1826206 - ThreadSanitizer: data race [@ Close] vs. [@ nsBufferedInputStream::Fill]

Reporter

Description

•

2 years ago

Found while fuzzing m-c 20230401-e7000d363b5a (--enable-thread-sanitizer --enable-fuzzing)

WARNING: ThreadSanitizer: data race (pid=334753)
  Write of size 8 at 0x7b4000008e60 by thread T26 (mutexes: write M0):
    #0 assign_assuming_AddRef /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:373:13 (libxul.so+0x44a994b) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #1 operator= /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:1048:5 (libxul.so+0x44a994b)
    #2 Close /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp:77:11 (libxul.so+0x44a994b)
    #3 Close /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp:375:21 (libxul.so+0x44a994b)
    #4 CloseWithStatus /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp:663:67 (libxul.so+0x44a994b)
    #5 non-virtual thunk to nsBufferedInputStream::CloseWithStatus(nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp (libxul.so+0x44a994b)
    #6 mozilla::RemoteLazyInputStream::Close() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:528:23 (libxul.so+0x7935659) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #7 mozilla::RemoteLazyInputStream::CloseWithStatus(nsresult) /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:699:67 (libxul.so+0x7938555) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #8 operator() /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:215:33 (libxul.so+0x44eb885) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #9 mozilla::detail::RunnableFunction<nsInputStreamPump::Cancel(nsresult)::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:548:5 (libxul.so+0x44eb885)
    #10 nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:343:14 (libxul.so+0x42e0391) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #11 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16 (libxul.so+0x42d70c8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #12 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #13 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20 (libxul.so+0x500193e) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #14 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x4f1a2a7) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #15 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x4f1a2a7)
    #16 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x4f1a2a7)
    #17 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10 (libxul.so+0x42d2262) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #18 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x523e3) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)

  Previous read of size 8 at 0x7b4000008e60 by thread T28 (mutexes: write M1):
    #0 get /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:1157:68 (libxul.so+0x44a8b09) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #1 operator nsISupports * /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:1165:42 (libxul.so+0x44a8b09)
    #2 nsBufferedInputStream::Fill() /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp:484:3 (libxul.so+0x44a8b09)
    #3 nsBufferedInputStream::ReadSegments(nsresult (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp:462:12 (libxul.so+0x44a8999) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #4 non-virtual thunk to nsBufferedInputStream::ReadSegments(nsresult (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp (libxul.so+0x44a8d0b) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #5 mozilla::RemoteLazyInputStream::ReadSegments(nsresult (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:444:25 (libxul.so+0x7936875) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #6 mozilla::net::nsStreamLoader::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned long, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsStreamLoader.cpp:125:24 (libxul.so+0x454569c) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #7 nsInputStreamPump::OnStateTransfer() /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:584:22 (libxul.so+0x44cb2f5) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #8 nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:411:21 (libxul.so+0x44ca836) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #9 non-virtual thunk to nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp (libxul.so+0x44cbc79) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #10 mozilla::(anonymous namespace)::InputStreamCallbackRunnable::Run() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:58:16 (libxul.so+0x7948799) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #11 nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:343:14 (libxul.so+0x42e0391) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #12 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16 (libxul.so+0x42d70c8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #13 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #14 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5 (libxul.so+0x50019a8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #15 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x4f1a2a7) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #16 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x4f1a2a7)
    #17 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x4f1a2a7)
    #18 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10 (libxul.so+0x42d2262) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #19 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x523e3) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)

  Location is heap block of size 248 at 0x7b4000008e00 allocated by thread T23:
    #0 malloc /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:667:5 (firefox-bin+0xc0a21) (BuildId: cce92757f3190ed3818b778b6dfd6c3de5c62aa9)
    #1 moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52:15 (firefox-bin+0x144fab) (BuildId: cce92757f3190ed3818b778b6dfd6c3de5c62aa9)
    #2 operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33:10 (libxul.so+0x44a771b) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #3 nsBufferedInputStream::Create(nsID const&, void**) /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp:313:42 (libxul.so+0x44a771b)
    #4 NS_NewBufferedInputStream(nsIInputStream**, already_AddRefed<nsIInputStream>, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp:1351:17 (libxul.so+0x44cbd35) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #5 mozilla::RemoteLazyInputStream::EnsureAsyncRemoteStream() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:1090:19 (libxul.so+0x7935cd1) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #6 operator() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:858:23 (libxul.so+0x794a6e6) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #7 std::_Function_handler<void (mozilla::Maybe<mozilla::ipc::IPCStream>&&), mozilla::RemoteLazyInputStream::StreamNeeded()::$_2::operator()() const::'lambda'(mozilla::Maybe<mozilla::ipc::IPCStream> const&)>::_M_invoke(std::_Any_data const&, mozilla::Maybe<mozilla::ipc::IPCStream>&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:316:2 (libxul.so+0x794a6e6)
    #8 operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14 (libxul.so+0x79475b8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #9 Resolve /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/MessageChannel.h:141:37 (libxul.so+0x79475b8)
    #10 mozilla::PRemoteLazyInputStreamChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PRemoteLazyInputStreamChild.cpp:260:27 (libxul.so+0x79475b8)
    #11 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25 (libxul.so+0x4ffc50c) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #12 mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9 (libxul.so+0x4ffa927) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #13 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3 (libxul.so+0x4ffafdb) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #14 mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14 (libxul.so+0x4ffbb7e) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #15 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16 (libxul.so+0x42d70c8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #16 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #17 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5 (libxul.so+0x50019a8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #18 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x4f1a2a7) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #19 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x4f1a2a7)
    #20 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x4f1a2a7)
    #21 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10 (libxul.so+0x42d2262) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #22 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x523e3) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)

  Mutex M0 (0x7b3400030e40) created at:
    #0 pthread_mutex_init /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1316:3 (firefox-bin+0xc395f) (BuildId: cce92757f3190ed3818b778b6dfd6c3de5c62aa9)
    #1 mozilla::RecursiveMutex::RecursiveMutex(char const*) /builds/worker/checkouts/gecko/xpcom/threads/RecursiveMutex.cpp:50:3 (libxul.so+0x42b0197) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #2 nsInputStreamPump::nsInputStreamPump() /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.h:123:33 (libxul.so+0x44c8c12) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #3 mozilla::xpcom::CreateInstanceImpl(mozilla::xpcom::ModuleID, nsID const&, void**) /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:10905:44 (libxul.so+0x428c0b1) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #4 mozilla::xpcom::(anonymous namespace)::StaticModuleFactory::CreateInstance(nsID const&, void**) /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:12963:10 (libxul.so+0x4297e0f) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #5 nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsID const&, void**) /builds/worker/checkouts/gecko/xpcom/components/nsComponentManager.cpp:836:19 (libxul.so+0x42a15ce) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #6 CallCreateInstance /builds/worker/checkouts/gecko/xpcom/components/nsComponentManagerUtils.cpp:128:43 (libxul.so+0x42a585f) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #7 nsCreateInstanceByContractID::operator()(nsID const&, void**) const /builds/worker/checkouts/gecko/xpcom/components/nsComponentManagerUtils.cpp:169:21 (libxul.so+0x42a585f)
    #8 nsCOMPtr_base::assign_from_helper(nsCOMPtr_helper const&, nsID const&) /builds/worker/checkouts/gecko/xpcom/base/nsCOMPtr.cpp:109:7 (libxul.so+0x41caf6f) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #9 nsCOMPtr /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:652:5 (libxul.so+0x44d9075) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #10 NS_NewInputStreamPump(nsIInputStreamPump**, already_AddRefed<nsIInputStream>, unsigned int, unsigned int, bool, nsIEventTarget*) /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp:866:7 (libxul.so+0x44d9075)
    #11 mozilla::dom::BodyConsumer::BeginConsumeBodyMainThread(mozilla::dom::ThreadSafeWorkerRef*) /builds/worker/checkouts/gecko/dom/base/BodyConsumer.cpp:538:7 (libxul.so+0x5d380df) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #12 mozilla::dom::(anonymous namespace)::BeginConsumeBodyRunnable::Run() /builds/worker/checkouts/gecko/dom/base/BodyConsumer.cpp:54:20 (libxul.so+0x5d49cd5) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #13 mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /builds/worker/checkouts/gecko/xpcom/threads/ThrottledEventQueue.cpp:254:22 (libxul.so+0x42f1dac) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #14 mozilla::ThrottledEventQueue::Inner::Executor::Run() /builds/worker/checkouts/gecko/xpcom/threads/ThrottledEventQueue.cpp:81:15 (libxul.so+0x42ed6ef) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #15 mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:553:16 (libxul.so+0x42bda9f) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #16 mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:869:26 (libxul.so+0x42b6b20) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #17 mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:700:15 (libxul.so+0x42b50c6) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #18 mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:464:36 (libxul.so+0x42b54a0) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #19 operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:194:37 (libxul.so+0x42c031a) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #20 mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:548:5 (libxul.so+0x42c031a)
    #21 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1239:16 (libxul.so+0x42d6dc5) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #22 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #23 SpinEventLoopUntil<(mozilla::ProcessFailureBehavior)1, (lambda at /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:3058:29)> /builds/worker/workspace/obj-build/dist/include/mozilla/SpinEventLoopUntil.h:176:25 (libxul.so+0x91052ed) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #24 mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*, bool, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp:3057:10 (libxul.so+0x91052ed)
    #25 mozilla::dom::XMLHttpRequestMainThread::Send(mozilla::dom::Nullable<mozilla::dom::DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString> const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/xhr/XMLHttpRequestMainThread.cpp (libxul.so+0x91042ed) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #26 mozilla::dom::XMLHttpRequest_Binding::send(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/XMLHttpRequestBinding.cpp:1682:24 (libxul.so+0x6cf5e5f) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #27 bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3335:13 (libxul.so+0x71c5cc4) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #28 CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:459:13 (libxul.so+0xc14957e) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #29 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:553:12 (libxul.so+0xc14957e)
    #30 InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:620:10 (libxul.so+0xc13f749) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #31 CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:625:10 (libxul.so+0xc13f749)
    #32 Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3368:16 (libxul.so+0xc13f749)
    #33 js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:431:13 (libxul.so+0xc132b9f) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #34 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:585:13 (libxul.so+0xc149648) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #35 InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:620:10 (libxul.so+0xc14a263) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #36 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:652:8 (libxul.so+0xc14a263)
    #37 JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10 (libxul.so+0xc1e219b) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #38 mozilla::dom::Function::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/FunctionBinding.cpp:50:8 (libxul.so+0x700c20b) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #39 void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject>>(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:71:12 (libxul.so+0x5f45dff) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #40 mozilla::dom::CallbackTimeoutHandler::Call(char const*) /builds/worker/checkouts/gecko/dom/base/TimeoutHandler.cpp:167:29 (libxul.so+0x5f45b8b) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #41 nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:6517:38 (libxul.so+0x5ce382b) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #42 mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /builds/worker/checkouts/gecko/dom/base/TimeoutManager.cpp:902:44 (libxul.so+0x5f4305a) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #43 mozilla::dom::TimeoutExecutor::MaybeExecute() /builds/worker/checkouts/gecko/dom/base/TimeoutExecutor.cpp:179:11 (libxul.so+0x5f42485) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #44 Notify /builds/worker/checkouts/gecko/dom/base/TimeoutExecutor.cpp:246:5 (libxul.so+0x5f442f8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #45 non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /builds/worker/checkouts/gecko/dom/base/TimeoutExecutor.cpp (libxul.so+0x5f442f8)
    #46 operator() /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:656:44 (libxul.so+0x42c9d0c) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #47 matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16 (libxul.so+0x42c9d0c)
    #48 matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14 (libxul.so+0x42c9d0c)
    #49 matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:902:12 (libxul.so+0x42c9d0c)
    #50 match<(lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:656:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:657:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:660:7), (lambda at /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:661:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:857:12 (libxul.so+0x42c9d0c)
    #51 nsTimerImpl::Fire(int) /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:654:22 (libxul.so+0x42c9d0c)
    #52 nsTimerEvent::Run() /builds/worker/checkouts/gecko/xpcom/threads/TimerThread.cpp:469:11 (libxul.so+0x42c8cb9) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #53 mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /builds/worker/checkouts/gecko/xpcom/threads/ThrottledEventQueue.cpp:254:22 (libxul.so+0x42f1dac) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #54 mozilla::ThrottledEventQueue::Inner::Executor::Run() /builds/worker/checkouts/gecko/xpcom/threads/ThrottledEventQueue.cpp:81:15 (libxul.so+0x42ed6ef) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #55 mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:553:16 (libxul.so+0x42bda9f) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #56 mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:869:26 (libxul.so+0x42b6b20) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #57 mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:700:15 (libxul.so+0x42b50c6) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #58 mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:464:36 (libxul.so+0x42b54a0) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #59 operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:194:37 (libxul.so+0x42c031a) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #60 mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:548:5 (libxul.so+0x42c031a)
    #61 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1239:16 (libxul.so+0x42d6dc5) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #62 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #63 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107:5 (libxul.so+0x5000d9c) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #64 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:268:30 (libxul.so+0x500184b) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #65 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x4f1a2a7) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #66 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x4f1a2a7)
    #67 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x4f1a2a7)
    #68 nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27 (libxul.so+0x93d23e6) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #69 XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:738:20 (libxul.so+0xbedfebc) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #70 mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9 (libxul.so+0x50017fd) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #71 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x4f1a2a7) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #72 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x4f1a2a7)
    #73 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x4f1a2a7)
    #74 XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:673:34 (libxul.so+0xbedfb09) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #75 mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/Bootstrap.cpp:67:12 (libxul.so+0xbee9f22) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #76 content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28 (firefox-bin+0x142e63) (BuildId: cce92757f3190ed3818b778b6dfd6c3de5c62aa9)
    #77 main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:353:18 (firefox-bin+0x142e63)

