1825398 - Assertion failure: mBackgroundRequestHandler->FileSystemManagerChildStrongRef() ->AllWritableFileStreamsClosed(), at /dom/fs/api/FileSystemManager.cpp:73

Status: RESOLVED WORKSFORME

(Core :: DOM: File, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 5aa2b55eb19b (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands (may require several attempts):

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 5aa2b55eb19b --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --repeat 20

Assertion failure: mBackgroundRequestHandler->FileSystemManagerChildStrongRef() ->AllWritableFileStreamsClosed(), at /dom/fs/api/FileSystemManager.cpp:73

    ==31067==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe1fcd08cb2 bp 0x7fe1a6e07640 sp 0x7fe1a6e075f0 T33238)
    ==31067==The signal is caused by a WRITE memory access.
    ==31067==Hint: address points to the zero page.
        #0 0x7fe1fcd08cb2 in mozilla::dom::FileSystemManager::Shutdown() /dom/fs/api/FileSystemManager.cpp:72:7
        #1 0x7fe1fda17219 in mozilla::dom::StorageManager::Shutdown() /dom/quota/StorageManager.cpp:756:25
        #2 0x7fe1fe0d432c in mozilla::dom::WorkerNavigator::Invalidate() /dom/workers/WorkerNavigator.cpp:76:22
        #3 0x7fe1fe0ead15 in mozilla::dom::WorkerGlobalScope::NoteShuttingDown() /dom/workers/WorkerScope.cpp:444:17
        #4 0x7fe1fe0e3864 in mozilla::dom::WorkerPrivate::NotifyInternal(mozilla::dom::WorkerStatus) /dom/workers/WorkerPrivate.cpp:4790:25
        #5 0x7fe1fe0e2acf in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3196:9
        #6 0x7fe1fe0c949d in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2043:42
        #7 0x7fe1f939f9c2 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1233:16
        #8 0x7fe1f93a5d4d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:477:10
        #9 0x7fe1f9fe49ca in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:300:20
        #10 0x7fe1f9f05928 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:381:10
        #11 0x7fe1f9f05831 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #12 0x7fe1f9f05831 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #13 0x7fe1f939ad67 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:391:10
        #14 0x7fe20cfd8c86 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #15 0x7fe20cc94b42 in start_thread nptl/pthread_create.c:442:8
        #16 0x7fe20cd269ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/fs/api/FileSystemManager.cpp:72:7 in mozilla::dom::FileSystemManager::Shutdown()
    ==31067==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Jan Varga [:janv]]

I could investigate this, but I would prefer Jari to take a look at the moment.

Comment 3

[Jari Jalkanen]

I was unable to reproduce this neither with the latest nightly or a debug build.