Open Bug 1833131 Opened 2 years ago Updated 20 days ago

Assertion failure: !mPromise, at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1364

Categories

(Core :: Widget: Win32, defect, P3)

Product:
Core
Component:
Widget: Win32
Type:
defect

Tracking

()

People

(Reporter: sas.kunz, Unassigned)

Details

(Keywords: reporter-external, Whiteboard: [reporter-external] [client-bounty-form] [verif?][win:stability])

Attachments

(2 files)

bandicam 2023-05-15 19-14-38-828.mp4
8.13 MB, video/mp4
Details
share.html
1.49 KB, text/html
Details

Log Asan:

Assertion failure: !mPromise, at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1364
#01: mozilla::MozPromiseHolderBase<mozilla::MozPromise<bool,nsresult,1>,mozilla::MozPromiseHolder<mozilla::MozPromise<bool,nsresult,1> > >::~MozPromiseHolderBase (/builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1364)
#02: mozilla::media::Refcountable<mozilla::MozPromiseHolder<mozilla::MozPromise<bool,nsresult,1> > >::~Refcountable (/builds/worker/workspace/obj-build/dist/include/mozilla/media/MediaUtils.h:113)
#03: mozilla::media::RefcountableBase::Release (/builds/worker/workspace/obj-build/dist/include/mozilla/media/MediaUtils.h:107)
#04: std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/widget/windows/WindowsUIUtils.cpp:775:30',long,ABI::Windows::ApplicationModel::DataTransfer::IDataRequestedEventArgs *>::_Delete_this (/builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/functional:839)
#05: Microsoft::WRL::Details::DelegateArgTraits<long (ABI::Windows::Foundation::ITypedEventHandler_impl<ABI::Windows::Foundation::Internal::AggregateType<ABI::Windows::ApplicationModel::DataTransfer::DataTransferManager *,ABI::Windows::ApplicationModel::DataTr (/builds/worker/fetches/vs/Windows Kits/10/Include/10.0.19041.0/winrt/wrl/event.h:239)
#06: Microsoft::WRL::Details::RuntimeClassImpl<Microsoft::WRL::RuntimeClassFlags<2>,1,0,1,ABI::Windows::Foundation::ITypedEventHandler<ABI::Windows::ApplicationModel::DataTransfer::DataTransferManager *,ABI::Windows::ApplicationModel::DataTransfer::DataRequest (/builds/worker/fetches/vs/Windows Kits/10/Include/10.0.19041.0/winrt/wrl/implements.h:1590)
#07: PsmShutdownApplication[C:\WINDOWS\SYSTEM32\twinapi.appcore.dll +0x6c86e]
#08: PsmRegisterAppStateChangeNotification[C:\WINDOWS\SYSTEM32\twinapi.appcore.dll +0x576cf]
#09: PsmUnblockAppStateChangeCompletion[C:\WINDOWS\SYSTEM32\twinapi.appcore.dll +0x3fc60]
#10: Ordinal501[C:\WINDOWS\SYSTEM32\twinapi.appcore.dll +0xce379]
#11: PsmShutdownApplication[C:\WINDOWS\SYSTEM32\twinapi.appcore.dll +0xab4f3]
#12: WindowsUIUtils::Share (/builds/worker/checkouts/gecko/widget/windows/WindowsUIUtils.cpp:775)
#13: nsSharePicker::Share (/builds/worker/checkouts/gecko/widget/windows/nsSharePicker.cpp:69)
#14: mozilla::dom::WindowGlobalParent::RecvShare (/builds/worker/checkouts/gecko/dom/ipc/WindowGlobalParent.cpp:696)
#15: mozilla::dom::PWindowGlobalParent::OnMessageReceived (/builds/worker/workspace/obj-build/ipc/ipdl/PWindowGlobalParent.cpp:1469)
#16: mozilla::dom::PContentParent::OnMessageReceived (/builds/worker/workspace/obj-build/ipc/ipdl/PContentParent.cpp:6810)
#17: mozilla::ipc::MessageChannel::DispatchAsyncMessage (/builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800)
#18: mozilla::ipc::MessageChannel::DispatchMessage (/builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1728)
#19: mozilla::ipc::MessageChannel::RunMessage (/builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525)
#20: mozilla::ipc::MessageChannel::MessageTask::Run (/builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623)
#21: mozilla::RunnableTask::Run (/builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:556)
#22: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal (/builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:879)
#23: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal (/builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:702)
#24: mozilla::TaskController::ProcessPendingMTTask (/builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491)
#25: mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:221:7'>::Run (/builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:549)
#26: nsThread::ProcessNextEvent (/builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1243)
#27: NS_ProcessNextEvent (/builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479)
#28: mozilla::ipc::MessagePump::Run (/builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:107)
#29: MessageLoop::RunInternal (/builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369)
#30: MessageLoop::RunHandler (/builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363)
#31: MessageLoop::Run (/builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344)
#32: nsBaseAppShell::Run (/builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150)
#33: nsAppShell::Run (/builds/worker/checkouts/gecko/widget/windows/nsAppShell.cpp:615)
#34: nsAppStartup::Run (/builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:295)
#35: XREMain::XRE_mainRun (/builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5668)
#36: XREMain::XRE_main (/builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5868)
#37: XRE_main (/builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5924)
#38: NS_internal_main (/builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:445)
#39: wmain (/builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp:167)
#40: __scrt_common_main_seh (D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288)
#41: BaseThreadInitThunk[C:\WINDOWS\System32\KERNEL32.DLL +0x17604]
#42: RtlUserThreadStart[C:\WINDOWS\SYSTEM32\ntdll.dll +0x526a1]

Step to produces:
very hard to reproduce but I did a lot of clicking and pressing escape at the same time

Flags: sec-bounty?
Attached file share.html —

Kagami, how serious of an issue do you think this is? It looks related to some web share stuff you worked on a few years ago, thanks.

It looks like this assertion is checking that mPromise (which is a RefPtr) is null in the dtor, which doesn't sound particularly security-sensitive, but I could be wrong, as I'm not super familiar with MozPromise.

Group: firefox-core-security → dom-core-security
Component: Security → Widget: Win32
Flags: needinfo?(krosylight)
Product: Firefox → Core

Hmm, first of all this has never been enabled outside of beta on Windows: https://searchfox.org/mozilla-central/rev/eb07633057d66ab25f9db4c5900eeb6913da7579/modules/libpref/init/StaticPrefList.yaml#4844

It seems the MozPromise here sometimes goes away without being resolved/rejected because of some Windows API failure (while the specifics are not clear to me from the stack), and that doesn't seem like a big deal either.

Flags: needinfo?(krosylight)

Doesn't seem to be a security issue, just a bug when this occurs.

Group: dom-core-security

The severity field is not set for this bug.
:rkraesig, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(rkraesig)
Severity: -- → S3
Flags: needinfo?(rkraesig)
Priority: -- → P3
Whiteboard: [reporter-external] [client-bounty-form] [verif?] → [reporter-external] [client-bounty-form] [verif?][win:stability]
Flags: sec-bounty? → sec-bounty-

(Note: all existing failures for the last month appear to be in ESR 115, and specifically from mozilla::gfx::CrossProcessPaint::~CrossProcessPaint().)

You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: