1807768 - Assertion failure: !listElem->isInList(), at /builds/worker/workspace/obj-build/dist/include/mozilla/LinkedList.h:333

Status: RESOLVED WORKSFORME

(Core :: DOM: Animation, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev bd78e2e5b1fe (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build bd78e2e5b1fe --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !listElem->isInList(), at /builds/worker/workspace/obj-build/dist/include/mozilla/LinkedList.h:333

    =================================================================
    ==58147==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f3985b51d95 bp 0x7ffc741ecf30 sp 0x7ffc741ecf30 T0)
    ==58147==The signal is caused by a WRITE memory access.
    ==58147==Hint: address points to the zero page.
        #0 0x7f3985b51d95 in mozilla::LinkedListElement<mozilla::dom::Animation>::setPreviousUnsafe(mozilla::dom::Animation*) /builds/worker/workspace/obj-build/dist/include/mozilla/LinkedList.h:333:5
        #1 0x7f3985aff98d in insertBack /builds/worker/workspace/obj-build/dist/include/mozilla/LinkedList.h:482:45
        #2 0x7f3985aff98d in mozilla::dom::AnimationTimeline::NotifyAnimationUpdated(mozilla::dom::Animation&) /dom/animation/AnimationTimeline.cpp:78:23
        #3 0x7f3985b08532 in mozilla::dom::DocumentTimeline::NotifyAnimationUpdated(mozilla::dom::Animation&) /dom/animation/DocumentTimeline.cpp:157:22
        #4 0x7f3985af19c3 in mozilla::dom::Animation::Tick() /dom/animation/Animation.cpp:930:3
        #5 0x7f3985b01e94 in mozilla::dom::CSSAnimation::Tick() /dom/animation/CSSAnimation.cpp:127:14
        #6 0x7f3985aff311 in mozilla::dom::AnimationTimeline::Tick() /dom/animation/AnimationTimeline.cpp:58:16
        #7 0x7f3985b08781 in mozilla::dom::DocumentTimeline::MostRecentRefreshTimeUpdated() /dom/animation/DocumentTimeline.cpp:178:17
        #8 0x7f398bbd6c45 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2550:12
        #9 0x7f398bbe5306 in TickDriver /layout/base/nsRefreshDriver.cpp:374:13
        #10 0x7f398bbe5306 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /layout/base/nsRefreshDriver.cpp:352:7
        #11 0x7f398bbe506e in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:368:5
        #12 0x7f398bbe4df5 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:912:5
        #13 0x7f398bbe408f in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:826:5
        #14 0x7f398bbe32d1 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:747:5
        #15 0x7f398bbe2aeb in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /layout/base/nsRefreshDriver.cpp:593:14
        #16 0x7f398bbe2688 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /layout/base/nsRefreshDriver.cpp:550:9
        #17 0x7f398a81183c in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncMainChild.cpp:68:15
        #18 0x7f398ac6260f in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:78
        #19 0x7f3984523ee6 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6306:32
        #20 0x7f398448cac9 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1756:25
        #21 0x7f3984489bbf in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1681:9
        #22 0x7f398448a7ee in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1481:3
        #23 0x7f398448ba1e in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1579:14
        #24 0x7f3982cfa1e9 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:538:16
        #25 0x7f3982cf12a7 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:851:26
        #26 0x7f3982cee528 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:683:15
        #27 0x7f3982ceec50 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:461:36
        #28 0x7f3982d00324 in operator() /xpcom/threads/TaskController.cpp:190:37
        #29 0x7f3982d00324 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
        #30 0x7f3982d23520 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1204:16
        #31 0x7f3982d2dcc4 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:474:10
        #32 0x7f39844942b3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #33 0x7f3984318b07 in RunInternal /ipc/chromium/src/base/message_loop.cc:381:10
        #34 0x7f3984318b07 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #35 0x7f3984318b07 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #36 0x7f398b5ef3a9 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:150:27
        #37 0x7f3990569768 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:884:20
        #38 0x7f3984318b07 in RunInternal /ipc/chromium/src/base/message_loop.cc:381:10
        #39 0x7f3984318b07 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #40 0x7f3984318b07 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #41 0x7f3990568735 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:743:34
        #42 0x5599bc7c23d4 in content_process_main(mozilla::Bootstrap*, int, char**) /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #43 0x5599bc7c2897 in main /browser/app/nsBrowserApp.cpp:359:18
        #44 0x7f39a5820d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #45 0x7f39a5820e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #46 0x5599bc700e58 in _start (/home/jkratzer/builds/m-c-20221213041109-fuzzing-asan-opt/firefox+0x111e58) (BuildId: 018ab1597a3850fecbf26ab75bb044a483086fa7)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/LinkedList.h:333:5 in mozilla::LinkedListElement<mozilla::dom::Animation>::setPreviousUnsafe(mozilla::dom::Animation*)
    ==58147==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1807768 using build mozilla-central 20221213041109-bd78e2e5b1fe. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Jason Kratzer [:jkratzer]]

This appears to have also been fixed via bug 1806902.