1788544 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at /builds/worker/checkouts/gecko/third_party/rust/audioipc2/src/rpccore.rs:124

Status: RESOLVED FIXED

(Core :: Audio/Video: cubeb, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220826-be22852de7df (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --repeat 5 --no-harness

Hit MOZ_CRASH(called Option::unwrap() on a None value) at /builds/worker/checkouts/gecko/third_party/rust/audioipc2/src/rpccore.rs:124

#0 0x7ffab7b08247 in AnnotateMozCrashReason /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:40
#1 0x7ffab7b08247 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261
#2 0x7ffab7b08247 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:17
#3 0x7ffab5ed1d20 in mozglue_static::panic_hook /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:91
#4 0x7ffab5ed1c61 in core::ops::function::FnOnce::call_once /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ops\function.rs:248
#5 0x7ffab5ed1c61 in core::ops::function::FnOnce::call_once<void (*)(ref$<core::panic::panic_info::PanicInfo>),tuple$<ref$<core::panic::panic_info::PanicInfo> > > /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ops\function.rs:248
#6 0x7ffab613e1c3 in std::panicking::rust_panic_with_hook /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f/library\std\src\panicking.rs:702
#7 0x7ffab613dea9 in std::panicking::begin_panic_handler::closure$0 /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f/library\std\src\panicking.rs:586
#8 0x7ffab613de38 in std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$> /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f/library\std\src\sys_common\backtrace.rs:138
#9 0x7ffab613ddf3 in std::panicking::begin_panic_handler /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f/library\std\src\panicking.rs:584
#10 0x7ffab81d9744 in core::panicking::panic_fmt /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f/library\core\src\panicking.rs:142
#11 0x7ffab81d983b in core::panicking::panic /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f/library\core\src\panicking.rs:48
#12 0x7ffab5aedb2b in enum$<core::option::Option<alloc::sync::Arc<audioipc2::rpccore::ProxyManager<enum$<audioipc2::messages::ClientMessage> > > >, 1, 18446744073709551615, Some>::unwrap /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\option.rs:775
#13 0x7ffab5aedb2b in audioipc2::rpccore::impl$1::clone<enum$<audioipc2::messages::ServerMessage>,enum$<audioipc2::messages::ClientMessage> > /builds/worker/checkouts/gecko/third_party/rust/audioipc2/src/rpccore.rs:129
#14 0x7ffab5af227a in audioipc2_client::context::ClientContext::rpc /builds/worker/checkouts/gecko/third_party/rust/audioipc2-client/src/context.rs:60
#15 0x7ffab5af227a in audioipc2_client::context::impl$4::drop /builds/worker/checkouts/gecko/third_party/rust/audioipc2-client/src/context.rs:370
#16 0x7ffab5af227a in core::ptr::drop_in_place /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\mod.rs:487
#17 0x7ffab5af227a in core::ptr::drop_in_place /rustc/4b91a6ea7258a947e59c6522cd5898e7c0a6a88f\library\core\src\ptr\mod.rs:487
#18 0x7ffab5af227a in cubeb_backend::capi::capi_destroy<audioipc2_client::context::ClientContext> /builds/worker/checkouts/gecko/third_party/rust/cubeb-backend/src/capi.rs:180
#19 0x7ffaad3b9886 in mozilla::CubebUtils::ShutdownLibrary(void) /builds/worker/checkouts/gecko/dom/media/CubebUtils.cpp:724
#20 0x7ffab13e6f45 in nsLayoutStatics::Shutdown(void) /builds/worker/checkouts/gecko/layout/build/nsLayoutStatics.cpp:357
#21 0x7ffab13e6d85 in nsLayoutStatics::Release /builds/worker/checkouts/gecko/layout/build/nsLayoutStatics.h:44
#22 0x7ffab13e6d85 in Shutdown /builds/worker/checkouts/gecko/layout/build/nsLayoutModule.cpp:119
#23 0x7ffab13e6d85 in nsLayoutModuleDtor(void) /builds/worker/checkouts/gecko/layout/build/nsLayoutModule.cpp:237
#24 0x7ffaa665f823 in nsComponentManagerImpl::Shutdown(void) /builds/worker/checkouts/gecko/xpcom/components/nsComponentManager.cpp:553
#25 0x7ffaa676cf89 in mozilla::ShutdownXPCOM(class nsIServiceManager *) /builds/worker/checkouts/gecko/xpcom/build/XPCOMInit.cpp:693
#26 0x7ffab49e1440 in XRE_TermEmbedding(void) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:224
#27 0x7ffaa7d44938 in mozilla::ipc::ScopedXREEmbed::Stop(void) /builds/worker/checkouts/gecko/ipc/glue/ScopedXREEmbed.cpp:90
#28 0x7ffab49e2520 in XRE_InitChildProcess(int, char **const, struct XREChildData const *) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:743
#29 0x7ff641632bcf in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:58
#30 0x7ff641632bcf in NS_internal_main(int, char **, char **) /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:362
#31 0x7ff6416317bf in wmain /builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:167
#32 0x7ff64172e477 in invoke_main d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:90
#33 0x7ff64172e477 in __scrt_common_main_seh d:\agent\_work\2\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#34 0x7ffae05384d3  (C:\Windows\System32\KERNEL32.DLL+0x1800084d3)
#35 0x7ffae07e1790  (C:\Windows\SYSTEM32\ntdll.dll+0x180051790)

Comment 1

[C.M.Chang[:chunmin]]

Hi Matthew, could you take a look? It looks like proxy_mgr has been dropped when cubeb is shutting down.

Comment 2

[Intermittent Failures Robot]

3 failures in 3023 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 2
• autoland: 1

Platform and build breakdown:

• windows10-32-2004-qr: 2
  • debug: 2
• windows10-64-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1788544&startday=2022-09-12&endday=2022-09-18&tree=all

Comment 3

[Intermittent Failures Robot]

3 failures in 2909 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• try: 2
• autoland: 1

Platform and build breakdown:

• windows10-64-2004-qr: 3
  • debug: 3

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1788544&startday=2022-09-19&endday=2022-09-25&tree=all

Comment 4

[Intermittent Failures Robot]

3 failures in 2041 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-beta: 2
• mozilla-central: 1

Platform and build breakdown:

• windows10-64-2004-qr: 2
  • debug: 2
• windows10-32-2004-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1788544&startday=2022-09-26&endday=2022-10-02&tree=all

Comment 5

[Tyson Smith [:tsmith]]

This was last reported by fuzzers targeting m-c 20220929-a58c99b9307b.

kinetik: Any idea that fixed it? Can this be closed? Is it worth landing the crash test?

Comment 6

[Matthew Gregan [:kinetik]]

Thanks for the ping. This was fixed via bug 1792743, and includes a test for this code path.