1838484 - Assertion failure: aGlobalObject->GetModuleLoader(dom::danger::GetJSContext()) == mModuleLoader, at /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:275

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230613-37def70ef369 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: aGlobalObject->GetModuleLoader(dom::danger::GetJSContext()) == mModuleLoader, at /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:275

#0 0x7fb9c3c8e2f6 in mozilla::dom::ScriptLoader::SetGlobalObject(nsIGlobalObject*) /builds/worker/checkouts/gecko/dom/script/ScriptLoader.cpp:274:3
#1 0x7fb9c05232a7 in mozilla::dom::Document::SetScriptGlobalObject(nsIScriptGlobalObject*) /builds/worker/checkouts/gecko/dom/base/Document.cpp:7851:20
#2 0x7fb9c052327d in mozilla::dom::Document::SetScriptGlobalObject(nsIScriptGlobalObject*) /builds/worker/checkouts/gecko/dom/base/Document.cpp:7846:29
#3 0x7fb9c0390689 in nsGlobalWindowOuter::SetNewDocument(mozilla::dom::Document*, nsISupports*, bool, mozilla::dom::WindowGlobalChild*) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:2408:14
#4 0x7fb9c438651e in nsDocumentViewer::SetDocumentInternal(mozilla::dom::Document*, bool) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1882:19
#5 0x7fb9c054d51e in mozilla::dom::Document::CreateStaticClone(nsIDocShell*, nsIContentViewer*, nsIPrintSettings*, bool*) /builds/worker/checkouts/gecko/dom/base/Document.cpp:13445:12
#6 0x7fb9c03a791b in nsGlobalWindowOuter::Print(nsIPrintSettings*, mozilla::layout::RemotePrintJobChild*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::IsForWindowDotPrint, std::function<void (mozilla::dom::PrintPreviewResultInfo const&)>&&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowOuter.cpp:5137:42
#7 0x7fb9c0360ab9 in nsGlobalWindowInner::PrintPreview(nsIPrintSettings*, nsIWebProgressListener*, nsIDocShell*, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:3748:3
#8 0x7fb9c170774a in mozilla::dom::Window_Binding::printPreview(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:3740:59
#9 0x7fb9c1d4eda2 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeCrossOriginObjectThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3329:13
#10 0x7fb9c64872c5 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:486:13
#11 0x7fb9c6486b1d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:12
#12 0x7fb9c649b392 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:652:10
#13 0x7fb9c649b392 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3395:16
#14 0x7fb9c648606d in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:458:13
#15 0x7fb9c6486b39 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:612:13
#16 0x7fb9c648814d in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:679:8
#17 0x7fb9c65721f2 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
#18 0x7fb9c15a7bf8 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::IdleDeadline&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/WindowBinding.cpp:827:8
#19 0x7fb9c0461634 in mozilla::dom::IdleRequestCallback::Call(mozilla::dom::IdleDeadline&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:733:12
#20 0x7fb9c0608466 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/WindowBinding.h:746:12
#21 0x7fb9c0608466 in mozilla::dom::IdleRequest::IdleRun(nsPIDOMWindowInner*, double, bool) /builds/worker/checkouts/gecko/dom/base/IdleRequest.cpp:58:13
#22 0x7fb9c0345291 in nsGlobalWindowInner::RunIdleRequest(mozilla::dom::IdleRequest*, double, bool) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:727:12
#23 0x7fb9c03440f1 in nsGlobalWindowInner::ExecuteIdleRequest(mozilla::TimeStamp) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:755:3
#24 0x7fb9c0343e80 in IdleRequestExecutor::Run() /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:596:13
#25 0x7fb9be95bda7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:555:16
#26 0x7fb9be953a31 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:880:26
#27 0x7fb9be95251d in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:746:15
#28 0x7fb9be952825 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:491:36
#29 0x7fb9be95fbe6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:218:37
#30 0x7fb9be95fbe6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#31 0x7fb9be97626a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#32 0x7fb9be97cfdd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#33 0x7fb9bf6252f5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#34 0x7fb9bf5414e1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#35 0x7fb9bf5414e1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#36 0x7fb9c3f19ab8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#37 0x7fb9c6246a3b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:717:20
#38 0x7fb9bf6261d6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#39 0x7fb9bf5414e1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#40 0x7fb9bf5414e1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#41 0x7fb9c6246302 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:34
#42 0x563a516b4526 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#43 0x563a516b4526 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#44 0x7fb9d2a29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#45 0x7fb9d2a29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#46 0x563a5168b7c8 in _start (/home/user/workspace/browsers/m-c-20230613152538-fuzzing-debug/firefox-bin+0x587c8) (BuildId: d89cf947af375925bf506a307a92e70531a6c6d1)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230614213601-933dd3c3e1c8.
The bug appears to have been introduced in the following build range:

