Closed Bug 1809176 Opened 1 year ago Closed 3 months ago

[WeakPtr accessed from multiple threads] | [@ mozilla::dom::WebTaskWorkerRunnable::WorkerRun]

Categories

(Core :: DOM: Workers, defect, P3)

Product:
Core
Component:
DOM: Workers
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: testcase, Whiteboard: [bugmon:confirm])

Attachments

(1 file, 1 obsolete file)

testcase.zip
1.01 KB, application/x-zip-compressed
Details

Testcase found while fuzzing mozilla-central rev 8453a8c7c4fb (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 8453a8c7c4fb --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !_owningThread || _owningThread->IsCurrentThread() (WeakPtr accessed from multiple threads), at /builds/worker/workspace/obj-build/dist/include/mozilla/WeakPtr.h:184

    ==217696==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8ca4321984 bp 0x7f8c9279b410 sp 0x7f8c9279b400 T217735)
    ==217696==The signal is caused by a WRITE memory access.
    ==217696==Hint: address points to the zero page.
        #0 0x7f8ca4321984 in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/webscheduling/WebTaskSchedulerWorker.cpp
        #1 0x7f8ca3ea073e in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #2 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #3 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #4 0x7f8ca3e8f1a4 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3239:7
        #5 0x7f8ca3e7670d in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2044:42
        #6 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #7 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #8 0x7f8c9ff32403 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #9 0x7f8c9fe54c98 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #10 0x7f8c9fe54ba1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #11 0x7f8c9fe54ba1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #12 0x7f8c9f335bb7 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:383:10
        #13 0x7f8cb27a2c86 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #14 0x7f8cb3043b42 in start_thread nptl/pthread_create.c:442:8
        #15 0x7f8cb30d59ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/webscheduling/WebTaskSchedulerWorker.cpp in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*)
    ==217696==ABORTING
Attached file Testcase (obsolete) — 

    
    

    
  
Unable to reproduce bug 1809176 using build mozilla-central 20230109093059-8453a8c7c4fb.  Without a baseline, bugmon is unable to analyze this bug.

Removing bugmon keyword as no further action possible.  Please review the bug and re-add the keyword for further analysis.


Keywords: bugmon
Severity: -- → S3
Priority: -- → P3
Flags: needinfo?(twsmith)

    
    

    
  

      
      
      
      

        Attached file
          
        testcase.zip
        — 
      

    


  

        Attachment #9311356 -
        Attachment is obsolete: true
Flags: needinfo?(twsmith)
Keywords: bugmon

    
    

    
  
(In reply to Jason Kratzer [:jkratzer] from comment #0)




Testcase found while fuzzing mozilla-central rev 8453a8c7c4fb (built with: --enable-debug --enable-fuzzing).


Testcase can be reproduced using the following commands:


$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 8453a8c7c4fb --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html



Assertion failure: !_owningThread || _owningThread->IsCurrentThread() (WeakPtr accessed from multiple threads), at /builds/worker/workspace/obj-build/dist/include/mozilla/WeakPtr.h:184

    ==217696==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8ca4321984 bp 0x7f8c9279b410 sp 0x7f8c9279b400 T217735)
    ==217696==The signal is caused by a WRITE memory access.
    ==217696==Hint: address points to the zero page.
        #0 0x7f8ca4321984 in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/webscheduling/WebTaskSchedulerWorker.cpp
        #1 0x7f8ca3ea073e in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #2 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #3 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #4 0x7f8ca3e8f1a4 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3239:7
        #5 0x7f8ca3e7670d in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2044:42
        #6 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #7 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #8 0x7f8c9ff32403 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #9 0x7f8c9fe54c98 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #10 0x7f8c9fe54ba1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #11 0x7f8c9fe54ba1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #12 0x7f8c9f335bb7 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:383:10
        #13 0x7f8cb27a2c86 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #14 0x7f8cb3043b42 in start_thread nptl/pthread_create.c:442:8
        #15 0x7f8cb30d59ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/webscheduling/WebTaskSchedulerWorker.cpp in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*)
    ==217696==ABORTING





Flags: needinfo?(chrisimap32)

    
    

    
  
Unable to reproduce bug 1809176 using build mozilla-central 20230123094444-1af6fa02884e.  Without a baseline, bugmon is unable to analyze this bug.

Removing bugmon keyword as no further action possible.  Please review the bug and re-add the keyword for further analysis.


Keywords: bugmon

    
    

    
  
This bug hasn't been seen by the fuzzers since 2022/12/24.  I think we can safely close this for now and I'll file a new issue if it appears again.


Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → WORKSFORME

    
    

    
  
(In reply to Jason Kratzer [:jkratzer] from comment #0)




Testcase found while fuzzing mozilla-central rev 8453a8c7c4fb (built with: --enable-debug --enable-fuzzing).


Testcase can be reproduced using the following commands:


$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 8453a8c7c4fb --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html



Assertion failure: !_owningThread || _owningThread->IsCurrentThread() (WeakPtr accessed from multiple threads), at /builds/worker/workspace/obj-build/dist/include/mozilla/WeakPtr.h:184

    ==217696==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8ca4321984 bp 0x7f8c9279b410 sp 0x7f8c9279b400 T217735)
    ==217696==The signal is caused by a WRITE memory access.
    ==217696==Hint: address points to the zero page.
        #0 0x7f8ca4321984 in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/webscheduling/WebTaskSchedulerWorker.cpp
        #1 0x7f8ca3ea073e in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #2 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #3 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #4 0x7f8ca3e8f1a4 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3239:7
        #5 0x7f8ca3e7670d in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2044:42
        #6 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #7 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #8 0x7f8c9ff32403 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #9 0x7f8c9fe54c98 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #10 0x7f8c9fe54ba1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #11 0x7f8c9fe54ba1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #12 0x7f8c9f335bb7 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:383:10
        #13 0x7f8cb27a2c86 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #14 0x7f8cb3043b42 in start_thread nptl/pthread_create.c:442:8
        #15 0x7f8cb30d59ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/webscheduling/WebTaskSchedulerWorker.cpp in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*)
    ==217696==ABORTING






    
    

    
  
(In reply to Bugmon [:jkratzer for issues] from comment #2)




Unable to reproduce bug 1809176 using build mozilla-central 20230109093059-8453a8c7c4fb.  Without a baseline, bugmon is unable to analyze this bug.

Removing bugmon keyword as no further action possible.  Please review the bug and re-add the keyword for further analysis.




Flags: needinfo?(chrisimap32)

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: