1771009 - Assertion failure: !HasTimeouts(), at /dom/base/TimeoutManager.cpp:914

Reporter

Description

•

2 years ago

Testcase found while fuzzing mozilla-central rev a8d14b452547 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build a8d14b452547 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !HasTimeouts(), at /dom/base/TimeoutManager.cpp:914

    ==643748==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ffbb5ec5cc7 bp 0x7ffc2dfcee80 sp 0x7ffc2dfcedd0 T643748)
    ==643748==The signal is caused by a WRITE memory access.
    ==643748==Hint: address points to the zero page.
        #0 0x7ffbb5ec5cc7 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /dom/base/TimeoutManager.cpp:914:11
        #1 0x7ffbb5eb0ce0 in mozilla::dom::TimeoutExecutor::MaybeExecute() /dom/base/TimeoutExecutor.cpp:179:11
        #2 0x7ffbb5eb1289 in Notify /dom/base/TimeoutExecutor.cpp:246:5
        #3 0x7ffbb5eb1289 in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /dom/base/TimeoutExecutor.cpp
        #4 0x7ffbb43caf2c in operator() /xpcom/threads/nsTimerImpl.cpp:656:44
        #5 0x7ffbb43caf2c in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
        #6 0x7ffbb43caf2c in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
        #7 0x7ffbb43caf2c in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:902:12
        #8 0x7ffbb43caf2c in match<(lambda at /xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:857:12
        #9 0x7ffbb43caf2c in nsTimerImpl::Fire(int) /xpcom/threads/nsTimerImpl.cpp:654:22
        #10 0x7ffbb439c79e in nsTimerEvent::Run() /xpcom/threads/TimerThread.cpp:263:11
        #11 0x7ffbb43bb9cd in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /xpcom/threads/ThrottledEventQueue.cpp:254:22
        #12 0x7ffbb43b82b1 in mozilla::ThrottledEventQueue::Inner::Executor::Run() /xpcom/threads/ThrottledEventQueue.cpp:81:15
        #13 0x7ffbb43b930e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:475:16
        #14 0x7ffbb4393cc3 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:788:26
        #15 0x7ffbb4392873 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:620:15
        #16 0x7ffbb4392ae3 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:398:36
        #17 0x7ffbb43bca96 in operator() /xpcom/threads/TaskController.cpp:124:37
        #18 0x7ffbb43bca96 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #19 0x7ffbb43a856f in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1180:16
        #20 0x7ffbb43aeb6d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #21 0x7ffbb4f6f146 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #22 0x7ffbb4e97b97 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:380:10
        #23 0x7ffbb4e97aa2 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #24 0x7ffbb4e97aa2 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #25 0x7ffbb90c2068 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #26 0x7ffbbb2067ab in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:874:20
        #27 0x7ffbb4f7003a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #28 0x7ffbb4e97b97 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:380:10
        #29 0x7ffbb4e97aa2 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #30 0x7ffbb4e97aa2 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #31 0x7ffbbb205dcc in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:733:34
        #32 0x5617ab7e9e90 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #33 0x5617ab7e9e90 in main /browser/app/nsBrowserApp.cpp:338:18
        #34 0x7ffbcb91a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
        #35 0x5617ab7bfc3c in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x15c3c) (BuildId: 84ed5f2846741362991b3c63588716ec37be5b9c)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/base/TimeoutManager.cpp:914:11 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool)
    ==643748==ABORTING

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

2 years ago

Attached file Testcase — Details

Bugmon [:jkratzer for issues]

Comment 2

•

2 years ago

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220524214448-3d57939c6779.
The bug appears to have been introduced in the following build range:

Start: 5e5c1c1c2630088c304db1b8bd7088effc3bd536 (20220401170250)
End: 53e6fbe77dff1c74b11e1903ccf3084a39f90cd0 (20220401192012)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5e5c1c1c2630088c304db1b8bd7088effc3bd536&tochange=53e6fbe77dff1c74b11e1903ccf3084a39f90cd0

Keywords: regression

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Edgar Chen [:edgar] (Parental leave until Oct. 09.)

Comment 3

•

2 years ago

Looks like a regression of bug 1753309.

Regressed by: 1753309

BugBot [:suhaib / :marco/ :calixte]

Comment 4

•

2 years ago

Set release status flags based on info from the regressing bug 1753309

status-firefox100: --- → affected

status-firefox101: --- → affected

status-firefox102: --- → affected

status-firefox-esr91: --- → unaffected

BugBot [:suhaib / :marco/ :calixte]

Comment 5

•

2 years ago

:saschanaz, since you are the author of the regressor, bug 1753309, could you take a look?
For more information, please visit auto_nag documentation.

Flags: needinfo?(krosylight)

Ryan VanderMeulen [:RyanVM]

Updated

•

2 years ago

status-firefox100: affected → wontfix

status-firefox101: affected → wontfix

Kagami Rosylight [:saschanaz] (they/them)

Assignee

Updated

•

2 years ago

Assignee: nobody → krosylight

Status: NEW → ASSIGNED

Flags: needinfo?(krosylight)

Kagami Rosylight [:saschanaz] (they/them)

Assignee

Comment 6

•

2 years ago

Attached file Bug 1771009 - Make TimeoutManager::SetTimeout no-op if window is dying r=smaug — Details

setTimeout is not affected since nsGlobalWindowInner::SetTimeout is not called at all when it's dying, but that's not the case with AbortSignal.timout, so we have to explicitly deal with such situation.

BugBot [:suhaib / :marco/ :calixte]

Updated

•

2 years ago

Has Regression Range: --- → yes

Pulsebot

Comment 7

•

2 years ago

Pushed by krosylight@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/f29c1f743f52 Make TimeoutManager::SetTimeout no-op if window is dying r=smaug

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Comment 8

•

2 years ago

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/34226 for changes under testing/web-platform/tests

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Updated

•

2 years ago

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

Iulian Moraru

Comment 9

•

2 years ago

Backed out for causing failures on timeout-close.html.

Push with failures

Failure log

Backout link

[task 2022-05-26T22:45:13.520Z] 22:45:13     INFO - TEST-START | /dom/abort/crashtests/timeout-close.html
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING - Traceback (most recent call last):
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -   File "/builds/worker/workspace/build/tests/web-platform/tests/tools/wptrunner/wptrunner/executors/executormarionette.py", line 811, in run_func
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -     self.result = True, self.func(self.protocol, self.url, self.timeout)
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -   File "/builds/worker/workspace/build/tests/web-platform/tests/tools/wptrunner/wptrunner/executors/executormarionette.py", line 1213, in do_crashtest
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -     protocol.base.execute_script(self.wait_script, asynchronous=True)
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -   File "/builds/worker/workspace/build/tests/web-platform/tests/tools/wptrunner/wptrunner/executors/executormarionette.py", line 86, in execute_script
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -     return method(script, new_sandbox=False, sandbox=None)
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -   File "/builds/worker/workspace/build/venv/lib/python3.6/site-packages/marionette_driver/marionette.py", line 1786, in execute_async_script
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -     rv = self._send_message("WebDriver:ExecuteAsyncScript", body, key="value")
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -   File "/builds/worker/workspace/build/venv/lib/python3.6/site-packages/marionette_driver/decorators.py", line 27, in _
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -     return func(*args, **kwargs)
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -   File "/builds/worker/workspace/build/venv/lib/python3.6/site-packages/marionette_driver/marionette.py", line 668, in _send_message
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -     self._handle_error(err)
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -   File "/builds/worker/workspace/build/venv/lib/python3.6/site-packages/marionette_driver/marionette.py", line 680, in _handle_error
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING -     raise errors.lookup(error)(message, stacktrace=stacktrace)
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING - marionette_driver.errors.JavascriptException: JavaScriptError: Document was unloaded
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING - stacktrace:
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING - 	WebDriverError@chrome://remote/content/shared/webdriver/Errors.jsm:186:5
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING - 	JavaScriptError@chrome://remote/content/shared/webdriver/Errors.jsm:365:5
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING - 	evaluate.sandbox/promise</unloadHandler<@chrome://remote/content/marionette/evaluate.js:151:20
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING - 
[task 2022-05-26T22:45:13.662Z] 22:45:13  WARNING - 
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO - TEST-UNEXPECTED-ERROR | /dom/abort/crashtests/timeout-close.html | JavaScriptError: Document was unloaded
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO - Traceback (most recent call last):
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -   File "/builds/worker/workspace/build/tests/web-platform/tests/tools/wptrunner/wptrunner/executors/executormarionette.py", line 811, in run_func
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -     self.result = True, self.func(self.protocol, self.url, self.timeout)
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -   File "/builds/worker/workspace/build/tests/web-platform/tests/tools/wptrunner/wptrunner/executors/executormarionette.py", line 1213, in do_crashtest
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -     protocol.base.execute_script(self.wait_script, asynchronous=True)
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -   File "/builds/worker/workspace/build/tests/web-platform/tests/tools/wptrunner/wptrunner/executors/executormarionette.py", line 86, in execute_script
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -     return method(script, new_sandbox=False, sandbox=None)
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.6/site-packages/marionette_driver/marionette.py", line 1786, in execute_async_script
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -     rv = self._send_message("WebDriver:ExecuteAsyncScript", body, key="value")
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.6/site-packages/marionette_driver/decorators.py", line 27, in _
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -     return func(*args, **kwargs)
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.6/site-packages/marionette_driver/marionette.py", line 668, in _send_message
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -     self._handle_error(err)
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -   File "/builds/worker/workspace/build/venv/lib/python3.6/site-packages/marionette_driver/marionette.py", line 680, in _handle_error
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO -     raise errors.lookup(error)(message, stacktrace=stacktrace)
[task 2022-05-26T22:45:13.775Z] 22:45:13     INFO - marionette_driver.errors.JavascriptException: JavaScriptError: Document was unloaded
[task 2022-05-26T22:45:13.776Z] 22:45:13     INFO - stacktrace:
[task 2022-05-26T22:45:13.776Z] 22:45:13     INFO - 	WebDriverError@chrome://remote/content/shared/webdriver/Errors.jsm:186:5
[task 2022-05-26T22:45:13.776Z] 22:45:13     INFO - 	JavaScriptError@chrome://remote/content/shared/webdriver/Errors.jsm:365:5
[task 2022-05-26T22:45:13.776Z] 22:45:13     INFO - 	evaluate.sandbox/promise</unloadHandler<@chrome://remote/content/marionette/evaluate.js:151:20
[task 2022-05-26T22:45:13.776Z] 22:45:13     INFO - 
[task 2022-05-26T22:45:13.776Z] 22:45:13     INFO - TEST-INFO took 252ms
[task 2022-05-26T22:45:13.776Z] 22:45:13     INFO - Restarting browser for new test group
[task 2022-05-26T22:45:14.158Z] 22:45:14     INFO - STDOUT: cleanup aborted: Unable to remount device
[task 2022-05-26T22:45:14.285Z] 22:45:14     INFO - STDOUT: cleanup aborted: Unable to remount device
[task 2022-05-26T22:45:14.287Z] 22:45:14     INFO - Closing logging queue
[task 2022-05-26T22:45:14.287Z] 22:45:14     INFO - queue closed
[task 2022-05-26T22:45:14.310Z] 22:45:14     INFO - Setting up ssl
[task 2022-05-26T22:45:14.335Z] 22:45:14     INFO - certutil | b''
[task 2022-05-26T22:45:14.362Z] 22:45:14     INFO - certutil | b''
[task 2022-05-26T22:45:14.382Z] 22:45:14     INFO - certutil | b'\nCertificate Nickname                                         Trust Attributes\n                                                             SSL,S/MIME,JAR/XPI\n\nweb-platform-tests                                           CT,, \n'
[task 2022-05-26T22:45:15.265Z] 22:45:15     INFO - adb Granting important runtime permissions to org.mozilla.geckoview.test_runner
[task 2022-05-26T22:45:16.805Z] 22:45:16     INFO - adb launch_application: am start -W -n org.mozilla.geckoview.test_runner/org.mozilla.geckoview.test_runner.TestRunnerActivity -a android.intent.action.MAIN --es env0 MOZ_CRASHREPORTER=1 --es env1 MOZ_CRASHREPORTER_NO_REPORT=1 --es env2 MOZ_CRASHREPORTER_SHUTDOWN=1 --es env3 MOZ_HIDE_RESULTS_TABLE=1 --es env4 MOZ_IN_AUTOMATION=1 --es env5 MOZ_LOG=signaling:3,mtransport:4,DataChannel:4,jsep:4 --es env6 R_LOG_LEVEL=6 --es env7 R_LOG_DESTINATION=stderr --es env8 R_LOG_VERBOSE=1 --es env9 MOZ_PROCESS_LOG=/tmp/tmplh5dvrmnpidlog --es env10 MOZ_DISABLE_NONLOCAL_CONNECTIONS=1 --es env11 STYLO_THREADS=1 --es arg0 -no-remote --es arg1 -profile --es arg2 /data/local/tmp/test_root/profile --es arg3 --marionette --es arg4 about:blank --ez use_multiprocess True
[task 2022-05-26T22:45:17.940Z] 22:45:17     INFO - Starting runner
[task 2022-05-26T22:45:18.901Z] 22:45:18     INFO - TEST-START | /dom/events/keypress-dispatch-crash.html

Flags: needinfo?(krosylight)

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Comment 10

•

2 years ago

Upstream PR was closed without merging

Pulsebot

Comment 11

•

2 years ago

Pushed by krosylight@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/1b5a961e5406 Make TimeoutManager::SetTimeout no-op if window is dying r=smaug

Cristian Tuns

Comment 12

•

2 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/1b5a961e5406

Status: ASSIGNED → RESOLVED

Closed: 2 years ago

status-firefox102: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → 102 Branch

Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)

Comment 13

•

2 years ago

Upstream PR merged by moz-wptsync-bot

Kagami Rosylight [:saschanaz] (they/them)

Assignee

Updated

•

2 years ago

Flags: needinfo?(krosylight)

Bugmon [:jkratzer for issues]

Comment 14

•

2 years ago

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220528091325-c7f47d9896aa.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED

status-firefox102: fixed → verified

Keywords: bugmon

Testcase 2 years ago Jason Kratzer [:jkratzer] 495 bytes, text/plain		Details
Bug 1771009 - Make TimeoutManager::SetTimeout no-op if window is dying r=smaug 2 years ago Kagami Rosylight [:saschanaz] (they/them) 48 bytes, text/x-phabricator-request		Details \| Review