1812165 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: No remote found!), at /builds/worker/checkouts/gecko/accessible/ipc/DocAccessibleParent.cpp:639

Status: NEW

(Core :: Disability Access APIs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230118-60b4965aa0ca (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

The attached test case only reproduces on Windows.

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: No remote found!), at /builds/worker/checkouts/gecko/accessible/ipc/DocAccessibleParent.cpp:639

0|0|xul.dll|mozilla::a11y::DocAccessibleParent::RecvCache(mozilla::a11y::CacheUpdateType const&, nsTArray<mozilla::a11y::CacheData>&&, bool const&)|hg:hg.mozilla.org/mozilla-central:accessible/ipc/DocAccessibleParent.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|639|0x102
0|1|xul.dll|mozilla::a11y::PDocAccessibleParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:b71d0c8431a6f07d8b06bb760146164485453e0404c2cc48a064dd190c079979bd20e2baef0ad3046d5db2da3a4f962fb9417a5c08303f93978a94bfbd3229a1/ipc/ipdl/PDocAccessibleParent.cpp:|1364|0x275f
0|2|xul.dll|mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:0d9696be64968fd5495615f8e9f050c3611291bb1b33dc180114cd731afa41b029b39deee518591ba3bc550ea3e3dcdcb0c7ce9165570d2f0950de14540e8ad3/ipc/ipdl/PContentParent.cpp:|6750|0x404
0|3|xul.dll|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|1800|0x14b
0|4|xul.dll|mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message,mozilla::DefaultDelete<IPC::Message> >)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|1725|0x2a4
0|5|xul.dll|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|1525|0x18d
0|6|xul.dll|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|1623|0xd7
0|7|xul.dll|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|539|0x107
0|8|xul.dll|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|852|0x951
0|9|xul.dll|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|684|0x4a
0|10|xul.dll|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|462|0x69
0|11|xul.dll|mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:188:7'>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:60b4965aa0ca5a7a60c71229600092a65df8bc1d|546|0x16
0|12|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|1197|0x82e
0|13|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|477|0x44
0|14|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|85|0xb8
0|15|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:60b4965aa0ca5a7a60c71229600092a65df8bc1d|374|0x4f
0|16|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:60b4965aa0ca5a7a60c71229600092a65df8bc1d|356|0x6e
0|17|xul.dll|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|148|0x27
0|18|xul.dll|nsAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/windows/nsAppShell.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|614|0x2bb
0|19|xul.dll|nsAppStartup::Run()|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|295|0x77
0|20|xul.dll|XREMain::XRE_mainRun()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|5642|0x1bb3
0|21|xul.dll|XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|5835|0x8ce
0|22|xul.dll|XRE_main(int, char**, mozilla::BootstrapConfig const&)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|5891|0xa9
0|23|firefox.exe|NS_internal_main(int, char**, char**)|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|429|0x54a
0|24|firefox.exe|wmain(int, wchar_t**)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsWindowsWMain.cpp:60b4965aa0ca5a7a60c71229600092a65df8bc1d|167|0x2dc
0|25|firefox.exe|__scrt_common_main_seh()|/builds/worker/workspace/obj-build/browser/app/d:/agent/_work/2/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl|288|0x10b
0|26|kernel32.dll||||
0|27|ntdll.dll||||
0|28|KERNELBASE.dll||||

Comment 1

[James Teh [:Jamie]]

This test case creates an infinite loop, which brings the browser (any browser) to a crawl. However, that's not the actual problem that needs to be debugged here, though it will make things difficult.