  Mutex M1 (0x7b4000008e28) created at:
    #0 pthread_mutex_init /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1316:3 (firefox-bin+0xc395f) (BuildId: cce92757f3190ed3818b778b6dfd6c3de5c62aa9)
    #1 mozilla::RecursiveMutex::RecursiveMutex(char const*) /builds/worker/checkouts/gecko/xpcom/threads/RecursiveMutex.cpp:50:3 (libxul.so+0x42b0197) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #2 nsBufferedStream /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.h:46:39 (libxul.so+0x44a7795) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #3 nsBufferedInputStream /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.h:93:29 (libxul.so+0x44a7795)
    #4 nsBufferedInputStream::Create(nsID const&, void**) /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp:313:46 (libxul.so+0x44a7795)
    #5 NS_NewBufferedInputStream(nsIInputStream**, already_AddRefed<nsIInputStream>, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsNetUtil.cpp:1351:17 (libxul.so+0x44cbd35) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #6 mozilla::RemoteLazyInputStream::EnsureAsyncRemoteStream() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:1090:19 (libxul.so+0x7935cd1) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #7 operator() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:858:23 (libxul.so+0x794a6e6) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #8 std::_Function_handler<void (mozilla::Maybe<mozilla::ipc::IPCStream>&&), mozilla::RemoteLazyInputStream::StreamNeeded()::$_2::operator()() const::'lambda'(mozilla::Maybe<mozilla::ipc::IPCStream> const&)>::_M_invoke(std::_Any_data const&, mozilla::Maybe<mozilla::ipc::IPCStream>&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:316:2 (libxul.so+0x794a6e6)
    #9 operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14 (libxul.so+0x79475b8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #10 Resolve /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/MessageChannel.h:141:37 (libxul.so+0x79475b8)
    #11 mozilla::PRemoteLazyInputStreamChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PRemoteLazyInputStreamChild.cpp:260:27 (libxul.so+0x79475b8)
    #12 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25 (libxul.so+0x4ffc50c) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #13 mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9 (libxul.so+0x4ffa927) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #14 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3 (libxul.so+0x4ffafdb) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #15 mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14 (libxul.so+0x4ffbb7e) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #16 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16 (libxul.so+0x42d70c8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #17 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #18 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5 (libxul.so+0x50019a8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #19 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x4f1a2a7) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #20 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x4f1a2a7)
    #21 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x4f1a2a7)
    #22 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10 (libxul.so+0x42d2262) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #23 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x523e3) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)

