1775486 - Assertion failure: !aGCThing, at /xpcom/base/CycleCollectedJSRuntime.cpp:1532

Status: RESOLVED FIXED

(Core :: Graphics: WebGPU, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 0242545b34ca (built with: --enable-debug --enable-fuzzing).

Marking as S-S just in case since this occurs during garbage collection.

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 0242545b34ca --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !aGCThing, at /xpcom/base/CycleCollectedJSRuntime.cpp:1532

    ==927317==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f3e50191931 bp 0x7ffc12df41f0 sp 0x7ffc12df41d0 T927317)
    ==927317==The signal is caused by a WRITE memory access.
    ==927317==Hint: address points to the zero page.
        #0 0x7f3e50191931 in AssertNoGcThing(JS::GCCellPtr, char const*, void*) /xpcom/base/CycleCollectedJSRuntime.cpp:1532:3
        #1 0x7f3e5368a3a1 in mozilla::webgpu::Buffer::cycleCollection::Trace(void*, TraceCallbacks const&, void*) /dom/webgpu/Buffer.cpp:39:7
        #2 0x7f3e5019184f in mozilla::CycleCollectedJSRuntime::AssertNoObjectsToTrace(void*) /xpcom/base/CycleCollectedJSRuntime.cpp:1538:13
        #3 0x7f3e501b7f2f in nsCycleCollector::CollectWhite() /xpcom/base/nsCycleCollector.cpp:3077:21
        #4 0x7f3e501b97db in nsCycleCollector::Collect(mozilla::CCReason, ccIsManual, js::SliceBudget&, nsICycleCollectorListener*, bool) /xpcom/base/nsCycleCollector.cpp:3440:26
        #5 0x7f3e501b94cd in nsCycleCollector::ShutdownCollect() /xpcom/base/nsCycleCollector.cpp:3351:20
        #6 0x7f3e501ba816 in nsCycleCollector::Shutdown(bool) /xpcom/base/nsCycleCollector.cpp:3647:5
        #7 0x7f3e501bc232 in nsCycleCollector_shutdown(bool) /xpcom/base/nsCycleCollector.cpp:3963:18
        #8 0x7f3e502f6105 in mozilla::ShutdownXPCOM(nsIServiceManager*) /xpcom/build/XPCOMInit.cpp:705:3
        #9 0x7f3e5712432c in XRE_TermEmbedding() /toolkit/xre/nsEmbedFunctions.cpp:224:3
        #10 0x7f3e50ea055e in mozilla::ipc::ScopedXREEmbed::Stop() /ipc/glue/ScopedXREEmbed.cpp:90:5
        #11 0x7f3e571249c5 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:738:16
        #12 0x55c07b269f70 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #13 0x55c07b269f70 in main /browser/app/nsBrowserApp.cpp:338:18
        #14 0x7f3e66f2e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
        #15 0x55c07b23fd1c in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x15d1c) (BuildId: dd6e9f4140ebb5f07010c92403424520bc60bcea)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /xpcom/base/CycleCollectedJSRuntime.cpp:1532:3 in AssertNoGcThing(JS::GCCellPtr, char const*, void*)
    ==927317==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220622094342-0242545b34ca.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 152fdda295bb5f6658d65c2bc48bc6aae499b526 (20210623095324)
End: 0242545b34ca3f3290c68496c2e921ddfdf5cdc3 (20220622094342)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 3

[Andrew McCreight [:mccr8]]

Looks like mMapped->mArrayBuffers needs to be cleared in Unlink. I'm not sure how bad this is securitywise. In the worst case, it could lead to a use-after-free, though the stack looks like we're in shutdown, so maybe that's not super exploitable.

Comment 4

[Andrew McCreight [:mccr8]]

The scenario I was worried about can't happen because we clear the traced fields in DropObjects, but this should still be fixed because I think it could potentially cause a leak or something.

Comment 5

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jimb, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 6

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20220622094342-0242545b34ca) but not with tip (mozilla-central 20220813092239-cbd753d18619.)

The bug appears to have been fixed in the following build range:

Start: 880cac21dca544a25fa34b5d0c6599d0fd240c17 (20220810143834)
End: bdb42cfe62138374343d5be83ac208826812cd2d (20220810161147)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=880cac21dca544a25fa34b5d0c6599d0fd240c17&tochange=bdb42cfe62138374343d5be83ac208826812cd2d

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 7

[Jason Kratzer [:jkratzer]]

:nical, could you confirm which bug from the bisection results in comment 6 is responsible for fixing this issue?

Comment 8

[Nicolas Silva [:nical]]

I think that it was fixed by https://hg.mozilla.org/integration/autoland/rev/40348d5f2170ea0007fdd7a89e20a143cd576828 in bug 1777535