1765339 - Assertion failure: !aArgument.IsUncatchableException() (Doesn't make sense to convert uncatchable exception to a JS value!), at /dom/bindings/ToJSValue.cpp:55

Status: VERIFIED FIXED

(Core :: DOM: Streams, defect, P1)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 61d8c578d367 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 61d8c578d367 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !aArgument.IsUncatchableException() (Doesn't make sense to convert uncatchable exception to a JS value!), at /dom/bindings/ToJSValue.cpp:55

    ==2172129==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ff1473302df bp 0x7ff139d307d0 sp 0x7ff139d307c0 T2172192)
    ==2172129==The signal is caused by a WRITE memory access.
    ==2172129==Hint: address points to the zero page.
        #0 0x7ff1473302df in mozilla::dom::ToJSValue(JSContext*, mozilla::ErrorResult&&, JS::MutableHandle<JS::Value>) /dom/bindings/ToJSValue.cpp:53:3
        #1 0x7ff148c3b9a4 in mozilla::dom::PipeToPump::ShutdownWithActionAfterFinishedWrite(JSContext*, already_AddRefed<mozilla::dom::Promise> (*)(JSContext*, mozilla::dom::PipeToPump*, JS::Handle<mozilla::Maybe<JS::Value> >, mozilla::ErrorResult&), JS::Handle<mozilla::Maybe<JS::Value> >) /dom/streams/ReadableStreamPipeTo.cpp:509:15
        #2 0x7ff148c3a3b9 in mozilla::dom::PipeToPump::ShutdownWithAction(JSContext*, already_AddRefed<mozilla::dom::Promise> (*)(JSContext*, mozilla::dom::PipeToPump*, JS::Handle<mozilla::Maybe<JS::Value> >, mozilla::ErrorResult&), JS::Handle<mozilla::Maybe<JS::Value> >) /dom/streams/ReadableStreamPipeTo.cpp:429:3
        #3 0x7ff148c3abc2 in mozilla::dom::PipeToPump::OnDestClosed(JSContext*, JS::Handle<JS::Value>) /dom/streams/ReadableStreamPipeTo.cpp
        #4 0x7ff148c3a64a in mozilla::dom::PipeToPump::SourceOrDestErroredOrClosed(JSContext*) /dom/streams/ReadableStreamPipeTo.cpp:283:5
        #5 0x7ff148c3ad50 in mozilla::dom::PipeToPump::Start(JSContext*, mozilla::dom::AbortSignal*) /dom/streams/ReadableStreamPipeTo.cpp:319:7
        #6 0x7ff148c3167d in mozilla::dom::ReadableStreamPipeTo(mozilla::dom::ReadableStream*, mozilla::dom::WritableStream*, bool, bool, bool, mozilla::dom::AbortSignal*, mozilla::ErrorResult&) /dom/streams/ReadableStreamPipeTo.cpp:958:9
        #7 0x7ff148c3221f in mozilla::dom::ReadableStream::PipeTo(mozilla::dom::WritableStream&, mozilla::dom::StreamPipeOptions const&, mozilla::ErrorResult&) /dom/streams/ReadableStream.cpp:812:10
        #8 0x7ff1467174ad in pipeTo /builds/worker/workspace/obj-build/dom/bindings/ReadableStreamBinding.cpp:678:60
        #9 0x7ff1467174ad in mozilla::dom::ReadableStream_Binding::pipeTo_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/ReadableStreamBinding.cpp:692:13
        #10 0x7ff147314628 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3270:13
        #11 0x7ff14c762f4f in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:420:13
        #12 0x7ff14c7627bd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:507:12
        #13 0x7ff14c763bfe in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:567:10
        #14 0x7ff14c759d76 in CallFromStack /js/src/vm/Interpreter.cpp:571:10
        #15 0x7ff14c759d76 in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3293:16
        #16 0x7ff14c750bc3 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:389:13
        #17 0x7ff14c7626b8 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:539:13
        #18 0x7ff14c763bfe in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:567:10
        #19 0x7ff14c763e01 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:584:8
        #20 0x7ff14b3f1f61 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #21 0x7ff14702db1c in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:283:37
        #22 0x7ff1478a06d9 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:365:12
        #23 0x7ff14789f88d in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /dom/events/JSEventHandler.cpp:201:12
        #24 0x7ff14788060b in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /dom/events/EventListenerManager.cpp:1316:22
        #25 0x7ff1478812c9 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1507:17
        #26 0x7ff147875ff4 in HandleEvent /dom/events/EventListenerManager.h:395:5
        #27 0x7ff147875ff4 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:348:17
        #28 0x7ff147875517 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:550:16
        #29 0x7ff147877d78 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1119:11
        #30 0x7ff14787a916 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp
        #31 0x7ff14785167b in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/events/DOMEventTargetHelper.cpp:180:17
        #32 0x7ff147887dd2 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /dom/events/EventTarget.cpp:180:13
        #33 0x7ff148b4a86f in mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool) /dom/workers/MessageEventRunnable.cpp:106:12
        #34 0x7ff148b94ab2 in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #35 0x7ff1443b52c9 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1174:16
        #36 0x7ff1443bba4d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #37 0x7ff148b83854 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3133:7
        #38 0x7ff148b6296a in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2162:42
        #39 0x7ff1443b52c9 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1174:16
        #40 0x7ff1443bba4d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #41 0x7ff144f65fa4 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #42 0x7ff144e82507 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:380:10
        #43 0x7ff144e82412 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #44 0x7ff144e82412 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #45 0x7ff1443b08d6 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:378:10
        #46 0x7ff15a016a57 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #47 0x7ff15ad88608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477:8
        #48 0x7ff15a94f162 in __clone /build/glibc-sMfBJT/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/bindings/ToJSValue.cpp:53:3 in mozilla::dom::ToJSValue(JSContext*, mozilla::ErrorResult&&, JS::MutableHandle<JS::Value>)
    ==2172129==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Matthew Gaudet (he/him) [:mgaudet]]

Oops.

This is the same bug as Bug 1764117, but I forgot to look for another instance of this pattern. Should be an easy fix.

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1765339 - Update error handling in PipeToPump r?evilpie

Comment 4

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220419093010-61d8c578d367.
The bug appears to have been introduced in the following build range:

Start: 0d1d9fa72512cf8da0bc8c0fdd63f3fb3ff0a468 (20220322200148)
End: 39b9b2ea812745fc89d98d71c5601758d83342e1 (20220322213301)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=0d1d9fa72512cf8da0bc8c0fdd63f3fb3ff0a468&tochange=39b9b2ea812745fc89d98d71c5601758d83342e1

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8b61ea61278d
Update error handling in PipeToPump r=evilpie

Comment 6

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/8b61ea61278d

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220420033948-f78fb89b9c2f.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

:mgaudet, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 9

[Matthew Gaudet (he/him) [:mgaudet]]

Comment on attachment 9272882 [details]
Bug 1765339 - Update error handling in PipeToPump r?evilpie

Beta/Release Uplift Approval Request

• User impact if declined: Potential tab or worker crashes; expected to be very low volume however.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Restructures error handling around a low frequency path; the new handling is more idiomatic as well as not subject to the failure the fuzz test was.
• String changes made/needed:

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1759597

Comment 11

[Dianna Smith [:diannaS]]

Comment on attachment 9272882 [details]
Bug 1765339 - Update error handling in PipeToPump r?evilpie

Approved for 100.0b9

Comment 12

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-beta/rev/4848f0114fa6