  Thread T26 'StreamTrans #4' (tid=334801, running) created by thread T21 at:
    #0 pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1022:3 (firefox-bin+0xc218d) (BuildId: cce92757f3190ed3818b778b6dfd6c3de5c62aa9)
    #1 _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:458:14 (libnspr4.so+0x4948f) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)
    #2 PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:533:12 (libnspr4.so+0x3e2a5) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)
    #3 nsThread::Init(nsTSubstring<char> const&) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:633:18 (libxul.so+0x42d3e57) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #4 nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadManager.cpp:548:12 (libxul.so+0x42dc8af) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #5 NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:175:57 (libxul.so+0x42e53e5) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #6 NS_NewNamedThread /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:167:10 (libxul.so+0x42df694) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #7 nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:126:17 (libxul.so+0x42df694)
    #8 Dispatch /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:380:3 (libxul.so+0x42e1261) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #9 non-virtual thunk to nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp (libxul.so+0x42e1261)
    #10 mozilla::net::nsStreamTransportService::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsStreamTransportService.cpp:296:16 (libxul.so+0x4546dd9) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #11 non-virtual thunk to mozilla::net::nsStreamTransportService::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsStreamTransportService.cpp (libxul.so+0x4546ea8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #12 operator() /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:63:21 (libxul.so+0x4fdf519) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #13 invoke<(lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:61:9) &> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10 (libxul.so+0x4fdf519)
    #14 fu2::abi_400::detail::type_erasure::invocation_table::function_trait<void ()>::internal_invoker<fu2::abi_400::detail::type_erasure::box<false, mozilla::ipc::data_pipe_detail::DoNotifyOnUnlock(mozilla::ipc::data_pipe_detail::DataPipeAutoLock&, already_AddRefed<nsIRunnable>, already_AddRefed<nsIEventTarget>)::$_25, std::allocator<mozilla::ipc::data_pipe_detail::DoNotifyOnUnlock(mozilla::ipc::data_pipe_detail::DataPipeAutoLock&, already_AddRefed<nsIRunnable>, already_AddRefed<nsIEventTarget>)::$_25>>, true>::invoke(fu2::abi_400::detail::type_erasure::data_accessor*, unsigned long) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:628:1 (libxul.so+0x4fdf519)
    #15 invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1036:12 (libxul.so+0x4fc8e8a) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #16 invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, void ()> > &> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1258:37 (libxul.so+0x4fc8e8a)
    #17 operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:816:1 (libxul.so+0x4fc8e8a)
    #18 mozilla::ipc::data_pipe_detail::DataPipeAutoLock::~DataPipeAutoLock() /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:45:7 (libxul.so+0x4fc8e8a)
    #19 mozilla::ipc::data_pipe_detail::DataPipeBase::AsyncWaitInternal(already_AddRefed<nsIRunnable>, already_AddRefed<nsIEventTarget>, bool) /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:401:1 (libxul.so+0x4fca692) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #20 mozilla::ipc::DataPipeReceiver::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:653:3 (libxul.so+0x4fcbab0) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #21 mozilla::InputStreamLengthWrapper::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/xpcom/io/InputStreamLengthWrapper.cpp:226:33 (libxul.so+0x424ccd8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #22 nsBufferedInputStream::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp:699:18 (libxul.so+0x44a9be0) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #23 non-virtual thunk to nsBufferedInputStream::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp (libxul.so+0x44a9cab) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #24 mozilla::RemoteLazyInputStream::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:788:22 (libxul.so+0x7938970) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #25 nsInputStreamPump::EnsureWaiting() /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:111:33 (libxul.so+0x44c9467) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #26 nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:460:21 (libxul.so+0x44ca94c) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #27 non-virtual thunk to nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp (libxul.so+0x44cbc79) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #28 mozilla::(anonymous namespace)::InputStreamCallbackRunnable::Run() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:58:16 (libxul.so+0x7948799) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #29 nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:343:14 (libxul.so+0x42e0391) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #30 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16 (libxul.so+0x42d70c8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #31 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #32 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20 (libxul.so+0x500193e) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #33 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x4f1a2a7) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #34 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x4f1a2a7)
    #35 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x4f1a2a7)
    #36 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10 (libxul.so+0x42d2262) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #37 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x523e3) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)

  Thread T28 'StreamTrans #7' (tid=334803, running) created by thread T24 at:
    #0 pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1022:3 (firefox-bin+0xc218d) (BuildId: cce92757f3190ed3818b778b6dfd6c3de5c62aa9)
    #1 _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:458:14 (libnspr4.so+0x4948f) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)
    #2 PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:533:12 (libnspr4.so+0x3e2a5) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)
    #3 nsThread::Init(nsTSubstring<char> const&) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:633:18 (libxul.so+0x42d3e57) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #4 nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadManager.cpp:548:12 (libxul.so+0x42dc8af) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #5 NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:175:57 (libxul.so+0x42e53e5) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #6 NS_NewNamedThread /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:167:10 (libxul.so+0x42df694) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #7 nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:126:17 (libxul.so+0x42df694)
    #8 Dispatch /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:380:3 (libxul.so+0x42e1261) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #9 non-virtual thunk to nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp (libxul.so+0x42e1261)
    #10 mozilla::net::nsStreamTransportService::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsStreamTransportService.cpp:296:16 (libxul.so+0x4546dd9) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #11 non-virtual thunk to mozilla::net::nsStreamTransportService::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/checkouts/gecko/netwerk/base/nsStreamTransportService.cpp (libxul.so+0x4546ea8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #12 operator() /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:63:21 (libxul.so+0x4fdf519) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #13 invoke<(lambda at /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:61:9) &> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10 (libxul.so+0x4fdf519)
    #14 fu2::abi_400::detail::type_erasure::invocation_table::function_trait<void ()>::internal_invoker<fu2::abi_400::detail::type_erasure::box<false, mozilla::ipc::data_pipe_detail::DoNotifyOnUnlock(mozilla::ipc::data_pipe_detail::DataPipeAutoLock&, already_AddRefed<nsIRunnable>, already_AddRefed<nsIEventTarget>)::$_25, std::allocator<mozilla::ipc::data_pipe_detail::DoNotifyOnUnlock(mozilla::ipc::data_pipe_detail::DataPipeAutoLock&, already_AddRefed<nsIRunnable>, already_AddRefed<nsIEventTarget>)::$_25>>, true>::invoke(fu2::abi_400::detail::type_erasure::data_accessor*, unsigned long) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:628:1 (libxul.so+0x4fdf519)
    #15 invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1036:12 (libxul.so+0x4fc8e8a) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #16 invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, void ()> > &> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1258:37 (libxul.so+0x4fc8e8a)
    #17 operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:816:1 (libxul.so+0x4fc8e8a)
    #18 mozilla::ipc::data_pipe_detail::DataPipeAutoLock::~DataPipeAutoLock() /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:45:7 (libxul.so+0x4fc8e8a)
    #19 mozilla::ipc::data_pipe_detail::DataPipeBase::AsyncWaitInternal(already_AddRefed<nsIRunnable>, already_AddRefed<nsIEventTarget>, bool) /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:401:1 (libxul.so+0x4fca692) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #20 mozilla::ipc::DataPipeReceiver::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/ipc/glue/DataPipe.cpp:653:3 (libxul.so+0x4fcbab0) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #21 mozilla::InputStreamLengthWrapper::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/xpcom/io/InputStreamLengthWrapper.cpp:226:33 (libxul.so+0x424ccd8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #22 nsBufferedInputStream::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp:699:18 (libxul.so+0x44a9be0) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #23 non-virtual thunk to nsBufferedInputStream::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/netwerk/base/nsBufferedStreams.cpp (libxul.so+0x44a9cab) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #24 mozilla::RemoteLazyInputStream::AsyncWait(nsIInputStreamCallback*, unsigned int, unsigned int, nsIEventTarget*) /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:788:22 (libxul.so+0x7938970) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #25 nsInputStreamPump::EnsureWaiting() /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:111:33 (libxul.so+0x44c9467) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #26 nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp:460:21 (libxul.so+0x44ca94c) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #27 non-virtual thunk to nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) /builds/worker/checkouts/gecko/netwerk/base/nsInputStreamPump.cpp (libxul.so+0x44cbc79) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #28 mozilla::(anonymous namespace)::InputStreamCallbackRunnable::Run() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:58:16 (libxul.so+0x7948799) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #29 nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:343:14 (libxul.so+0x42e0391) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #30 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16 (libxul.so+0x42d70c8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #31 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #32 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20 (libxul.so+0x500193e) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #33 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x4f1a2a7) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #34 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x4f1a2a7)
    #35 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x4f1a2a7)
    #36 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10 (libxul.so+0x42d2262) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #37 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x523e3) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)

