1831330 - Hit MOZ_CRASH(MozPromise::ThenValue created from 'WriteImpl' destroyed without being either disconnected, resolved, or rejected (dispatchRv: not dispatched)) at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:534

Status: RESOLVED FIXED

(Core :: DOM: File, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev f99ee8082b68 (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build f99ee8082b68 --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(MozPromise::ThenValue created from 'WriteImpl' destroyed without being either disconnected, resolved, or rejected (dispatchRv: not dispatched)) at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:534

    =================================================================
    ==696563==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7fe9d0352e72 bp 0x7ffe6accacc0 sp 0x7ffe6accaca0 T0)
    ==696563==The signal is caused by a WRITE memory access.
    ==696563==Hint: address points to the zero page.
        #0 0x7fe9d0352e72 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
        #1 0x7fe9d0352e72 in mozilla::MozPromise<long, nsresult, false>::ThenValueBase::AssertIsDead() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:529:11
        #2 0x7fe9d0351a6e in mozilla::MozPromise<long, nsresult, false>::AssertIsDead() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1141:13
        #3 0x7fe9d0351f5b in mozilla::MozPromise<long, nsresult, false>::~MozPromise() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1184:5
        #4 0x7fe9d0351857 in mozilla::MozPromise<long, nsresult, false>::Private::~Private() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:257:9
        #5 0x7fe9d03786f3 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:152:3
        #6 0x7fe9d03786f3 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:54:40
        #7 0x7fe9d03786f3 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:420:36
        #8 0x7fe9d03786f3 in ~RefPtr /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:85:7
        #9 0x7fe9d03786f3 in mozilla::dom::(anonymous namespace)::WriteImpl(RefPtr<nsISerialEventTarget> const&, nsCOMPtr<nsIInputStream>, RefPtr<mozilla::dom::fs::FileSystemThreadSafeStreamOwner>&, mozilla::Maybe<unsigned long>, RefPtr<mozilla::dom::Promise> const&) /dom/fs/api/FileSystemWritableFileStream.cpp:86:3
        #10 0x7fe9d033c118 in void mozilla::dom::FileSystemWritableFileStream::Write<mozilla::dom::ArrayBufferViewOrArrayBufferOrBlobOrUTF8StringOrWriteParams>(mozilla::dom::ArrayBufferViewOrArrayBufferOrBlobOrUTF8StringOrWriteParams const&, mozilla::Maybe<unsigned long>, RefPtr<mozilla::dom::Promise> const&) /dom/fs/api/FileSystemWritableFileStream.cpp:748:5
        #11 0x7fe9d03372c9 in mozilla::dom::FileSystemWritableFileStream::Write(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&) /dom/fs/api/FileSystemWritableFileStream.cpp:571:3
        #12 0x7fe9d314edcd in WritableStreamDefaultControllerProcessWrite /dom/streams/WritableStreamDefaultController.cpp:311:19
        #13 0x7fe9d314edcd in mozilla::dom::streams_abstract::WritableStreamDefaultControllerAdvanceQueueIfNeeded(JSContext*, mozilla::dom::WritableStreamDefaultController*, mozilla::ErrorResult&) /dom/streams/WritableStreamDefaultController.cpp:429:3
        #14 0x7fe9d314f7d3 in mozilla::dom::streams_abstract::WritableStreamDefaultControllerWrite(JSContext*, mozilla::dom::WritableStreamDefaultController*, JS::Handle<JS::Value>, double, mozilla::ErrorResult&) /dom/streams/WritableStreamDefaultController.cpp:489:3
        #15 0x7fe9d31548d0 in mozilla::dom::streams_abstract::WritableStreamDefaultWriterWrite(JSContext*, mozilla::dom::WritableStreamDefaultWriter*, JS::Handle<JS::Value>, mozilla::ErrorResult&) /dom/streams/WritableStreamDefaultWriter.cpp:333:3
        #16 0x7fe9d3154c73 in mozilla::dom::WritableStreamDefaultWriter::Write(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&) /dom/streams/WritableStreamDefaultWriter.cpp:354:10
        #17 0x7fe9d033d272 in mozilla::dom::FileSystemWritableFileStream::Write(mozilla::dom::ArrayBufferViewOrArrayBufferOrBlobOrUTF8StringOrWriteParams const&, mozilla::ErrorResult&) /dom/fs/api/FileSystemWritableFileStream.cpp:611:37
        #18 0x7fe9cee491a1 in write /builds/worker/workspace/obj-build/dom/bindings/FileSystemWritableFileStreamBinding.cpp:1063:60
        #19 0x7fe9cee491a1 in mozilla::dom::FileSystemWritableFileStream_Binding::write_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/FileSystemWritableFileStreamBinding.cpp:1079:13
        #20 0x7fe9cf283fad in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3335:13
        #21 0x7fe9d9f87ae3 in CallJSNative /js/src/vm/Interpreter.cpp:486:13
        #22 0x7fe9d9f87ae3 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:580:12
        #23 0x7fe9d9f89c16 in InternalCall /js/src/vm/Interpreter.cpp:647:10
        #24 0x7fe9d9f89c16 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:679:8
        #25 0x7fe9da8c8967 in js::ForwardingProxyHandler::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const /js/src/proxy/Wrapper.cpp:168:10
        #26 0x7fe9da88d050 in js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const /js/src/proxy/CrossCompartmentWrapper.cpp:229:19
        #27 0x7fe9da8ab49d in js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) /js/src/proxy/Proxy.cpp:706:19
        #28 0x7fe9d9f88295 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:560:14
        #29 0x7fe9d9facc76 in InternalCall /js/src/vm/Interpreter.cpp:647:10
        #30 0x7fe9d9facc76 in CallFromStack /js/src/vm/Interpreter.cpp:652:10
        #31 0x7fe9d9facc76 in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3395:16
        #32 0x7fe9d9f86888 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:400:10
        #33 0x7fe9d9f86888 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:458:13
        #34 0x7fe9d9f87c9c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:612:13
        #35 0x7fe9d9f89c16 in InternalCall /js/src/vm/Interpreter.cpp:647:10
        #36 0x7fe9d9f89c16 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:679:8
        #37 0x7fe9da0f654b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #38 0x7fe9cee96f89 in mozilla::dom::Function::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/FunctionBinding.cpp:50:8
        #39 0x7fe9cc8dbfe2 in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject>>(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:71:12
        #40 0x7fe9cc8dbb82 in mozilla::dom::CallbackTimeoutHandler::Call(char const*) /dom/base/TimeoutHandler.cpp:167:29
        #41 0x7fe9cc256b15 in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) /dom/base/nsGlobalWindowInner.cpp:6500:38
        #42 0x7fe9cc8d4ed5 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /dom/base/TimeoutManager.cpp:902:44
        #43 0x7fe9cc8d372b in mozilla::dom::TimeoutExecutor::MaybeExecute() /dom/base/TimeoutExecutor.cpp:179:11
        #44 0x7fe9cc8d7b9e in Notify /dom/base/TimeoutExecutor.cpp:246:5
        #45 0x7fe9cc8d7b9e in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /dom/base/TimeoutExecutor.cpp
        #46 0x7fe9c881ecb4 in operator() /xpcom/threads/nsTimerImpl.cpp:675:44
        #47 0x7fe9c881ecb4 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:675:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:679:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:680:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
        #48 0x7fe9c881ecb4 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:674:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:675:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:679:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:680:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
        #49 0x7fe9c881ecb4 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:674:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:675:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:679:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:680:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:902:12
        #50 0x7fe9c881ecb4 in match<(lambda at /xpcom/threads/nsTimerImpl.cpp:674:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:675:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:679:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:680:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:857:12
        #51 0x7fe9c881ecb4 in nsTimerImpl::Fire(int) /xpcom/threads/nsTimerImpl.cpp:673:22
        #52 0x7fe9c881d385 in nsTimerEvent::Run() /xpcom/threads/TimerThread.cpp:476:11
        #53 0x7fe9c8867694 in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /xpcom/threads/ThrottledEventQueue.cpp:254:22
        #54 0x7fe9c885e48f in mozilla::ThrottledEventQueue::Inner::Executor::Run() /xpcom/threads/ThrottledEventQueue.cpp:81:15
        #55 0x7fe9c880787a in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:555:16
        #56 0x7fe9c87f85ca in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:879:26
        #57 0x7fe9c87f54c7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:702:15
        #58 0x7fe9c87f5daf in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:491:36
        #59 0x7fe9c880cfd4 in operator() /xpcom/threads/TaskController.cpp:221:37
        #60 0x7fe9c880cfd4 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #61 0x7fe9c8838c1b in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1239:16
        #62 0x7fe9c88466b4 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:479:10
        #63 0x7fe9ca438d43 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #64 0x7fe9ca26322a in RunInternal /ipc/chromium/src/base/message_loop.cc:369:10
        #65 0x7fe9ca26322a in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #66 0x7fe9ca26322a in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #67 0x7fe9d3b70e29 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #68 0x7fe9d9b2ddc8 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:738:20
        #69 0x7fe9ca26322a in RunInternal /ipc/chromium/src/base/message_loop.cc:369:10
        #70 0x7fe9ca26322a in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #71 0x7fe9ca26322a in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #72 0x7fe9d9b2d48e in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:673:34
        #73 0x5593149a30ee in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #74 0x5593149a30ee in main /browser/app/nsBrowserApp.cpp:375:18
        #75 0x7fe9ef229d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #76 0x7fe9ef229e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #77 0x5593148cc708 in _start (/home/jkratzer/builds/m-c-20230503214103-fuzzing-asan-opt/firefox+0x106708) (BuildId: c47c9324c9c1234a525629dfb3a2b4e2565c0a88)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3 in MOZ_Crash
    ==696563==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Jens Stutte [:jstutte]]

