fee3bec74b7 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:550:16
        #37 0x7fee3bec9d18 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1085:11
        #38 0x7fee3becc4e6 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp
        #39 0x7fee3bea2ffb in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/events/DOMEventTargetHelper.cpp:181:17
        #40 0x7fee3bed9022 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /dom/events/EventTarget.cpp:180:13
        #41 0x7fee3ce67b6f in mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool) /dom/workers/MessageEventRunnable.cpp:106:12
        #42 0x7fee3ceb058c in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:378:12
        #43 0x7fee3895e859 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1169:16
        #44 0x7fee3896597a in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:467:10
        #45 0x7fee3ce9f918 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3105:7
        #46 0x7fee3ce7fce7 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2244:42
        #47 0x7fee3895e859 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1169:16
        #48 0x7fee3896597a in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:467:10
        #49 0x7fee393fb9cb in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:300:20
        #50 0x7fee39319e47 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #51 0x7fee39319d52 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #52 0x7fee39319d52 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #53 0x7fee3895a4cb in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:391:10
        #54 0x7fee4db51a07 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #55 0x7fee4e8c5608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
        #56 0x7fee4e48d292 in __clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/ipc/ipdl/PLockRequestChild.cpp:278:9 in mozilla::ipc::IPDLParamTraits<mozilla::dom::locks::PLockRequestChild*>::Write(IPC::Message*, mozilla::ipc::IProtocol*, mozilla::dom::locks::PLockRequestChild* const&)
    ==2556573==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20211117094929-3088b7d11351.
The bug appears to have been introduced in the following build range:

Start: 59c6e74da9db894eb5212e1e83109e1cb9beaec9 (20211019105725)
End: 329de07e7a961067363ab88f789bf3652c037d6a (20211019125105)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=59c6e74da9db894eb5212e1e83109e1cb9beaec9&tochange=329de07e7a961067363ab88f789bf3652c037d6a

Comment 3

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Kagami, you may want to take a look.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

:saschanaz, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1725942

Comment 6

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20211117094929-3088b7d11351) but not with tip (mozilla-central 20211204095400-04183e5ab506.)
The bug appears to have been fixed in the following build range:

Start: ba4d4963c38ba7a68e481d39b5b1a3698e5098d9 (20211123033957)
End: 71332992f78f548b219f6405ca970828bd22c071 (20211123020419)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=ba4d4963c38ba7a68e481d39b5b1a3698e5098d9&tochange=71332992f78f548b219f6405ca970828bd22c071
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 7

[Kagami Rosylight [:saschanaz] (they/them) (OOO until Dec 11)]

Cool, closing then.