1807847 - Assertion failure: mOwner (Need a non-null owner window), at /builds/worker/checkouts/gecko/dom/base/ResizeObserver.cpp:259

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20221215-440856ffde51 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --repeat 10 --relaunch 1

Assertion failure: mOwner (Need a non-null owner window), at /builds/worker/checkouts/gecko/dom/base/ResizeObserver.cpp:259

#0 0x7faea8e8ea88 in mozilla::dom::ResizeObserver::ResizeObserver(mozilla::dom::Document&, void (*)(mozilla::dom::Sequence<mozilla::OwningNonNull<mozilla::dom::ResizeObserverEntry>> const&, mozilla::dom::ResizeObserver&)) /builds/worker/checkouts/gecko/dom/base/ResizeObserver.cpp:259:3
#1 0x7faea8e92238 in mozilla::dom::ResizeObserver::CreateLastRememberedSizeObserver(mozilla::dom::Document&) /builds/worker/checkouts/gecko/dom/base/ResizeObserver.cpp:593:24
#2 0x7faea8d8b4af in mozilla::dom::Document::EnsureLastRememberedSizeObserver() /builds/worker/checkouts/gecko/dom/base/Document.cpp:15844:9
#3 0x7faea8d8b5ee in mozilla::dom::Document::ObserveForLastRememberedSize(mozilla::dom::Element&) /builds/worker/checkouts/gecko/dom/base/Document.cpp:15853:3
#4 0x7faeac8b8d30 in nsIFrame::HandleLastRememberedSize() /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:1483:34
#5 0x7faeac8b2219 in nsIFrame::DidSetComputedStyle(mozilla::ComputedStyle*) /builds/worker/checkouts/gecko/layout/generic/nsIFrame.cpp:1449:5
#6 0x7faeac719ec6 in SetComputedStyle /builds/worker/checkouts/gecko/layout/generic/nsIFrame.h:808:7
#7 0x7faeac719ec6 in mozilla::RestyleManager::ProcessPostTraversal(mozilla::dom::Element*, mozilla::ServoRestyleState&, mozilla::ServoPostTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:2875:10
#8 0x7faeac71c070 in mozilla::RestyleManager::DoProcessPendingRestyles(mozilla::ServoTraversalFlags) /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3136:28
#9 0x7faeac6f4af0 in mozilla::RestyleManager::ProcessPendingRestyles() /builds/worker/checkouts/gecko/layout/base/RestyleManager.cpp:3250:3
#10 0x7faeac6f404f in mozilla::PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:4423:39
#11 0x7faeac6b7ca3 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2605:22
#12 0x7faeac6c13ed in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:374:13
#13 0x7faeac6c13ed in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:352:7
#14 0x7faeac6c12f3 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:368:5
#15 0x7faeac6c11d0 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:912:5
#16 0x7faeac6c053a in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:826:5
#17 0x7faeac6bfcf6 in mozilla::VsyncRefreshDriverTimer::NotifyVsyncOnMainThread(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:747:5
#18 0x7faeac6bf809 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:593:14
#19 0x7faeac6bf41d in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:550:9
#20 0x7faeabb6795b in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:68:15
#21 0x7faeabdf1578 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:220:78
#22 0x7faeabd038eb in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8758:32
#23 0x7faea7f0070a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#24 0x7faea7efd387 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#25 0x7faea7efdeb5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#26 0x7faea7eff1ef in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#27 0x7faea72f8bd5 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:539:16
#28 0x7faea72f41ac in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:852:26
#29 0x7faea72f2d7a in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:684:15
#30 0x7faea72f30d5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:462:36
#31 0x7faea72fc4d6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:188:37
#32 0x7faea72fc4d6 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
#33 0x7faea7311d75 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1197:16
#34 0x7faea73182bd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:476:10
#35 0x7faea7f06653 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#36 0x7faea7e2a118 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#37 0x7faea7e2a021 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#38 0x7faea7e2a021 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#39 0x7faeac35f7b8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150:27
#40 0x7faeae593dab in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:743:20
#41 0x7faea7f07519 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#42 0x7faea7e2a118 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#43 0x7faea7e2a021 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#44 0x7faea7e2a021 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#45 0x7faeae593908 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:676:34
#46 0x563ae27e9ca0 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#47 0x563ae27e9ca0 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:359:18
#48 0x7faebab12d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#49 0x7faebab12e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#50 0x563ae27c0308 in _start (/home/user/workspace/browsers/m-c-20221227093156-fuzzing-debug/firefox-bin+0x5b308) (BuildId: a628991bed63abb840106c8ac1f1bc985b09820e)

Comment 1

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1807847 using build mozilla-central 20221215195521-440856ffde51. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 2

[Joel Maher ( :jmaher ) (UTC -8)]

Attachment: Bug 1807847 - adjust win11 definition to use Win11 2022 H2 update. r=bxbrenden!

Comment 3

[Tyson Smith [:tsmith]]

Is this the correct bug for your patch?

Comment 4

[Phabricator Automation]

Comment on attachment 9310131 [details]
Bug 1807847 - adjust win11 definition to use Win11 2022 H2 update. r=bxbrenden!

Revision D165687 was moved to bug 1807947. Setting attachment 9310131 [details] to obsolete.

Comment 5

[Joel Maher ( :jmaher ) (UTC -8)]

oh, a typo- thanks for finding that and it should be corrected in a minute

Comment 6

[Sean Feng [:sefeng]]

I can spend sometime looking into the testcase

Comment 7

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Set assignee back to default per comment 5.

Comment 8

[Sean Feng [:sefeng]]

Attachment: Bug 1807847 - Ensure the document is active when ObserveForLastRememberedSize is called r=emilio

For this particular crash, I was not able to reproduce it locally.
However, based on the testcase, it looks like what happened was the
window is transitioning into a new document, and the synchronous XHR
causes the event loop to execute ObserveForLastRememberedSize. I think
it's safe to not creating the observer since we are inactivating
the document.

Comment 9

[Sean Feng [:sefeng]]

Hi Tyson, I am unable to reproduce it with the setup mentioned in the description. Is it still reproducible?

Comment 10

[Tyson Smith [:tsmith]]

(In reply to Sean Feng [:sefeng] from comment #9)

Hi Tyson, I am unable to reproduce it with the setup mentioned in the description. Is it still reproducible?

Yes I am able to reproduce. I grabbed a Pernosco session: https://pernos.co/debug/RcqjdDP0itHuo1JkBcboiw/index.html

Comment 11

[Sean Feng [:sefeng]]

Which platform did you run the test Tyson?

Comment 12

[Tyson Smith [:tsmith]]

(In reply to Sean Feng [:sefeng] from comment #11)

Which platform did you run the test Tyson?

Linux (Ubuntu 20.04 and 22.04)

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/62f20f4ed6eb
Ensure the document is active when ObserveForLastRememberedSize is called r=emilio

Comment 14

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/62f20f4ed6eb