Just launching the testcase in a local file reproduces for me, see crash.

Comment 3

[Jens Stutte [:jstutte]]

Would you mind to take a look, Jari?

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230504093414-0d4a9640bffd.
The bug appears to have been introduced in the following build range:

Start: 75b3c6c4437624f59fcaff278bb8f5b88358e3a6 (20230323211910)
End: 1dcf5b34283ddc44abafe2bc756dd5160b41e3e8 (20230323192211)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=75b3c6c4437624f59fcaff278bb8f5b88358e3a6&tochange=1dcf5b34283ddc44abafe2bc756dd5160b41e3e8

Comment 5

[BugBot [:suhaib / :marco]]

This bug has been marked as a regression. Setting status flag for Nightly to affected.

Comment 6

[Jens Stutte [:jstutte]]

The pushlog points to bug 1816710.

Comment 7

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1816710

Comment 8

[Jari Jalkanen [:jari]]

This will be retested after a stack of related work lands.

Comment 9

[Jari Jalkanen [:jari]]

This appears to not be reproducible anymore with the latest nightly.

Comment 10

[Andrew Sutherland [:asuth] (he/him)]

needinfo on the bugmon robot's reply before closing.

Comment 11

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20230503214103-f99ee8082b68) but not with tip (mozilla-central 20230612112030-176bd422292e.)

The bug appears to have been fixed in the following build range:

Start: 535c66924d7524bce5edb4586910a1b4536aed29 (20230607034523)
End: 29928f29c7a08d81bf5a480f4678c4c90b0abc68 (20230607065553)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=535c66924d7524bce5edb4586910a1b4536aed29&tochange=29928f29c7a08d81bf5a480f4678c4c90b0abc68

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 12

[Jason Kratzer [:jkratzer]]

:asuth, was this fixed via bug 1825552?

Comment 13

[Andrew Sutherland [:asuth] (he/him)]

(In reply to Jason Kratzer [:jkratzer] from comment #12)

:asuth, was this fixed via bug 1825552?

Yes, I believe so, as that fixed the lifecycle management to ensure the worker global wouldn't get torn down prematurely. But I wanted to make sure bugmon agreed that things were fixed consistent with Jari's comment 9. (I was not sure of the exact bug number Jari was referencing in comment 9 though, so did not provide it. But thanks to bugmon's detective work that seems like a reasonable and likely bug. :)

Please dupe if appropriate and it won't upset bugmon; I'm a little worried about duping and then it doing a bunch of extra work and making things more confusing.