1774467 - Crash [@ exposeToActiveJS]

Reporter

Description

•

9 months ago

Testcase found while fuzzing mozilla-central rev b1ed2fa50612 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build b1ed2fa50612 --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

[@ exposeToActiveJS]

    =================================================================
    ==195272==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x7f20e3fb7244 bp 0x7f2049ae3c30 sp 0x7f2049ae3c10 T20)
    ==195272==The signal is caused by a READ memory access.
    ==195272==Hint: address points to the zero page.
        #0 0x7f20e3fb7244 in exposeToActiveJS /builds/worker/workspace/obj-build/dist/include/js/RootingAPI.h:345:69
        #1 0x7f20e3fb7244 in get /builds/worker/workspace/obj-build/dist/include/js/RootingAPI.h:348:5
        #2 0x7f20e3fb7244 in operator JSObject *const & /builds/worker/workspace/obj-build/dist/include/js/RootingAPI.h:340:3
        #3 0x7f20e3fb7244 in PromiseObj /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Promise.h:296:41
        #4 0x7f20e3fb7244 in mozilla::dom::ToJSValue(JSContext*, mozilla::dom::Promise&, JS::MutableHandle<JS::Value>) /dom/bindings/ToJSValue.cpp:64:31
        #5 0x7f20e3293b14 in ToJSValue<mozilla::dom::Promise> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/ToJSValue.h:268:10
        #6 0x7f20e3293b14 in mozilla::dom::StorageManager_Binding::estimate(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/StorageManagerBinding.cpp:264:8
        #7 0x7f20e3293949 in mozilla::dom::StorageManager_Binding::estimate_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/StorageManagerBinding.cpp:273:13
        #8 0x7f20e3f853d1 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3272:13
        #9 0x7f20ee339200 in CallJSNative /js/src/vm/Interpreter.cpp:421:13
        #10 0x7f20ee339200 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:508:12
        #11 0x7f20ee327862 in InternalCall /js/src/vm/Interpreter.cpp:575:10
        #12 0x7f20ee327862 in CallFromStack /js/src/vm/Interpreter.cpp:579:10
        #13 0x7f20ee327862 in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3325:16
        #14 0x7f20ee30cdc9 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:390:13
        #15 0x7f20ee33933e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:540:13
        #16 0x7f20ee33ae1e in InternalCall /js/src/vm/Interpreter.cpp:575:10
        #17 0x7f20ee33ae1e in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:606:8
        #18 0x7f20ec9e7565 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #19 0x7f20e3ba200f in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:266:37
        #20 0x7f20e49af483 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:362:12
        #21 0x7f20e49ada28 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /dom/events/JSEventHandler.cpp:201:12
        #22 0x7f20e4973d68 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /dom/events/EventListenerManager.cpp:1316:22
        #23 0x7f20e49752ec in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1507:17
        #24 0x7f20e496340e in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:348:17
        #25 0x7f20e4961c71 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:550:16
        #26 0x7f20e4965e55 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1119:11
        #27 0x7f20e496b7d1 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp
        #28 0x7f20e4919aad in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/events/DOMEventTargetHelper.cpp:180:17
        #29 0x7f20e49826e3 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /dom/events/EventTarget.cpp:180:13
        #30 0x7f20e6c261e2 in mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool) /dom/workers/MessageEventRunnable.cpp:105:12
        #31 0x7f20e6c9261e in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #32 0x7f20dee8dc1e in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1174:16
        #33 0x7f20dee97824 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #34 0x7f20e6c7a84c in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3144:7
        #35 0x7f20e6c5007e in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2043:42
        #36 0x7f20dee8dc1e in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1174:16
        #37 0x7f20dee97824 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #38 0x7f20e0609b75 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:300:20
        #39 0x7f20e0488d61 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #40 0x7f20e0488d61 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #41 0x7f20e0488d61 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #42 0x7f20dee851de in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:378:10
        #43 0x7f2106189b7e in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #44 0x7f2106ac0608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
        #45 0x7f2106687132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/js/RootingAPI.h:345:69 in exposeToActiveJS
    Thread T20 (DOM Worker) created by T0 (Isolated Web Co) here:
        #0 0x56176f9c059c in __interceptor_pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:208:3
        #1 0x7f2106179c2c in _PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:458:14
        #2 0x7f210616afce in PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:533:12
        #3 0x7f20dee87df5 in nsThread::Init(nsTSubstring<char> const&) /xpcom/threads/nsThread.cpp:604:18
        #4 0x7f20e6ca117a in mozilla::dom::WorkerThread::Create(mozilla::dom::WorkerThreadFriendKey const&) /dom/workers/WorkerThread.cpp:102:7
        #5 0x7f20e6c2b015 in mozilla::dom::workerinternals::RuntimeService::ScheduleWorker(mozilla::dom::WorkerPrivate&) /dom/workers/RuntimeService.cpp:1324:37
        #6 0x7f20e6c29fe1 in mozilla::dom::workerinternals::RuntimeService::RegisterWorker(mozilla::dom::WorkerPrivate&) /dom/workers/RuntimeService.cpp:1200:19
        #7 0x7f20e6c74dc6 in mozilla::dom::WorkerPrivate::Constructor(JSContext*, nsTSubstring<char16_t> const&, bool, mozilla::dom::WorkerKind, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::WorkerLoadInfo*, mozilla::ErrorResult&, nsTString<char16_t>) /dom/workers/WorkerPrivate.cpp:2539:24
        #8 0x7f20e6c3a7f5 in mozilla::dom::Worker::Constructor(mozilla::dom::GlobalObject const&, nsTSubstring<char16_t> const&, mozilla::dom::WorkerOptions const&, mozilla::ErrorResult&) /dom/workers/Worker.cpp:43:41
        #9 0x7f20e37fe7f4 in mozilla::dom::Worker_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/WorkerBinding.cpp:1114:52
        #10 0x7f20ee33bc1b in CallJSNative /js/src/vm/Interpreter.cpp:421:13
        #11 0x7f20ee33bc1b in CallJSNativeConstructor /js/src/vm/Interpreter.cpp:437:8
        #12 0x7f20ee33bc1b in InternalConstruct(JSContext*, js::AnyConstructArgs const&) /js/src/vm/Interpreter.cpp:653:10
        #13 0x7f20ee32780a in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3315:16
        #14 0x7f20ee30cdc9 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:390:13
        #15 0x7f20ee33933e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:540:13
        #16 0x7f20ee33ae1e in InternalCall /js/src/vm/Interpreter.cpp:575:10
        #17 0x7f20ee33ae1e in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:606:8
        #18 0x7f20ec9e7565 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #19 0x7f20e3ba4a79 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:62:8
        #20 0x7f20e4974214 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #21 0x7f20e4973cd0 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /dom/events/EventListenerManager.cpp:1310:43
        #22 0x7f20e4975290 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1507:17
        #23 0x7f20e496340e in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:348:17
        #24 0x7f20e4961c71 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:550:16
        #25 0x7f20e4965e55 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1119:11
        #26 0x7f20e496b7d1 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp
        #27 0x7f20e239e1e4 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/base/nsINode.cpp:1366:17
        #28 0x7f20e1cb206f in nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch) /dom/base/nsContentUtils.cpp:4351:28
        #29 0x7f20e1cb1d36 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*) /dom/base/nsContentUtils.cpp:4321:10
        #30 0x7f20e20008b6 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8033:3
        #31 0x7f20e20f4ddd in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1147:12
        #32 0x7f20e20f4ddd in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1153:12
        #33 0x7f20e20f4ddd in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1200:13
        #34 0x7f20dee594cf in mozilla::SchedulerGroup::Runnable::Run() /xpcom/threads/SchedulerGroup.cpp:140:20
        #35 0x7f20deea7012 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:475:16
        #36 0x7f20dee6c645 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:788:26
        #37 0x7f20dee697f8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:620:15
        #38 0x7f20dee69f20 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:398:36
        #39 0x7f20deeafc11 in operator() /xpcom/threads/TaskController.cpp:124:37
        #40 0x7f20deeafc11 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #41 0x7f20dee8d3f7 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1180:16
        #42 0x7f20dee97824 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #43 0x7f20e06084cf in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #44 0x7f20e0488d61 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #45 0x7f20e0488d61 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #46 0x7f20e0488d61 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #47 0x7f20e7591067 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:150:27
        #48 0x7f20ec5709f7 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:875:20
        #49 0x7f20e0488d61 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #50 0x7f20e0488d61 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #51 0x7f20e0488d61 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #52 0x7f20ec56fb5f in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:734:34
        #53 0x56176fa146d5 in content_process_main(mozilla::Bootstrap*, int, char**) /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #54 0x56176fa14a86 in main /browser/app/nsBrowserApp.cpp:338:18
        #55 0x7f210658c082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    
    ==195272==ABORTING

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

9 months ago

Attached file Testcase — Details

Bugmon [:jkratzer for issues]

Comment 2

•

9 months ago

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220615214908-0e44540919cd.
The bug appears to have been introduced in the following build range:

Start: 7ea5369fe67682fe655b632705135ded8b1de11a (20210809141137)
End: 0f323b67aa6bfb598b1186101bc8f856f7836292 (20210809190531)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=7ea5369fe67682fe655b632705135ded8b1de11a&tochange=0f323b67aa6bfb598b1186101bc8f856f7836292

Keywords: regression

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Jens Stutte [:jstutte]

Comment 3

•

9 months ago

(In reply to Bugmon [:jkratzer for issues] from comment #2)

Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=7ea5369fe67682fe655b632705135ded8b1de11a&tochange=0f323b67aa6bfb598b1186101bc8f856f7836292

Hi Jan, from the pushlog to me bug 1723715 might stand out here?

Flags: needinfo?(jdemooij)

Jan de Mooij [:jandem]

Comment 4

•

9 months ago

(In reply to Jens Stutte [:jstutte] from comment #3)

Hi Jan, from the pushlog to me bug 1723715 might stand out here?

It's unlikely, but I looked into it and the test case uses self.reportError which was implemented in bug 1722448 and is in that range. The regression is likely older, assuming the failure doesn't depend on that reportError call.

Flags: needinfo?(jdemooij)

Jens Stutte [:jstutte]

Comment 5

•

9 months ago

Thanks! :evilpies, can you confirm?

Flags: needinfo?(evilpies)

Tom S [:evilpie]

Comment 6

•

9 months ago

I pretty sure what is happening here is that StorageManager::Estimate returns a nullptr without throwing an error. The first thing that jumps out to me is this: https://searchfox.org/mozilla-central/source/dom/quota/StorageManager.cpp#362-364.

Flags: needinfo?(evilpies)

Jens Stutte [:jstutte]

Comment 7

•

9 months ago

(In reply to Tom Schuster [:evilpie] from comment #6)

I pretty sure what is happening here is that StorageManager::Estimate returns a nullptr without throwing an error. The first thing that jumps out to me is this: https://searchfox.org/mozilla-central/source/dom/quota/StorageManager.cpp#362-364.

Thanks! Yeah, that sounds likely. IIUC the nullptr thing starts here in StrongWorkerRef::CreateImpl, that is we try to create a StrongWorkerRef to an already canceled worker. So I think you are right in saying that StorageManager::Estimate should throw an error there.

Severity: -- → S3

Priority: -- → P3

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:confirm]

Jens Stutte [:jstutte]

Comment 8

•

9 months ago

Harveer, would you mind taking this once you have time? Thanks

Flags: needinfo?(hsingh)

Jens Stutte [:jstutte]

Comment 9

•

9 months ago

(I requested another bisection from bugmon as I suspect this is a timing sensitive race on close and thus the bisection range could be not reliable)

Harveer Singh

Assignee

Comment 10

•

9 months ago

Jens, sure. I will assign this to myself.

Flags: needinfo?(hsingh)

Harveer Singh

Assignee

Updated

•

9 months ago

Assignee: nobody → hsingh

Bugmon [:jkratzer for issues]

Comment 11

•

9 months ago

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220622094342-0242545b34ca.
The bug appears to have been introduced in the following build range:

Start: 7ea5369fe67682fe655b632705135ded8b1de11a (20210809141137)
End: 0f323b67aa6bfb598b1186101bc8f856f7836292 (20210809190531)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=7ea5369fe67682fe655b632705135ded8b1de11a&tochange=0f323b67aa6bfb598b1186101bc8f856f7836292

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Jason Kratzer [:jkratzer]

Reporter

Comment 12

•

9 months ago

(In reply to Jens Stutte [:jstutte] from comment #9)

(I requested another bisection from bugmon as I suspect this is a timing sensitive race on close and thus the bisection range could be not reliable)

Looks like the same bisection range was returned. If you know of a testcase that doesn't use self.reportError as per comment 4, you can attach it here and mark the previous testcase as obsolete. Then re-run the bisection.

Release mgmt bot [:suhaib / :marco/ :calixte]

Comment 13

•

9 months ago

:hsingh, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Flags: needinfo?(hsingh)

Jens Stutte [:jstutte]

Comment 14

•

9 months ago

(In reply to Release mgmt bot [:suhaib / :marco/ :calixte] from comment #13)

:hsingh, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Just to be clear: We know what to fix but it is less clear, what in that range could have regressed this. Apparently there must be some change in when we cancel a worker that makes us get hear, but assuming that it is ok to cancel a worker anytime, this error needs to be just handled correctly in StorageManager::Estimate.

Harveer Singh

Assignee

Updated

•

9 months ago

Flags: needinfo?(hsingh)

Harveer Singh

Assignee

Comment 15

•

9 months ago

Attached file Bug 1774467: Fixed bug where premature shutdown of dedicated worker could lead to browser crash. r=#dom-storage-reviewers — Details

Pulsebot

Comment 16

•

9 months ago

Pushed by bugmail@asutherland.org:
https://hg.mozilla.org/integration/autoland/rev/e5eb50f55979
Fixed bug where premature shutdown of dedicated worker could lead to browser crash. r=dom-storage-reviewers,asuth

Iulian Moraru

Comment 17

•

9 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/e5eb50f55979

Status: NEW → RESOLVED

Closed: 9 months ago

status-firefox104: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 104 Branch

Bugmon [:jkratzer for issues]

Comment 18

•

9 months ago

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220708040957-9d777ac6ab3a.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED

status-firefox104: fixed → verified

Keywords: bugmon

Ryan VanderMeulen [:RyanVM]

Updated

•

8 months ago

status-firefox102: --- → wontfix

status-firefox103: --- → wontfix

status-firefox-esr102: --- → wontfix

status-firefox-esr91: --- → wontfix

Testcase 9 months ago Jason Kratzer [:jkratzer] 3.91 KB, application/octet-stream		Details
Bug 1774467: Fixed bug where premature shutdown of dedicated worker could lead to browser crash. r=#dom-storage-reviewers 9 months ago Harveer Singh 48 bytes, text/x-phabricator-request		Details \| Review