1809176 - [WeakPtr accessed from multiple threads] | [@ mozilla::dom::WebTaskWorkerRunnable::WorkerRun]

Status: NEW

(Core :: DOM: Workers, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 8453a8c7c4fb (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 8453a8c7c4fb --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !_owningThread || _owningThread->IsCurrentThread() (WeakPtr accessed from multiple threads), at /builds/worker/workspace/obj-build/dist/include/mozilla/WeakPtr.h:184

    ==217696==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8ca4321984 bp 0x7f8c9279b410 sp 0x7f8c9279b400 T217735)
    ==217696==The signal is caused by a WRITE memory access.
    ==217696==Hint: address points to the zero page.
        #0 0x7f8ca4321984 in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/webscheduling/WebTaskSchedulerWorker.cpp
        #1 0x7f8ca3ea073e in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #2 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #3 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #4 0x7f8ca3e8f1a4 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3239:7
        #5 0x7f8ca3e7670d in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2044:42
        #6 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #7 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #8 0x7f8c9ff32403 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #9 0x7f8c9fe54c98 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #10 0x7f8c9fe54ba1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #11 0x7f8c9fe54ba1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #12 0x7f8c9f335bb7 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:383:10
        #13 0x7f8cb27a2c86 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #14 0x7f8cb3043b42 in start_thread nptl/pthread_create.c:442:8
        #15 0x7f8cb30d59ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/webscheduling/WebTaskSchedulerWorker.cpp in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*)
    ==217696==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1809176 using build mozilla-central 20230109093059-8453a8c7c4fb. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.