1770075 - Assertion failure: !aGCThing, at src/xpcom/base/CycleCollectedJSRuntime.cpp:1529

Status: VERIFIED FIXED

(Core :: WebRTC, defect)

Description

[Tyson Smith [:tsmith] (Back Aug 12)]

Attachment: testcase.html

Found while fuzzing m-c 20220515-338c1afa1635 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !aGCThing, at src/xpcom/base/CycleCollectedJSRuntime.cpp:1529

#0 0x7f060f56f561 in AssertNoGcThing(JS::GCCellPtr, char const*, void*) src/xpcom/base/CycleCollectedJSRuntime.cpp:1529:3
#1 0x7f060f56f47f in mozilla::CycleCollectedJSRuntime::AssertNoObjectsToTrace(void*) src/xpcom/base/CycleCollectedJSRuntime.cpp:1535:13
#2 0x7f060f59584f in nsCycleCollector::CollectWhite() src/xpcom/base/nsCycleCollector.cpp:3077:21
#3 0x7f060f5970eb in nsCycleCollector::Collect(mozilla::CCReason, ccIsManual, js::SliceBudget&, nsICycleCollectorListener*, bool) src/xpcom/base/nsCycleCollector.cpp:3440:26
#4 0x7f060f596ddd in nsCycleCollector::ShutdownCollect() src/xpcom/base/nsCycleCollector.cpp:3351:20
#5 0x7f060f5980d6 in nsCycleCollector::Shutdown(bool) src/xpcom/base/nsCycleCollector.cpp:3646:5
#6 0x7f060f599af2 in nsCycleCollector_shutdown(bool) src/xpcom/base/nsCycleCollector.cpp:3962:18
#7 0x7f060f6d0b13 in mozilla::ShutdownXPCOM(nsIServiceManager*) src/xpcom/build/XPCOMInit.cpp:712:3
#8 0x7f06164c71fc in XRE_TermEmbedding() src/toolkit/xre/nsEmbedFunctions.cpp:223:3
#9 0x7f061027248e in mozilla::ipc::ScopedXREEmbed::Stop() src/ipc/glue/ScopedXREEmbed.cpp:90:5
#10 0x7f06164c7895 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:737:16
#11 0x555b84755e90 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#12 0x555b84755e90 in main src/browser/app/nsBrowserApp.cpp:329:18
#13 0x7f0625b8a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#14 0x555b8472bc3c in _start (/home/worker/builds/m-c-20220515094927-fuzzing-debug/firefox-bin+0x15c3c) (BuildId: a3c3f38575613f8bfa5bd34a05d62cc5a64c66fd)

Comment 1

[Tyson Smith [:tsmith] (Back Aug 12)]

A Pernosco session is available here: https://pernos.co/debug/u1oP9EfGHG7Dl7eu8bQ0Bw/index.html

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220518214245-11b3a2e731a9.
The bug appears to have been introduced in the following build range:

Start: 5492a8c99f4aeae1b9bbc4024fb03e97a42809f6 (20220509141323)
End: 1b2d1b77ad1554cc67079059a381201bffbc55fd (20220509153556)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5492a8c99f4aeae1b9bbc4024fb03e97a42809f6&tochange=1b2d1b77ad1554cc67079059a381201bffbc55fd

Comment 3

[Michael Froman [:mjf]]

Byron, it looks like this may have been regressed by Bug 1586109. Do you mind having a look?

Comment 4

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1586109

Comment 5

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1586109

Comment 6

[Intermittent Failures Robot]

1 failures in 2917 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 1

Platform and build breakdown:

• linux1804-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1770075&startday=2022-05-30&endday=2022-06-05&tree=all

Comment 7

[Byron Campen [:bwc]]

I have no idea what this assertion is meant to check...

Comment 8

[Andrew McCreight [:mccr8]]

This means that a cycle collected thing needs to not contain any JS pointers (looking by calling the Trace method) after it is unlinked.

Comment 9

[Andrew McCreight [:mccr8]]

I haven't looked through everything, but it looks like RTCRtpTransceiver is missing a call to NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER

Comment 10

[Andrew McCreight [:mccr8]]

You should also be able to double check what the class is that is hitting the assert by figuring out what pinfo->mParticipant is in CollectWhite, in a debugger. I started the Pernosco trace up so hopefully that will be available at some point.

Comment 11

[Andrew McCreight [:mccr8]]

Attachment: Bug 1770075 - Unlink preserved wrapper in RTCRtpTransceiver.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/79ce93d0a0aa
Unlink preserved wrapper in RTCRtpTransceiver. r=bwc

Comment 13

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/79ce93d0a0aa

Comment 14

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220619215938-31a47343b91e.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 15

[Andrew McCreight [:mccr8]]

Comment on attachment 9281874 [details]
Bug 1770075 - Unlink preserved wrapper in RTCRtpTransceiver.

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: I'm not really sure what the implications of this are, but it seems simple enough that we should probably just uplift it.
• User impact if declined: I'm not sure. Maybe crashes, maybe nothing.
• Fix Landed on Version: 103
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): It just clears a field when an object is in the process of being destroyed.

Comment 16

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9281874 [details]
Bug 1770075 - Unlink preserved wrapper in RTCRtpTransceiver.

Approved for 102.1esr.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/1bf49a54476d