  Thread T23 'RemoteLzyStream' (tid=334798, running) created by thread T22 at:
    #0 pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/tsan/rtl/tsan_interceptors_posix.cpp:1022:3 (firefox-bin+0xc218d) (BuildId: cce92757f3190ed3818b778b6dfd6c3de5c62aa9)
    #1 _PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:458:14 (libnspr4.so+0x4948f) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)
    #2 PR_CreateThread /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:533:12 (libnspr4.so+0x3e2a5) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)
    #3 nsThread::Init(nsTSubstring<char> const&) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:633:18 (libxul.so+0x42d3e57) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #4 nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadManager.cpp:548:12 (libxul.so+0x42dc8af) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #5 NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:175:57 (libxul.so+0x42e53e5) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #6 NS_NewNamedThread<16UL> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:87:10 (libxul.so+0x793e903) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #7 mozilla::RemoteLazyInputStreamThread::Initialize() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStreamThread.cpp:90:17 (libxul.so+0x793e903)
    #8 mozilla::RemoteLazyInputStreamThread::GetOrCreate() /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStreamThread.cpp:80:29 (libxul.so+0x79383aa) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #9 mozilla::BindChildActor(nsID, mozilla::ipc::Endpoint<mozilla::PRemoteLazyInputStreamChild>) /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:160:18 (libxul.so+0x79348c6) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #10 mozilla::RemoteLazyInputStream::IPCRead(IPC::MessageReader*) /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:1423:7 (libxul.so+0x793b43f) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #11 Read /builds/worker/checkouts/gecko/dom/file/ipc/RemoteLazyInputStream.cpp:1456:14 (libxul.so+0x79413bd) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #12 Read /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:1038:12 (libxul.so+0x79413bd)
    #13 ReadParam<RefPtr<mozilla::RemoteLazyInputStream> > /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:482:13 (libxul.so+0x79413bd)
    #14 IPC::ParamTraits<mozilla::RemoteLazyStream>::Read(IPC::MessageReader*) /builds/worker/workspace/obj-build/ipc/ipdl/IPCBlob.cpp:288:31 (libxul.so+0x79413bd)
    #15 ReadParam<mozilla::RemoteLazyStream> /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:479:12 (libxul.so+0x7942576) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #16 IPC::ParamTraits<mozilla::dom::IPCBlob>::Read(IPC::MessageReader*) /builds/worker/workspace/obj-build/ipc/ipdl/IPCBlob.cpp:492:32 (libxul.so+0x7942576)
    #17 ReadParam<mozilla::dom::IPCBlob> /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:479:12 (libxul.so+0x8bead2d) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #18 bool IPC::ReadSequenceParamImpl<mozilla::dom::IPCBlob, mozilla::nsTArrayBackInserter<mozilla::dom::IPCBlob, nsTArray<mozilla::dom::IPCBlob>>>(IPC::MessageReader*, mozilla::Maybe<mozilla::nsTArrayBackInserter<mozilla::dom::IPCBlob, nsTArray<mozilla::dom::IPCBlob>>>&&, unsigned int) /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:647:16 (libxul.so+0x8bead2d)
    #19 ReadSequenceParam<mozilla::dom::IPCBlob, (lambda at /builds/worker/workspace/obj-build/dist/include/ipc/IPCMessageUtilsSpecializations.h:172:42)> /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:677:10 (libxul.so+0x8bc8523) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #20 Read /builds/worker/workspace/obj-build/dist/include/ipc/IPCMessageUtilsSpecializations.h:172:12 (libxul.so+0x8bc8523)
    #21 ReadParam<nsTArray<mozilla::dom::IPCBlob> > /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:482:13 (libxul.so+0x8bc8523)
    #22 IPC::ParamTraits<mozilla::dom::ClonedMessageData>::Read(IPC::MessageReader*) /builds/worker/workspace/obj-build/ipc/ipdl/DOMTypes.cpp:155:26 (libxul.so+0x8bc8523)
    #23 ReadParam<mozilla::dom::ClonedMessageData> /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:479:12 (libxul.so+0x8bca0a8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #24 IPC::ParamTraits<mozilla::dom::MessageDataType>::Read(IPC::MessageReader*) /builds/worker/workspace/obj-build/ipc/ipdl/DOMTypes.cpp:701:31 (libxul.so+0x8bca0a8)
    #25 ReadParam<mozilla::dom::MessageDataType> /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:479:12 (libxul.so+0x8bca48b) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #26 IPC::ParamTraits<mozilla::dom::MessageData>::Read(IPC::MessageReader*) /builds/worker/workspace/obj-build/ipc/ipdl/DOMTypes.cpp:776:25 (libxul.so+0x8bca48b)
    #27 ReadParam<mozilla::dom::MessageData> /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:479:12 (libxul.so+0x8eaa001) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #28 bool IPC::ReadSequenceParamImpl<mozilla::dom::MessageData, mozilla::nsTArrayBackInserter<mozilla::dom::MessageData, nsTArray<mozilla::dom::MessageData>>>(IPC::MessageReader*, mozilla::Maybe<mozilla::nsTArrayBackInserter<mozilla::dom::MessageData, nsTArray<mozilla::dom::MessageData>>>&&, unsigned int) /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:647:16 (libxul.so+0x8eaa001)
    #29 ReadSequenceParam<mozilla::dom::MessageData, (lambda at /builds/worker/workspace/obj-build/dist/include/ipc/IPCMessageUtilsSpecializations.h:172:42)> /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:677:10 (libxul.so+0x8ea6007) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #30 Read /builds/worker/workspace/obj-build/dist/include/ipc/IPCMessageUtilsSpecializations.h:172:12 (libxul.so+0x8ea6007)
    #31 ReadParam<nsTArray<mozilla::dom::MessageData> > /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/ipc_message_utils.h:482:13 (libxul.so+0x8ea6007)
    #32 mozilla::dom::PMessagePortChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PMessagePortChild.cpp:247:36 (libxul.so+0x8ea6007)
    #33 mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6230:32 (libxul.so+0x505f2b5) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #34 mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25 (libxul.so+0x4ffc50c) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #35 mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9 (libxul.so+0x4ffa927) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #36 mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3 (libxul.so+0x4ffafdb) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #37 mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14 (libxul.so+0x4ffbb7e) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #38 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16 (libxul.so+0x42d70c8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #39 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #40 mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3280:7 (libxul.so+0x8e12d4a) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #41 mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:2143:42 (libxul.so+0x8dfb0f2) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #42 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16 (libxul.so+0x42d70c8) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #43 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10 (libxul.so+0x42dda96) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #44 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20 (libxul.so+0x500193e) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #45 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10 (libxul.so+0x4f1a2a7) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #46 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3 (libxul.so+0x4f1a2a7)
    #47 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3 (libxul.so+0x4f1a2a7)
    #48 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10 (libxul.so+0x42d2262) (BuildId: 103507d95a116c27e4daa911f10298396a345b11)
    #49 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x523e3) (BuildId: 2773435a878369e966f07cf6e8eebfe8ee4842fb)```

Andrew McCreight [:mccr8]

Comment 1

•

2 years ago

Looks like nsBufferedInputStream::Fill() checks mStream right before it acquires the mutex. The mutex was added fairly recently in bug 1818357.

Andrew McCreight [:mccr8]

Updated

•

2 years ago

Flags: needinfo?(valentin.gosu)

Valentin Gosu [:valentin] (he/him)

Comment 2

•

2 years ago

Right. Not sure why I missed that guarding mStream is also necessary.
We'll take a look ASAP.

