Closed Bug 1809176 Opened 2 years ago Closed 1 year ago

[WeakPtr accessed from multiple threads] | [@ mozilla::dom::WebTaskWorkerRunnable::WorkerRun]

Categories

(Core :: DOM: Workers, defect, P3)

Product:
Core
Component:
DOM: Workers
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: testcase, Whiteboard: [bugmon:confirm])

Attachments

(1 file, 1 obsolete file)

testcase.zip
1.01 KB, application/x-zip-compressed
Details

Testcase found while fuzzing mozilla-central rev 8453a8c7c4fb (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 8453a8c7c4fb --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !_owningThread || _owningThread->IsCurrentThread() (WeakPtr accessed from multiple threads), at /builds/worker/workspace/obj-build/dist/include/mozilla/WeakPtr.h:184

    ==217696==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8ca4321984 bp 0x7f8c9279b410 sp 0x7f8c9279b400 T217735)
    ==217696==The signal is caused by a WRITE memory access.
    ==217696==Hint: address points to the zero page.
        #0 0x7f8ca4321984 in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/webscheduling/WebTaskSchedulerWorker.cpp
        #1 0x7f8ca3ea073e in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #2 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #3 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #4 0x7f8ca3e8f1a4 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3239:7
        #5 0x7f8ca3e7670d in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2044:42
        #6 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #7 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #8 0x7f8c9ff32403 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #9 0x7f8c9fe54c98 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #10 0x7f8c9fe54ba1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #11 0x7f8c9fe54ba1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #12 0x7f8c9f335bb7 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:383:10
        #13 0x7f8cb27a2c86 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #14 0x7f8cb3043b42 in start_thread nptl/pthread_create.c:442:8
        #15 0x7f8cb30d59ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/webscheduling/WebTaskSchedulerWorker.cpp in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*)
    ==217696==ABORTING
Attached file Testcase (obsolete) —

Unable to reproduce bug 1809176 using build mozilla-central 20230109093059-8453a8c7c4fb. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
Severity: -- → S3
Priority: -- → P3
Flags: needinfo?(twsmith)
Attached file testcase.zip —
Attachment #9311356 - Attachment is obsolete: true
Flags: needinfo?(twsmith)
Keywords: bugmon

(In reply to Jason Kratzer [:jkratzer] from comment #0)

Testcase found while fuzzing mozilla-central rev 8453a8c7c4fb (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 8453a8c7c4fb --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !_owningThread || _owningThread->IsCurrentThread() (WeakPtr accessed from multiple threads), at /builds/worker/workspace/obj-build/dist/include/mozilla/WeakPtr.h:184

    ==217696==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8ca4321984 bp 0x7f8c9279b410 sp 0x7f8c9279b400 T217735)
    ==217696==The signal is caused by a WRITE memory access.
    ==217696==Hint: address points to the zero page.
        #0 0x7f8ca4321984 in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/webscheduling/WebTaskSchedulerWorker.cpp
        #1 0x7f8ca3ea073e in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #2 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #3 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #4 0x7f8ca3e8f1a4 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3239:7
        #5 0x7f8ca3e7670d in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2044:42
        #6 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #7 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #8 0x7f8c9ff32403 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #9 0x7f8c9fe54c98 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #10 0x7f8c9fe54ba1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #11 0x7f8c9fe54ba1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #12 0x7f8c9f335bb7 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:383:10
        #13 0x7f8cb27a2c86 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #14 0x7f8cb3043b42 in start_thread nptl/pthread_create.c:442:8
        #15 0x7f8cb30d59ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/webscheduling/WebTaskSchedulerWorker.cpp in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*)
    ==217696==ABORTING
Flags: needinfo?(chrisimap32)

Unable to reproduce bug 1809176 using build mozilla-central 20230123094444-1af6fa02884e. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon

This bug hasn't been seen by the fuzzers since 2022/12/24. I think we can safely close this for now and I'll file a new issue if it appears again.

Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → WORKSFORME

(In reply to Jason Kratzer [:jkratzer] from comment #0)

Testcase found while fuzzing mozilla-central rev 8453a8c7c4fb (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 8453a8c7c4fb --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !_owningThread || _owningThread->IsCurrentThread() (WeakPtr accessed from multiple threads), at /builds/worker/workspace/obj-build/dist/include/mozilla/WeakPtr.h:184

    ==217696==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8ca4321984 bp 0x7f8c9279b410 sp 0x7f8c9279b400 T217735)
    ==217696==The signal is caused by a WRITE memory access.
    ==217696==Hint: address points to the zero page.
        #0 0x7f8ca4321984 in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/webscheduling/WebTaskSchedulerWorker.cpp
        #1 0x7f8ca3ea073e in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #2 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #3 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #4 0x7f8ca3e8f1a4 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3239:7
        #5 0x7f8ca3e7670d in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2044:42
        #6 0x7f8c9f33a6b8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1191:16
        #7 0x7f8c9f340b3d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:476:10
        #8 0x7f8c9ff32403 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #9 0x7f8c9fe54c98 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #10 0x7f8c9fe54ba1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #11 0x7f8c9fe54ba1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #12 0x7f8c9f335bb7 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:383:10
        #13 0x7f8cb27a2c86 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #14 0x7f8cb3043b42 in start_thread nptl/pthread_create.c:442:8
        #15 0x7f8cb30d59ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/webscheduling/WebTaskSchedulerWorker.cpp in mozilla::dom::WebTaskWorkerRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*)
    ==217696==ABORTING

(In reply to Bugmon [:jkratzer for issues] from comment #2)

Unable to reproduce bug 1809176 using build mozilla-central 20230109093059-8453a8c7c4fb. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Flags: needinfo?(chrisimap32)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: