1747445 - Assertion failure: false, at /builds/worker/checkouts/gecko/netwerk/protocol/http/InterceptedHttpChannel.cpp:1388

Status: RESOLVED FIXED

(Core :: DOM: Service Workers, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.zip

Found while fuzzing m-c 20211219-c223d66e6148 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip --xvfb

Assertion failure: false, at src/netwerk/protocol/http/InterceptedHttpChannel.cpp:1388

#0 0x7f50c1f7634a in mozilla::net::InterceptedHttpChannel::InterceptionTimeStamps::RecordTime(mozilla::net::InterceptedHttpChannel::InterceptionTimeStamps::Status&&, mozilla::TimeStamp&&) src/netwerk/protocol/http/InterceptedHttpChannel.cpp:1388:9
#1 0x7f50c1f77b49 in mozilla::net::InterceptedHttpChannel::Cancel(nsresult) src/netwerk/protocol/http/InterceptedHttpChannel.cpp:504:15
#2 0x7f50c1f4c502 in mozilla::net::HttpChannelParent::RecvCancel(nsresult const&, unsigned int const&) src/netwerk/protocol/http/HttpChannelParent.cpp:726:15
#3 0x7f50c2622f40 in mozilla::net::PHttpChannelParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PHttpChannelParent.cpp:512:28
#4 0x7f50c24a695b in mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:6505:32
#5 0x7f50c22ea57f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2043:25
#6 0x7f50c22e6eb1 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:1968:9
#7 0x7f50c22e8335 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1827:3
#8 0x7f50c22e8f6d in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1855:14
#9 0x7f50c1859a9e in mozilla::RunnableTask::Run() src/xpcom/threads/TaskController.cpp:468:16
#10 0x7f50c1833736 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:771:26
#11 0x7f50c18323f8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) src/xpcom/threads/TaskController.cpp:607:15
#12 0x7f50c1832673 in mozilla::TaskController::ProcessPendingMTTask(bool) src/xpcom/threads/TaskController.cpp:391:36
#13 0x7f50c185d106 in operator() src/xpcom/threads/TaskController.cpp:124:37
#14 0x7f50c185d106 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#15 0x7f50c1848073 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1183:16
#16 0x7f50c184f2da in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:467:10
#17 0x7f50c22f0396 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:85:21
#18 0x7f50c220f7a7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:331:10
#19 0x7f50c220f6b2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:324:3
#20 0x7f50c220f6b2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
#21 0x7f50c6490448 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
#22 0x7f50c8389c76 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:295:30
#23 0x7f50c84b1ce6 in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:5362:22
#24 0x7f50c84b3590 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5547:8
#25 0x7f50c84b3e09 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5606:21
#26 0x560698b84f45 in do_main src/browser/app/nsBrowserApp.cpp:225:22
#27 0x560698b84f45 in main src/browser/app/nsBrowserApp.cpp:395:16
#28 0x7f50d64510b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#29 0x560698b607bc in _start (/home/worker/builds/m-c-20211219214917-fuzzing-debug/firefox-bin+0x157bc)

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20211224095019-6d1e19449b74.
The bug appears to have been introduced in the following build range:

Start: 23f3a0afb545acb23a5927696df94085ea74fcfe (20210822084712)
End: 43eb6ce90ab079e96f70d77747c8c211c08c0cec (20210822212235)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=23f3a0afb545acb23a5927696df94085ea74fcfe&tochange=43eb6ce90ab079e96f70d77747c8c211c08c0cec

Comment 2

[Eden Chuang[:edenchuang]]

Attachment: Bug 1747445 - Do not record time stamps for InterceptedHttpChannel if AsyncOpen() is never called. r=#dom-worker-reviewers

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

:edenchuang, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c053ba827f29
Do not record time stamps for InterceptedHttpChannel if AsyncOpen() is never called. r=dom-worker-reviewers,smaug

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/c053ba827f29

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Bug appears to be fixed on mozilla-central 20211230095735-7f3569144950 but BugMon was unable to find a usable build for c223d66e6148.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.