Severity: -- → S3

Flags: needinfo?(valentin.gosu)

Priority: -- → P2

Whiteboard: [necko-triaged][necko-priority-queue]

Andrew McCreight [:mccr8]

Comment 3

•

2 years ago

I'll mark this as sec-moderate, as this is showing up as a race not a UAF, though it potentially could be worse. There's also no test case attached to the bug, so maybe it is harder to trigger?

Keywords: sec-moderate

Andrew McCreight [:mccr8]

Comment 4

•

2 years ago

Is there a test case for this or have you not found one yet? I assume there isn't one, but the opening text didn't say anything one way or the other so I figured I'd check. Thanks.

Flags: needinfo?(twsmith)

Tyson Smith [:tsmith]

Reporter

Comment 5

•

2 years ago

Attached file testcase.html (obsolete) — Details

Sorry it took a bit longer to reduce this one.

Flags: needinfo?(twsmith)

Tyson Smith [:tsmith]

Reporter

Updated

•

2 years ago

Keywords: bugmon, testcase

Bugmon [:jkratzer for issues]

Comment 6

•

2 years ago

Verified bug as reproducible on mozilla-central 20230405212330-46a27404e36d.
The bug appears to have been introduced in the following build range:

Start: 5d3793ddd16ed337c5b26d0072bde43dedfd29b9 (20230109225210)
End: 23d84f02c22bd0c6783b847073526fa536407daa (20230110035510)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5d3793ddd16ed337c5b26d0072bde43dedfd29b9&tochange=23d84f02c22bd0c6783b847073526fa536407daa

Keywords: regression

Whiteboard: [necko-triaged][necko-priority-queue] → [necko-triaged][necko-priority-queue][bugmon:bisected,confirmed]

BugBot [:suhaib / :marco/ :calixte]

Comment 7

•

2 years ago

This bug has been marked as a regression. Setting status flag for Nightly to affected.

status-firefox113: --- → affected

Andrew McCreight [:mccr8]

Comment 8

•

2 years ago

OPFS seems like the most likely thing in that regression range.

Regressed by: 1785123

BugBot [:suhaib / :marco/ :calixte]

Comment 9

•

2 years ago

Set release status flags based on info from the regressing bug 1785123

:jesup, since you are the author of the regressor, bug 1785123, could you take a look?

For more information, please visit auto_nag documentation.

status-firefox111: --- → affected

status-firefox112: --- → affected

status-firefox-esr102: --- → unaffected

Flags: needinfo?(rjesup)

Randell Jesup [:jesup] (needinfo me)

Comment 10

•

2 years ago

So far as I can see, OPFS doesn't use RemoteLazyInputStream at all, so it's unlikely to be OPFS. (Also, the enable-by-default patch isn't likely to cause a TSAN issue)

Flags: needinfo?(rjesup) → needinfo?(continuation)

Andrew McCreight [:mccr8]

Updated

•

2 years ago

Flags: needinfo?(continuation)

Donal Meehan [:dmeehan]

Updated

•

2 years ago

status-firefox111: affected → wontfix

BugBot [:suhaib / :marco/ :calixte]

Comment 11

•

2 years ago

Set release status flags based on info from the regressing bug 1785123

status-firefox114: --- → affected

Ryan VanderMeulen [:RyanVM]

Updated

•

2 years ago

status-firefox112: affected → wontfix

Ryan VanderMeulen [:RyanVM]

Comment 12

•

2 years ago

Can we try re-bisecting this with dom.fs.enabled set to true?

status-firefox113: affected → wontfix

Flags: needinfo?(twsmith)

Tyson Smith [:tsmith]

Reporter

Comment 13

•

2 years ago

Jason can bugmon do this?

Flags: needinfo?(twsmith) → needinfo?(jkratzer)

Jason Kratzer [:jkratzer]

Comment 14

•

2 years ago

Attached file testcase.zip — Details

Attachment #9327279 - Attachment is obsolete: true

Flags: needinfo?(jkratzer)

Jason Kratzer [:jkratzer]

Updated

•

2 years ago

Whiteboard: [necko-triaged][necko-priority-queue][bugmon:bisected,confirmed] → [necko-triaged][necko-priority-queue][bugmon:bisect,confirmed]

Jason Kratzer [:jkratzer]

Comment 15

•

2 years ago

(In reply to Tyson Smith [:tsmith] from comment #13)

Jason can bugmon do this?

Yes. I uploaded a new testcase with those prefs and reset the bisected command in the whiteboard. Bugmon should pick this up shortly.

Bugmon [:jkratzer for issues]

Comment 16

•

2 years ago

The bug appears to have been introduced in the following build range:

Start: 89d291a9ee9bf8f1750aeedcf0fde58fb4ce1544 (20220717165114)
End: dd96cc22ca4dc05c61a78068eb22ef531124addb (20220718062441)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=89d291a9ee9bf8f1750aeedcf0fde58fb4ce1544&tochange=dd96cc22ca4dc05c61a78068eb22ef531124addb

Whiteboard: [necko-triaged][necko-priority-queue][bugmon:bisect,confirmed] → [necko-triaged][necko-priority-queue][bugmon:confirmed,bisected]

Ryan VanderMeulen [:RyanVM]

Comment 17

•

2 years ago

Still pointing at OPFS.

Regressed by: 1759152

Valentin Gosu [:valentin] (he/him)

Comment 18

•

1 year ago

Regardles of the regressor, this is on the necko priority queue. We'll try to address it in the next couple of weeks.

