1766472 - Assertion failure: !isInList(), at /dom/webscheduling/WebTaskScheduler.cpp:77

Status: VERIFIED FIXED

(Core :: Performance: General, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 31346aa577d3 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 31346aa577d3 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !isInList(), at /dom/webscheduling/WebTaskScheduler.cpp:77

    ==407514==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f72d0110437 bp 0x7f72c2124d30 sp 0x7f72c2124c90 T407587)
    ==407514==The signal is caused by a WRITE memory access.
    ==407514==Hint: address points to the zero page.
        #0 0x7f72d0110437 in mozilla::dom::WebTask::RunAbortAlgorithm() /dom/webscheduling/WebTaskScheduler.cpp:77:3
        #1 0x7f72ccbc8dd6 in mozilla::dom::AbortSignalImpl::SignalAbort(JS::Handle<JS::Value>) /dom/abort/AbortSignal.cpp:62:15
        #2 0x7f72ccbca55c in mozilla::dom::AbortSignal::SignalAbort(JS::Handle<JS::Value>) /dom/abort/AbortSignal.cpp:273:20
        #3 0x7f72ccbc8606 in mozilla::dom::AbortController::Abort(JSContext*, JS::Handle<JS::Value>) /dom/abort/AbortController.cpp:83:14
        #4 0x7f72cd199766 in mozilla::dom::AbortController_Binding::abort(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/AbortControllerBinding.cpp:86:24
        #5 0x7f72ce47340c in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3270:13
        #6 0x7f72d38450a0 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:420:13
        #7 0x7f72d38448aa in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:507:12
        #8 0x7f72d383bb56 in CallFromStack /js/src/vm/Interpreter.cpp:578:10
        #9 0x7f72d383bb56 in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3314:16
        #10 0x7f72d3832de2 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:389:13
        #11 0x7f72d38447a6 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:539:13
        #12 0x7f72d3845dd8 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:605:8
        #13 0x7f72d251fcf1 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #14 0x7f72ce22ea0d in mozilla::dom::VoidFunction::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/FunctionBinding.cpp:81:8
        #15 0x7f72cd127358 in mozilla::dom::VoidFunction::Call(mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:172:12
        #16 0x7f72cd126fdd in QueuedMicrotask::Run(mozilla::AutoSlowOperation&) /dom/base/nsIGlobalObject.cpp:275:31
        #17 0x7f72cb3f2e68 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /xpcom/base/CycleCollectedJSContext.cpp:674:17
        #18 0x7f72ce9d10ce in LeaveMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:243:7
        #19 0x7f72ce9d10ce in ~nsAutoMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:393:13
        #20 0x7f72ce9d10ce in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /dom/events/EventListenerManager.cpp:1318:3
        #21 0x7f72ce9d1d3d in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1507:17
        #22 0x7f72ce9c6c84 in HandleEvent /dom/events/EventListenerManager.h:395:5
        #23 0x7f72ce9c6c84 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:348:17
        #24 0x7f72ce9c61d2 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:550:16
        #25 0x7f72ce9c8a71 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1119:11
        #26 0x7f72ce9cb4c6 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp
        #27 0x7f72ce9a2e2b in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/events/DOMEventTargetHelper.cpp:180:17
        #28 0x7f72ce9d87a2 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /dom/events/EventTarget.cpp:180:13
        #29 0x7f72cfc76bfe in mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool) /dom/workers/MessageEventRunnable.cpp:106:12
        #30 0x7f72cfcc0283 in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #31 0x7f72cb51e1e7 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1174:16
        #32 0x7f72cb52450d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #33 0x7f72cfcaefd4 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3134:7
        #34 0x7f72cfc8e225 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2162:42
        #35 0x7f72cb51e1e7 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1174:16
        #36 0x7f72cb52450d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #37 0x7f72cc0c60ab in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:300:20
        #38 0x7f72cbfe3b47 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:380:10
        #39 0x7f72cbfe3a52 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #40 0x7f72cbfe3a52 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #41 0x7f72cb5196d6 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:378:10
        #42 0x7f72e10b12e7 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #43 0x7f72e1e23608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477:8
        #44 0x7f72e19ea162 in __clone /build/glibc-sMfBJT/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/webscheduling/WebTaskScheduler.cpp:77:3 in mozilla::dom::WebTask::RunAbortAlgorithm()
    ==407514==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220426094609-31346aa577d3.
The bug appears to have been introduced in the following build range:

Start: 11ecf2c5eb7b2e2c6461676ec28178ec5d2417e0 (20220421191935)
End: a440fb0e93f1f3b65c8b310466892aec98b14bf2 (20220421192030)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=11ecf2c5eb7b2e2c6461676ec28178ec5d2417e0&tochange=a440fb0e93f1f3b65c8b310466892aec98b14bf2

Comment 3

[BugBot [:suhaib / :marco]]

Setting regressed_by field after analyzing regression range found by bugmon.

Comment 4

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1734997

Comment 5

[BugBot [:suhaib / :marco]]

:sefeng, since you are the author of the regressor, bug 1734997, could you take a look?
For more information, please visit auto_nag documentation.

Comment 6

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1734997

Comment 7

[Sean Feng [:sefeng211]]

Attachment: Bug 1766472 - Remove the WebTask from the queue when it's failed to be queued r=smaug

A possible case is a WebTask got rejected in PostTask, and then
the abort algorithm run. If this happens, the abort algorithm should
remove it from the task list.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2df2a290e5fd
Remove the WebTask from the queue when it's failed to be queued r=smaug

Comment 9

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/2df2a290e5fd

Comment 10

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220712042008-b8040f409025.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.