1818417 - Assertion failure: NS_IsMainThread(), at /builds/worker/workspace/obj-build/dist/include/gfxUserFontSet.h:592

Status: VERIFIED FIXED

(Core :: Layout: Text and Fonts, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.zip

Found while fuzzing m-c 20230216-1a6c81eba852 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Assertion failure: NS_IsMainThread(), at /builds/worker/workspace/obj-build/dist/include/gfxUserFontSet.h:592

#0 0x7f40ec5ade4b in LoadCanceled /builds/worker/workspace/obj-build/dist/include/gfxUserFontSet.h:592:5
#1 0x7f40ec5ade4b in nsFontFaceLoader::Cancel() /builds/worker/checkouts/gecko/layout/style/nsFontFaceLoader.cpp:360:19
#2 0x7f40ec53f69f in mozilla::dom::FontFaceSetImpl::Destroy() /builds/worker/checkouts/gecko/layout/style/FontFaceSetImpl.cpp:97:12
#3 0x7f40ec54b1f8 in mozilla::dom::FontFaceSetWorkerImpl::Destroy() /builds/worker/checkouts/gecko/layout/style/FontFaceSetWorkerImpl.cpp:168:20
#4 0x7f40ebd3ddb8 in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1036:12
#5 0x7f40ebd3ddb8 in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, void ()> > &> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1258:37
#6 0x7f40ebd3ddb8 in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:816:1
#7 0x7f40ebd3ddb8 in mozilla::dom::WorkerRef::Notify() /builds/worker/checkouts/gecko/dom/workers/WorkerRef.cpp:97:3
#8 0x7f40ebd2db15 in mozilla::dom::WorkerPrivate::NotifyWorkerRefs(mozilla::dom::WorkerStatus) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:4135:16
#9 0x7f40ebd2f3e8 in mozilla::dom::WorkerPrivate::NotifyInternal(mozilla::dom::WorkerStatus) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:4815:5
#10 0x7f40ebd4003e in mozilla::dom::WorkerRunnable::Run() /builds/worker/checkouts/gecko/dom/workers/WorkerRunnable.cpp:377:12
#11 0x7f40ebd2f041 in mozilla::dom::WorkerPrivate::ProcessAllControlRunnablesLocked() /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3887:9
#12 0x7f40ebd2e1f7 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3174:21
#13 0x7f40ebd152dd in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:2044:42
#14 0x7f40e6f5d0f2 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1219:16
#15 0x7f40e6f6347d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:477:10
#16 0x7f40e7ba536a in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#17 0x7f40e7ac6058 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#18 0x7f40e7ac5f61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#19 0x7f40e7ac5f61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#20 0x7f40e6f584e7 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:384:10
#21 0x7f40fb9d7c86 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#22 0x7f40fc280b42 in start_thread nptl/pthread_create.c:442:8
#23 0x7f40fc3129ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230222214030-5bb3e281dc9e.
The bug appears to have been introduced in the following build range:

Start: 1e8ae92954911e752a5da18c1037aadf91531d92 (20230213230316)
End: e74d14d3a7df0588fd4047d7fd1d86fba26ed1b1 (20230214012126)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=1e8ae92954911e752a5da18c1037aadf91531d92&tochange=e74d14d3a7df0588fd4047d7fd1d86fba26ed1b1

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1808832

:emilio, since you are the author of the regressor, bug 1808832, could you take a look? Also, could you set the severity field?

For more information, please visit auto_nag documentation.

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1818417 - Tweak nsFontFaceLoader destruction to be more consistent. r=jfkthame,aosmond

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/49d67c36e86a
Tweak nsFontFaceLoader destruction to be more consistent. r=jfkthame

Comment 5

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/49d67c36e86a

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230225205757-adce45ea7383.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 7

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 9319439 [details]
Bug 1818417 - Tweak nsFontFaceLoader destruction to be more consistent. r=jfkthame,aosmond

Beta/Release Uplift Approval Request

• User impact if declined: The regressing bug is in beta too.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Makes the shutdown of the worker a bit more consistent.
• String changes made/needed: none
• Is Android affected?: Yes

Comment 8

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1818417 - Add a crashtest. r=jfkthame,aosmond

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f6544dc11356
Add a crashtest. r=jfkthame

Comment 10

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/38720 for changes under testing/web-platform/tests

Comment 11

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/f6544dc11356

Comment 12

[Web Platform Test Sync Bot (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)

Comment 14

[Donal Meehan [:dmeehan]]

Comment on attachment 9319439 [details]
Bug 1818417 - Tweak nsFontFaceLoader destruction to be more consistent. r=jfkthame,aosmond

Approved for 111.0b7

Comment 15

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/3c81d7306210
https://hg.mozilla.org/releases/mozilla-beta/rev/1e0db2997e8b