Randell Jesup [:jesup] (needinfo me)

Comment 19

•

1 year ago

I'll look into this, since OPFS is involved (and mutexes)

Assignee: nobody → rjesup

Ryan VanderMeulen [:RyanVM]

Updated

•

1 year ago

status-firefox114: affected → wontfix

status-firefox115: --- → affected

Randell Jesup [:jesup] (needinfo me)

Updated

•

1 year ago

Comment 20

•

1 year ago

To capture some data: This appears to be due to multiple sources pumping one stream, which to quote Nika, "won't work".

OPFS is not involved; it appears to be at most a red herring by changing the timing; nothing more than getDirectory() is ever called. This appears to be due to the Blob usage in the testcase:

    let a = new ArrayBuffer(207104)
    let b = new Blob(["ó ª", a], {})
    let c = new File([b, b, b, a, b, b], "", {})
    const blob = new Blob([document.querySelector('#w').textContent], { type: "text/javascript" })
    self.addEventListener("load", async () => {
        let d = new SharedWorker(window.URL.createObjectURL(blob))
        d.port.postMessage([undefined, c], [])
    })

Randell Jesup [:jesup] (needinfo me)

Comment 21

•

1 year ago

How can I repro this locally?

Flags: needinfo?(jkratzer)

Jason Kratzer [:jkratzer]

Comment 22

•

1 year ago

The testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build e7000d363b5a --tsan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Flags: needinfo?(jkratzer)

Bugmon [:jkratzer for issues]

Comment 23

•

1 year ago

Bugmon was unable reproduce this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon

Nika Layzell [:nika] (ni? for response)

Assignee

Comment 24

•

1 year ago

Attached file Bug 1826206 - Require nsISerialEventTarget for RetargetDeliveryTo, r=#necko-reviewers! — Details

This avoids potential issues where multiple OnDataAvailable callbacks or
similar could theoretically be called concurrently on different
StreamTransportService threads when targeting the STS - these cases will
now target a TaskQueue on the STS instead, structurally ensuring serial
execution.

Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)

Comment 25

•

1 year ago

Require nsISerialEventTarget for RetargetDeliveryTo, r=necko-reviewers,valentin
https://hg.mozilla.org/integration/autoland/rev/3a5319e18457cb243aaf9a2842efa3633392444a
https://hg.mozilla.org/mozilla-central/rev/3a5319e18457

Group: network-core-security → core-security-release

Status: NEW → RESOLVED

Closed: 1 year ago

status-firefox116: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 116 Branch

Ryan VanderMeulen [:RyanVM]

Updated

•

1 year ago

Assignee: rjesup → nika

tracking-firefox115: --- → +

tracking-firefox116: --- → +

BugBot [:suhaib / :marco/ :calixte]

Comment 26

•

1 year ago

The patch landed in nightly and beta is affected.
:nika, is this bug important enough to require an uplift?

If yes, please nominate the patch for beta approval.
If no, please set status-firefox115 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(nika)

Jason Kratzer [:jkratzer]

Comment 27

•

1 year ago

A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.

Keywords: bugmon

Bugmon [:jkratzer for issues]

Comment 28

•

1 year ago

Verified bug as fixed on rev mozilla-central 20230608152955-256876c3862b.

Status: RESOLVED → VERIFIED

Nika Layzell [:nika] (ni? for response)

Assignee

Comment 29

•

1 year ago

Comment on attachment 9337508 [details]
Bug 1826206 - Require nsISerialEventTarget for RetargetDeliveryTo, r=#necko-reviewers!

Beta/Release Uplift Approval Request

User impact if declined: Potential data race for some network activity.
Is this code covered by automated tests?: No
Has the fix been verified in Nightly?: Yes
Needs manual test from QE?: No
If yes, steps to reproduce:
List of other uplifts needed: None
Risk to taking this patch: Low
Why is the change risky/not risky? (and alternatives if risky): The bulk of the patch just changes the signature of RetargetDeliveryTo to require nsISerialEventTarget. Only a few call-sites have changed behaviour, and they end up using the same threadpools, just with a TaskQueue between them and the threadpool to avoid concurrent execution.
String changes made/needed: None
Is Android affected?: Yes

Flags: needinfo?(nika)

Attachment #9337508 - Flags: approval-mozilla-beta?

Donal Meehan [:dmeehan]

Comment 30

•

1 year ago

Comment on attachment 9337508 [details]
Bug 1826206 - Require nsISerialEventTarget for RetargetDeliveryTo, r=#necko-reviewers!

Approved for 115.0b5.

Attachment #9337508 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

Donal Meehan [:dmeehan]

Comment 31

•

1 year ago

uplift

https://hg.mozilla.org/releases/mozilla-beta/rev/4b62e3eb2bcf

status-firefox115: affected → fixed

Jason Kratzer [:jkratzer]

Updated

•

1 year ago

Whiteboard: [necko-triaged][necko-priority-queue][bugmon:confirmed,bisected] → [necko-triaged][necko-priority-queue][bugmon:confirmed,bisected][adv-main115+r]

Daniel Veditz [:dveditz]

Updated

•

1 year ago

Group: core-security-release

David Lawrence [:dkl]

Updated

•

10 months ago

Keywords: bugmon

testcase.html 2 years ago Tyson Smith [:tsmith] 959 bytes, text/html		Details
testcase.zip 2 years ago Jason Kratzer [:jkratzer] 4.06 KB, application/zip		Details
Bug 1826206 - Require nsISerialEventTarget for RetargetDeliveryTo, r=#necko-reviewers! 1 year ago Nika Layzell [:nika] (ni? for response) 48 bytes, text/x-phabricator-request	dmeehan : approval-mozilla-beta+	Details \| Review