Start: 48bedd7ad73f194f4b7544587d4889eb45db570c (20230613080723)
End: c7b5ae0c3e2d58a11af3dbe818dd67837d0ff44a (20230613092730)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=48bedd7ad73f194f4b7544587d4889eb45db570c&tochange=c7b5ae0c3e2d58a11af3dbe818dd67837d0ff44a

Comment 2

[Dianna Smith [:diannaS]]

:jonco could you take a look at this and confirm if the regressor is bug 1835886 based on the above range?

Comment 3

[Jon Coppeard (:jonco)]

(In reply to Dianna Smith [:diannaS] from comment #2)
Bug 1835886 added the assertion that is triggering, but this is a preexisting issue. It's really bug 1761938 that is at fault.

Comment 4

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1761938

Comment 5

[Jon Coppeard (:jonco)]

Attachment: Bug 1838484 - Don't create module loader for template contents owner document r?smaug

When I added ScriptLoader::SetGlobalObject I didn't realise that more than one
document could share the same global object. It turns out that this happens for
these template contents owner documents and this causes the assert that checks
that right module loader is associated with the global to fail because it finds the
other document's module loader.

As far as I can tell we don't need a module load for these documents so we can
skip this call that creates it.

For some reason the test times out on Android and I wasn't able to work out why
so I didn't enable it there.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7a7f505c1116
Don't create module loader for template contents owner document r=smaug

Comment 7

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/7a7f505c1116

Comment 8

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230617092009-29e4ffb2c397.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 9

[Jon Coppeard (:jonco)]

Comment on attachment 9339587 [details]
Bug 1838484 - Don't create module loader for template contents owner document r?smaug

Beta/Release Uplift Approval Request

• User impact if declined: Requesting uplift as required for uplift of bug 1835886.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a simple change required for uplift of bug 1835886.
• String changes made/needed:
• Is Android affected?: Yes

Comment 10

[Donal Meehan [:dmeehan]]

Comment on attachment 9339587 [details]
Bug 1838484 - Don't create module loader for template contents owner document r?smaug

Approved for 115.0b8.

Comment 11

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/81ae155e0ae3

Comment 12

[Jon Coppeard (:jonco)]

Attachment: WIP: Bug 1838484 - Don't create module loader for template contents owner document (ESR102)

When I added ScriptLoader::SetGlobalObject I didn't realise that more than one
document could share the same global object. It turns out that this happens for
these template contents owner documents and this causes the assert that checks
that right module loader is associated with the global to fail because it finds the
other document's module loader.

As far as I can tell we don't need a module load for these documents so we can
skip this call that creates it.

Depends on D182190

Comment 13

[Jon Coppeard (:jonco)]

Comment on attachment 9341252 [details]
WIP: Bug 1838484 - Don't create module loader for template contents owner document (ESR102)

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Required for uplift of bug 1835886 (sec-high bug).
• User impact if declined: Possible crash / security vulnerability.
• Fix Landed on Version: 116
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a simple change required for uplift of bug 1835886.

Comment 14

[Donal Meehan [:dmeehan]]

Comment on attachment 9341252 [details]
WIP: Bug 1838484 - Don't create module loader for template contents owner document (ESR102)

Approved for 102.13esr.

Comment 15

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/03da282eb8a5

Comment 16

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/d0f72061cb9c595f15f8e3001fbcda3e16179b74
Backed out changeset 03da282eb8a5 (bug 1838484) with Bug 1813494 and Bug 1835886 for causing test failures in esr102

https://treeherder.mozilla.org/jobs?repo=mozilla-esr102&group_state=expanded&revision=e00b12330b4f762b921611f3be26433c5a7c7728

Comment 17

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/07b206524b7e