Closed Bug 1767893 Opened 2 years ago Closed 10 months ago

Assertion failure: !mPromise, at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1318

Categories

(Core :: WebRTC: Audio/Video, defect, P2)

Unspecified
Android
defect

Tracking

()

RESOLVED FIXED
116 Branch
Tracking Status
firefox-esr102 --- wontfix
firefox101 --- wontfix
firefox102 --- wontfix
firefox112 --- wontfix
firefox113 --- wontfix
firefox114 --- wontfix
firefox115 --- wontfix
firefox116 --- fixed

People

(Reporter: tsmith, Assigned: karlt)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase)

Attachments

(2 files)

Attached file testcase.html

Found while fuzzing m-c 20220429-6921abcd7429 (--enable-debug --enable-fuzzing)

The fuzzers are seeing this on Android (x86).

Assertion failure: !mPromise, at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1318

eax = 0xb8614625    ebp = 0xbd508a38    ebx = 0xbc01aaa0
ecx = 0xbcbe6c74    edi = 0xab743ac0    edx = 0x00000000
eflags = 0x00210282 eip = 0xb40af7ec    esi = 0x00000526
esp = 0xbd508a20
OS|Android|0.0.0 Linux 5.4.86-android11-2-00006-gae78026f427c-ab7595864 #1 SMP PREEMPT Thu Jul 29 20:54:47 UTC 2021 i686
CPU|x86|GenuineIntel family 6 model 6 stepping 3|4
Crash|SIGSEGV / SEGV_MAPERR|0x00000000|13
13|0|libxul.so|mozilla::MozPromiseHolderBase<mozilla::MozPromise<RefPtr<mozilla::media::Refcountable<nsTArray<RefPtr<mozilla::MediaDevice> > > >, RefPtr<mozilla::MediaMgrError>, true>, mozilla::MozPromiseHolder<mozilla::MozPromise<RefPtr<mozilla::media::Refcountable<nsTArray<RefPtr<mozilla::MediaDevice> > > >, RefPtr<mozilla::MediaMgrError>, true> > >::~MozPromiseHolderBase()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/MozPromise.h:6921abcd74295e0b89a234508b730d1ad245456c|1318|0x4e
13|1|libxul.so|mozilla::MediaManager::EnumerateRawDevices(mozilla::dom::MediaSourceEnum, mozilla::dom::MediaSourceEnum, mozilla::EnumSet<mozilla::MediaManager::EnumerationFlag, unsigned int>)::$_90::~$_90()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaManager.cpp:6921abcd74295e0b89a234508b730d1ad245456c|1828|0x2d
13|2|libxul.so|mozilla::media::LambdaTask<mozilla::MediaManager::EnumerateRawDevices(mozilla::dom::MediaSourceEnum, mozilla::dom::MediaSourceEnum, mozilla::EnumSet<mozilla::MediaManager::EnumerationFlag, unsigned int>)::$_90>::~LambdaTask()|hg:hg.mozilla.org/mozilla-central:dom/media/systemservices/MediaTaskUtils.h:6921abcd74295e0b89a234508b730d1ad245456c|28|0x1e
13|3|libxul.so|mozilla::Runnable::Release()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:6921abcd74295e0b89a234508b730d1ad245456c|61|0x62
13|4|libxul.so|nsCOMPtr_base::~nsCOMPtr_base()|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsCOMPtr.h:6921abcd74295e0b89a234508b730d1ad245456c|328|0x35
13|5|libxul.so|mozilla::SegmentedVector<nsCOMPtr<nsISupports>, (unsigned int)4096, mozilla::MallocAllocPolicy>::SegmentImpl<(unsigned int)1020>::~SegmentImpl()|hg:hg.mozilla.org/mozilla-central:mfbt/SegmentedVector.h:6921abcd74295e0b89a234508b730d1ad245456c|78|0x30
13|6|libxul.so|mozilla::SegmentedVector<nsCOMPtr<nsISupports>, (unsigned int)4096, mozilla::MallocAllocPolicy>::PopLastN(unsigned int)|hg:hg.mozilla.org/mozilla-central:mfbt/SegmentedVector.h:6921abcd74295e0b89a234508b730d1ad245456c|246|0x53
13|7|libxul.so|mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.h:6921abcd74295e0b89a234508b730d1ad245456c|2770|0x3c
13|8|libxul.so|mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSRuntime.cpp:6921abcd74295e0b89a234508b730d1ad245456c|1697|0x130
13|9|libxul.so|mozilla::IncrementalFinalizeRunnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSRuntime.cpp:6921abcd74295e0b89a234508b730d1ad245456c|1734|0x57
13|10|libxul.so|IdleRunnableWrapper::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:6921abcd74295e0b89a234508b730d1ad245456c|309|0x52
13|11|libxul.so|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6921abcd74295e0b89a234508b730d1ad245456c|467|0xe4
13|12|libxul.so|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6921abcd74295e0b89a234508b730d1ad245456c|780|0x53f
13|13|libxul.so|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6921abcd74295e0b89a234508b730d1ad245456c|654|0x181
13|14|libxul.so|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:6921abcd74295e0b89a234508b730d1ad245456c|390|0x6d
13|15|libxul.so|mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:6921abcd74295e0b89a234508b730d1ad245456c|531|0x22
13|16|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:6921abcd74295e0b89a234508b730d1ad245456c|1180|0x5db
13|17|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:6921abcd74295e0b89a234508b730d1ad245456c|465|0x6c
13|18|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:6921abcd74295e0b89a234508b730d1ad245456c|85|0x9b
13|19|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:6921abcd74295e0b89a234508b730d1ad245456c|380|0x66
13|20|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:6921abcd74295e0b89a234508b730d1ad245456c|355|0x3c
13|21|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:6921abcd74295e0b89a234508b730d1ad245456c|137|0x36
13|22|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:6921abcd74295e0b89a234508b730d1ad245456c|870|0x55
13|23|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:6921abcd74295e0b89a234508b730d1ad245456c|235|0x45
13|24|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:6921abcd74295e0b89a234508b730d1ad245456c|380|0x66
13|25|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:6921abcd74295e0b89a234508b730d1ad245456c|355|0x3c
13|26|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:6921abcd74295e0b89a234508b730d1ad245456c|729|0x54c
13|27|libxul.so|mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/Bootstrap.cpp:6921abcd74295e0b89a234508b730d1ad245456c|67|0x23
13|28|libmozglue.so|Java_org_mozilla_gecko_mozglue_GeckoLoader_nativeRun|hg:hg.mozilla.org/mozilla-central:mozglue/android/APKOpen.cpp:6921abcd74295e0b89a234508b730d1ad245456c|400|0x19a
13|29|libart.so||||
Flags: in-testsuite?
Component: Audio/Video → WebRTC

Marking P2/S2 since it is unclear whether non-debug builds do something safe in this situation.

Severity: -- → S2
Component: WebRTC → WebRTC: Audio/Video
Priority: -- → P2
Severity: S2 → S3
Flags: needinfo?(karlt)
No longer blocks: webrtc-triage

The MozPromiseHolderBase destructor is complaining that there is still an mPromise.

This comes from a task that will not be run if the GeckoViewPermissionProcessChild "AskDevicePermission" does not receive a reply before the Actor is destroyed.

A similar assertion failure can be generated with desktop builds when they have pref("media.navigator.permission.device", true);, though the failure is earlier because there is no "getUserMedia:ask-device-permission" observer to hold a reference to the task.

Assignee: nobody → karlt
Flags: needinfo?(karlt)
Keywords: regression
Regressed by: 1479841

Set release status flags based on info from the regressing bug 1479841

Pushed by ktomlinson@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b9e3497b939c
resolve EnumerateRawDevices() promise if task is destroyed before run r=jib
Status: NEW → RESOLVED
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → 116 Branch

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

The patch landed in nightly and beta is affected.
:karlt, is this bug important enough to require an uplift?

  • If yes, please nominate the patch for beta approval.
  • If no, please set status-firefox115 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(karlt)

Android-only process-shutdown assertion failure, the worst consequences of which would be a diagnostic assertion failure or leak.

Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: