1783785 - Assertion failure: !mIsBeingDestroyed, at /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:4783

Status: RESOLVED DUPLICATE of bug 1633495

(Core :: DOM: Navigation, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220802-020fc676eb89 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

This might be a duplicate of bug 1633495 in which case this has a recent test case and a Pernosco session.

A Pernosco session is available here: https://pernos.co/debug/_SLKNOFnnml--_D-x4ORFw/index.html

Assertion failure: !mIsBeingDestroyed, at /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:4783

#0 0x7fcc4788fcad in SetParentWidget /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:4783:3
#1 0x7fcc4788fcad in non-virtual thunk to nsDocShell::SetParentWidget(nsIWidget*) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
#2 0x7fcc462cb048 in nsDocumentViewer::Hide() /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:2208:15
#3 0x7fcc4789099b in nsDocShell::SetVisibility(bool) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
#4 0x7fcc42d2c1f6 in nsFrameLoader::Hide() /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:1175:12
#5 0x7fcc464ca20b in nsHideViewer::Run() /builds/worker/checkouts/gecko/layout/generic/nsSubDocumentFrame.cpp:913:21
#6 0x7fcc428b048d in nsContentUtils::RemoveScriptBlocker() /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:5870:17
#7 0x7fcc46255dae in ~nsAutoScriptBlocker /builds/worker/checkouts/gecko/dom/base/nsContentUtils.h:3552:28
#8 0x7fcc46255dae in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4364:5
#9 0x7fcc42af51c0 in FlushPendingNotifications /builds/worker/workspace/obj-build/dist/include/mozilla/PresShell.h:1455:5
#10 0x7fcc42af51c0 in mozilla::dom::Document::FlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/dom/base/Document.cpp:10895:16
#11 0x7fcc45a916ae in mozilla::SMILAnimationController::DoSample(bool) /builds/worker/checkouts/gecko/dom/smil/SMILAnimationController.cpp:398:15
#12 0x7fcc45aa008e in mozilla::SMILTimeContainer::Sample() /builds/worker/checkouts/gecko/dom/smil/SMILTimeContainer.cpp:160:3
#13 0x7fcc42afae40 in mozilla::dom::Document::OnPageShow(bool, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/base/Document.cpp:11775:27
#14 0x7fcc462cbf4c in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1128:20
#15 0x7fcc47895204 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6425:20
#16 0x7fcc47894cbb in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5817:7
#17 0x7fcc47895b6f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
#18 0x7fcc420071cc in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1377:3
#19 0x7fcc4200670a in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:975:14
#20 0x7fcc420049c1 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:794:9
#21 0x7fcc420068ea in ChildDoneWithOnload /builds/worker/workspace/obj-build/dist/include/nsDocLoader.h:228:5
#22 0x7fcc420068ea in nsDocLoader::NotifyDoneWithOnload(nsDocLoader*) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:869:14
#23 0x7fcc420049cc in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:796:9
#24 0x7fcc42005ba8 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:677:5
#25 0x7fcc478b6bed in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:13827:23
#26 0x7fcc4131ded0 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:614:22
#27 0x7fcc4131d59c in mozilla::net::nsLoadGroup::Cancel(nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:240:11
#28 0x7fcc420041a8 in nsDocLoader::Stop() /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:258:36
#29 0x7fcc4785fe7a in Stop /builds/worker/checkouts/gecko/docshell/base/nsDocShell.h:186:25
#30 0x7fcc4785fe7a in nsDocShell::Stop(unsigned int) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:4326:5
#31 0x7fcc47875390 in nsDocShell::Destroy() /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:4577:3
#32 0x7fcc42d357f4 in nsFrameLoader::DestroyDocShell() /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:2044:20
#33 0x7fcc42d35649 in nsFrameLoaderDestroyRunnable::Run() /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:1978:21
#34 0x7fcc42aeaa4b in mozilla::dom::Document::MaybeInitializeFinalizeFrameLoaders() /builds/worker/checkouts/gecko/dom/base/Document.cpp:9398:22
#35 0x7fcc42b9440b in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1147:12
#36 0x7fcc42b9440b in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1153:12
#37 0x7fcc42b9440b in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1200:13
#38 0x7fcc428b0e02 in nsContentUtils::AddScriptRunner(already_AddRefed<nsIRunnable>) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:5933:13
#39 0x7fcc428b103e in nsContentUtils::AddScriptRunner(nsIRunnable*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:5939:3
#40 0x7fcc42aeb06e in mozilla::dom::Document::FinalizeFrameLoader(nsFrameLoader*, nsIRunnable*) /builds/worker/checkouts/gecko/dom/base/Document.cpp:9355:5
#41 0x7fcc42d34bba in nsFrameLoader::StartDestroy(bool) /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:1970:7
#42 0x7fcc429af55e in UnloadObject /builds/worker/checkouts/gecko/dom/base/nsObjectLoadingContent.cpp:1970:19
#43 0x7fcc429af55e in nsObjectLoadingContent::LoadObject(bool, bool, nsIRequest*) /builds/worker/checkouts/gecko/dom/base/nsObjectLoadingContent.cpp:1472:3
#44 0x7fcc429aefd9 in nsObjectLoadingContent::LoadObject(bool, bool) /builds/worker/checkouts/gecko/dom/base/nsObjectLoadingContent.cpp:1391:10
#45 0x7fcc4487308a in operator() /builds/worker/checkouts/gecko/dom/html/HTMLEmbedElement.cpp:134:23
#46 0x7fcc4487308a in mozilla::detail::RunnableFunction<mozilla::dom::HTMLEmbedElement::AfterMaybeChangeAttr(int, nsAtom*, bool)::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#47 0x7fcc428b048d in nsContentUtils::RemoveScriptBlocker() /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:5870:17
