Assertion failure: !mPromise, at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1318
Categories
(Core :: WebRTC: Audio/Video, defect, P2)
Tracking
()
People
(Reporter: tsmith, Assigned: karlt)
References
(Blocks 1 open bug, Regression)
Details
(Keywords: assertion, regression, testcase)
Attachments
(2 files)
Found while fuzzing m-c 20220429-6921abcd7429 (--enable-debug --enable-fuzzing)
The fuzzers are seeing this on Android (x86).
Assertion failure: !mPromise, at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1318
eax = 0xb8614625 ebp = 0xbd508a38 ebx = 0xbc01aaa0
ecx = 0xbcbe6c74 edi = 0xab743ac0 edx = 0x00000000
eflags = 0x00210282 eip = 0xb40af7ec esi = 0x00000526
esp = 0xbd508a20
OS|Android|0.0.0 Linux 5.4.86-android11-2-00006-gae78026f427c-ab7595864 #1 SMP PREEMPT Thu Jul 29 20:54:47 UTC 2021 i686
CPU|x86|GenuineIntel family 6 model 6 stepping 3|4
Crash|SIGSEGV / SEGV_MAPERR|0x00000000|13
13|0|libxul.so|mozilla::MozPromiseHolderBase<mozilla::MozPromise<RefPtr<mozilla::media::Refcountable<nsTArray<RefPtr<mozilla::MediaDevice> > > >, RefPtr<mozilla::MediaMgrError>, true>, mozilla::MozPromiseHolder<mozilla::MozPromise<RefPtr<mozilla::media::Refcountable<nsTArray<RefPtr<mozilla::MediaDevice> > > >, RefPtr<mozilla::MediaMgrError>, true> > >::~MozPromiseHolderBase()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/MozPromise.h:6921abcd74295e0b89a234508b730d1ad245456c|1318|0x4e
13|1|libxul.so|mozilla::MediaManager::EnumerateRawDevices(mozilla::dom::MediaSourceEnum, mozilla::dom::MediaSourceEnum, mozilla::EnumSet<mozilla::MediaManager::EnumerationFlag, unsigned int>)::$_90::~$_90()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaManager.cpp:6921abcd74295e0b89a234508b730d1ad245456c|1828|0x2d
13|2|libxul.so|mozilla::media::LambdaTask<mozilla::MediaManager::EnumerateRawDevices(mozilla::dom::MediaSourceEnum, mozilla::dom::MediaSourceEnum, mozilla::EnumSet<mozilla::MediaManager::EnumerationFlag, unsigned int>)::$_90>::~LambdaTask()|hg:hg.mozilla.org/mozilla-central:dom/media/systemservices/MediaTaskUtils.h:6921abcd74295e0b89a234508b730d1ad245456c|28|0x1e
13|3|libxul.so|mozilla::Runnable::Release()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:6921abcd74295e0b89a234508b730d1ad245456c|61|0x62
13|4|libxul.so|nsCOMPtr_base::~nsCOMPtr_base()|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCOMPtr.h:6921abcd74295e0b89a234508b730d1ad245456c|328|0x35
13|5|libxul.so|mozilla::SegmentedVector<nsCOMPtr<nsISupports>, (unsigned int)4096, mozilla::MallocAllocPolicy>::SegmentImpl<(unsigned int)1020>::~SegmentImpl()|hg:hg.mozilla.org/mozilla-central:mfbt/SegmentedVector.h:6921abcd74295e0b89a234508b730d1ad245456c|78|0x30
13|6|libxul.so|mozilla::SegmentedVector<nsCOMPtr<nsISupports>, (unsigned int)4096, mozilla::MallocAllocPolicy>::PopLastN(unsigned int)|hg:hg.mozilla.org/mozilla-central:mfbt/SegmentedVector.h:6921abcd74295e0b89a234508b730d1ad245456c|246|0x53
13|7|libxul.so|mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.h:6921abcd74295e0b89a234508b730d1ad245456c|2770|0x3c
13|8|libxul.so|mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSRuntime.cpp:6921abcd74295e0b89a234508b730d1ad245456c|1697|0x130
13|9|libxul.so|mozilla::IncrementalFinalizeRunnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSRuntime.cpp:6921abcd74295e0b89a234508b730d1ad245456c|1734|0x57
13|10|libxul.so|IdleRunnableWrapper::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:6921abcd74295e0b89a234508b730d1ad245456c|309|0x52
13|11|libxul.so|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6921abcd74295e0b89a234508b730d1ad245456c|467|0xe4
13|12|libxul.so|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6921abcd74295e0b89a234508b730d1ad245456c|780|0x53f
13|13|libxul.so|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6921abcd74295e0b89a234508b730d1ad245456c|654|0x181
13|14|libxul.so|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6921abcd74295e0b89a234508b730d1ad245456c|390|0x6d
13|15|libxul.so|mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:6921abcd74295e0b89a234508b730d1ad245456c|531|0x22
13|16|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:6921abcd74295e0b89a234508b730d1ad245456c|1180|0x5db
13|17|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:6921abcd74295e0b89a234508b730d1ad245456c|465|0x6c
13|18|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:6921abcd74295e0b89a234508b730d1ad245456c|85|0x9b
13|19|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:6921abcd74295e0b89a234508b730d1ad245456c|380|0x66
13|20|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:6921abcd74295e0b89a234508b730d1ad245456c|355|0x3c
13|21|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:6921abcd74295e0b89a234508b730d1ad245456c|137|0x36
13|22|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:6921abcd74295e0b89a234508b730d1ad245456c|870|0x55
13|23|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:6921abcd74295e0b89a234508b730d1ad245456c|235|0x45
13|24|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:6921abcd74295e0b89a234508b730d1ad245456c|380|0x66
13|25|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:6921abcd74295e0b89a234508b730d1ad245456c|355|0x3c
13|26|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:6921abcd74295e0b89a234508b730d1ad245456c|729|0x54c
13|27|libxul.so|mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/Bootstrap.cpp:6921abcd74295e0b89a234508b730d1ad245456c|67|0x23
13|28|libmozglue.so|Java_org_mozilla_gecko_mozglue_GeckoLoader_nativeRun|hg:hg.mozilla.org/mozilla-central:mozglue/android/APKOpen.cpp:6921abcd74295e0b89a234508b730d1ad245456c|400|0x19a
13|29|libart.so||||
Updated•2 years ago
|
Comment 1•2 years ago
|
||
Marking P2/S2 since it is unclear whether non-debug builds do something safe in this situation.
Updated•1 year ago
|
Updated•1 year ago
|
Updated•1 year ago
|
Assignee | ||
Comment 2•1 year ago
|
||
The MozPromiseHolderBase
destructor is complaining that there is still an mPromise
.
This comes from a task that will not be run if the GeckoViewPermissionProcessChild
"AskDevicePermission" does not receive a reply before the Actor is destroyed.
A similar assertion failure can be generated with desktop builds when they have pref("media.navigator.permission.device", true);
, though the failure is earlier because there is no "getUserMedia:ask-device-permission" observer to hold a reference to the task.
Assignee | ||
Comment 3•11 months ago
|
||
This seems to be a consequence of the change from Pledge
to MozPromise
.
Assignee | ||
Comment 4•11 months ago
|
||
Comment 5•11 months ago
|
||
Set release status flags based on info from the regressing bug 1479841
Updated•11 months ago
|
Pushed by ktomlinson@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/b9e3497b939c resolve EnumerateRawDevices() promise if task is destroyed before run r=jib
Comment 7•10 months ago
|
||
bugherder |
Comment 8•10 months ago
|
||
Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.
Comment 9•10 months ago
|
||
The patch landed in nightly and beta is affected.
:karlt, is this bug important enough to require an uplift?
- If yes, please nominate the patch for beta approval.
- If no, please set
status-firefox115
towontfix
.
For more information, please visit BugBot documentation.
Assignee | ||
Comment 10•10 months ago
|
||
Android-only process-shutdown assertion failure, the worst consequences of which would be a diagnostic assertion failure or leak.
Assignee | ||
Updated•4 months ago
|
Description
•