#48 0x7fcc42adffbd in mozilla::dom::Document::EndUpdate() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7957:3
#49 0x7fcc42b37723 in ~mozAutoDocUpdate /builds/worker/checkouts/gecko/dom/base/mozAutoDocUpdate.h:34:18
#50 0x7fcc42b37723 in mozilla::dom::Element::SetAttr(int, nsAtom*, nsAtom*, nsTSubstring<char16_t> const&, nsIPrincipal*, bool) /builds/worker/checkouts/gecko/dom/base/Element.cpp:2437:1
#51 0x7fcc43ffc237 in SetAttr /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:948:12
#52 0x7fcc43ffc237 in SetAttr /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:944:12
#53 0x7fcc43ffc237 in SetAttr /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Element.h:1600:14
#54 0x7fcc43ffc237 in SetHTMLAttr /builds/worker/checkouts/gecko/dom/html/nsGenericHTMLElement.h:750:5
#55 0x7fcc43ffc237 in SetSrc /builds/worker/workspace/obj-build/dist/include/mozilla/dom/HTMLEmbedElement.h:90:5
#56 0x7fcc43ffc237 in mozilla::dom::HTMLEmbedElement_Binding::set_src(JSContext*, JS::Handle<JSObject*>, void*, JSJitSetterCallArgs) /builds/worker/workspace/obj-build/dom/bindings/HTMLEmbedElementBinding.cpp:96:24
#57 0x7fcc44117c2a in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3235:8
#58 0x7fcc495eb367 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:417:13
#59 0x7fcc495eac21 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:505:12
#60 0x7fcc495ec058 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:604:8
#61 0x7fcc495ed2bf in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:748:10
#62 0x7fcc48410670 in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, js::PropertyResult const&, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2494:8
#63 0x7fcc4840f785 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) /builds/worker/checkouts/gecko/js/src/vm/NativeObject.cpp:2528:14
#64 0x7fcc495f1f96 in SetProperty /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:308:10
#65 0x7fcc495f1f96 in SetObjectElementOperation(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:1819:10
#66 0x7fcc495dfaa8 in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3079:12
#67 0x7fcc495d95e2 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:389:13
#68 0x7fcc495eab1d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:537:13
#69 0x7fcc495ec058 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:604:8
#70 0x7fcc482aa281 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
#71 0x7fcc43e33343 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:299:37
#72 0x7fcc446b4709 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:367:12
#73 0x7fcc446b38e3 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:201:12
#74 0x7fcc44694b1e in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1316:22
#75 0x7fcc44695787 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1506:17
#76 0x7fcc4468a6c4 in HandleEvent /builds/worker/checkouts/gecko/dom/events/EventListenerManager.h:395:5
#77 0x7fcc4468a6c4 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:348:17
#78 0x7fcc44689c12 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:550:16
#79 0x7fcc4468c4b1 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1119:11
#80 0x7fcc45aaa4d8 in mozilla::(anonymous namespace)::AsyncTimeEventRunner::Run() /builds/worker/checkouts/gecko/dom/smil/SMILTimedElement.cpp:98:12
#81 0x7fcc411148e2 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:140:20
#82 0x7fcc4114659e in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:538:16
#83 0x7fcc4111ecc9 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:851:26
#84 0x7fcc4111d853 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:683:15
#85 0x7fcc4111dac3 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:461:36
#86 0x7fcc41149df6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:187:37
#87 0x7fcc41149df6 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
#88 0x7fcc4113370f in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1205:16
#89 0x7fcc41139d1d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465:10
#90 0x7fcc41d09166 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#91 0x7fcc41c2e677 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380:10
#92 0x7fcc41c2e582 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373:3
#93 0x7fcc41c2e582 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355:3
#94 0x7fcc45ef2438 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150:27
#95 0x7fcc47fea62b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:887:20
#96 0x7fcc41d0a05a in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#97 0x7fcc41c2e677 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380:10
#98 0x7fcc41c2e582 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373:3
#99 0x7fcc41c2e582 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355:3
#100 0x7fcc47fe9c4c in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:746:34
#101 0x55d5f34d0240 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#102 0x55d5f34d0240 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:346:18
#103 0x7fcc5e748c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
#104 0x55d5f34a5fec in _start (/home/twsmith/workspace/browsers/m-c-20220802094116-fuzzing-debug/firefox-bin+0x15fec) (BuildId: fbca9cd6ac76f9c89ffc71f4a57774031be4f179)

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220809035717-8e1a65ad0c4d.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 06bf8c7102d2790707481032e08b38e80fc629c2 (20210810032407)
End: 020fc676eb89c74f5642618c69266a6112932958 (20220802094116)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 2

[Sean Feng [:sefeng]]

I can take a look.

Comment 3

[Sean Feng [:sefeng]]

I believe this is a duplicate

Comment 4

[Bugmon [:jkratzer for issues]]

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.