1874084 - Assertion failure: !aOther.IsNull() (Cannot compute with aOther null value), at /builds/worker/workspace/obj-build/dist/include/mozilla/TimeStamp.h:494

Status: NEW

(Core :: Web Speech, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20231114-acdcddac0b90 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !aOther.IsNull() (Cannot compute with aOther null value), at /builds/worker/workspace/obj-build/dist/include/mozilla/TimeStamp.h:494

#0 0x7f535f1a7124 in operator- /builds/worker/workspace/obj-build/dist/include/mozilla/TimeStamp.h:494:5
#1 0x7f535f1a7124 in mozilla::dom::SpeechDispatcherCallback::OnSpeechEvent(SPDNotificationType) /builds/worker/checkouts/gecko/dom/media/webspeech/synth/speechd/SpeechDispatcherService.cpp:244:44
#2 0x7f535f1a95d6 in mozilla::dom::SpeechDispatcherService::EventNotify(unsigned int, unsigned int) /builds/worker/checkouts/gecko/dom/media/webspeech/synth/speechd/SpeechDispatcherService.cpp:552:19
#3 0x7f535f1a999c in operator()<StoreCopyPassByConstLRef<unsigned int> &, StoreCopyPassByConstLRef<SPDNotificationType> &> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1164:18
#4 0x7f535f1a999c in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), StoreCopyPassByConstLRef<unsigned int> &, StoreCopyPassByConstLRef<SPDNotificationType> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#5 0x7f535f1a999c in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), StoreCopyPassByConstLRef<unsigned int> &, StoreCopyPassByConstLRef<SPDNotificationType> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#6 0x7f535f1a999c in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<StoreCopyPassByConstLRef<unsigned int>, StoreCopyPassByConstLRef<SPDNotificationType> > &, 0UL, 1UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#7 0x7f535f1a999c in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<StoreCopyPassByConstLRef<unsigned int>, StoreCopyPassByConstLRef<SPDNotificationType> > &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#8 0x7f535f1a999c in apply<mozilla::dom::SpeechDispatcherService, void (mozilla::dom::SpeechDispatcherService::*)(unsigned int, unsigned int)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
#9 0x7f535f1a999c in mozilla::detail::RunnableMethodImpl<mozilla::dom::SpeechDispatcherService*, void (mozilla::dom::SpeechDispatcherService::*)(unsigned int, unsigned int), true, (mozilla::RunnableKind)0, unsigned int, SPDNotificationType>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1213:13
#10 0x7f535aa4dd67 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:568:16
#11 0x7f535aa434d6 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:895:26
#12 0x7f535aa41cb7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:718:15
#13 0x7f535aa42135 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:504:36
#14 0x7f535aa51d06 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:222:37
#15 0x7f535aa51d06 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#16 0x7f535aa67072 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#17 0x7f535aa6e1bd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#18 0x7f535b741fe5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#19 0x7f535b65b6b1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#20 0x7f535b65b6b1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#21 0x7f535ff92748 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#22 0x7f536004f698 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:470:33
#23 0x7f5361d2c2a4 in nsAppStartup::Run() /builds/worker/checkouts/gecko/toolkit/components/startup/nsAppStartup.cpp:296:30
#24 0x7f5361e95a52 in XREMain::XRE_mainRun() /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5714:22
#25 0x7f5361e970e6 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5923:8
#26 0x7f5361e97d02 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/checkouts/gecko/toolkit/xre/nsAppRunner.cpp:5979:21
#27 0x55bb0cc2c067 in do_main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:227:22
#28 0x55bb0cc2c067 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:445:16
#29 0x7f536f829d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#30 0x7f536f829e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#31 0x55bb0cc01e88 in _start (/home/user/workspace/browsers/m-c-20240109162901-fuzzing-debug/firefox-bin+0x58e88) (BuildId: e4c62efaf5851b0d60578cde9670049ea317e982)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240110213539-1c750a173258.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 539f28c1de729aac0a9676536b9fde47fb25d79f (20230112041059)
End: acdcddac0b907d2e59d6d0fa1f96fff98453093a (20231114093013)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 2

[Manuel Bucher [:manuel]]

Attachment: Bug 1874084 - Fix IsTimeNewerThanTimestamp returning older timestamp when passed a newer one r=karlt

I was originally trying to debug the crash of Bug 1863047 in debug mode.
Investigating the MOZ_ASSERT with rr and pernosco lead me to believe
that something is wrong with this condition.

I still can't wrap my head around this code entirely. Therefore I didn't
update the test cases yet.

Comment 3

[Karl Tomlinson (:karlt)]

#1 0x7f535f1a7124 in mozilla::dom::SpeechDispatcherCallback::OnSpeechEvent(SPDNotificationType)

https://searchfox.org/mozilla-central/rev/47db1be98f8069b387ce07dcbea22d09f1854515/dom/media/webspeech/synth/speechd/SpeechDispatcherService.cpp#244

Comment 4

[Manuel Bucher [:manuel]]

I can't reproduce this fuzzing testcase on current central. So this is the pernosco session of an unoptimized build (with annotations in the notebook) of the MOZ_ASSERT in the drag&drop case: https://pernos.co/debug/SSIaEjKXhPFDjgvnRyeMJA/index.html

I'll try to checkout an older version and record a pernosco trace for the fuzzing case too.

If we make the the function more resilient to underflow (like here), I think it would be good to add an MOZ_ASSERT too. To be still alerted of bugs like this.

Debug symbols and source code for /usr/lib/libgtk-3.so.0.2409.32 would be helpful if the drag crash were reproducible, but I'd guess that the speech event is something different. I don't see how SystemTimeConverter is involved in the stack in the bug. This recording looks different from https://crash-stats.mozilla.org/report/index/214c6dfe-c0c3-406d-97e0-e620e0240403 also.

I'll take a look on how to include debug symbols and source code for libgtk. The drag&drop is 100% reproduceable to me in debug mode. One suspicion I have is that the crash on the second drag&drop is just a sideeffect of firefox continuing in non-debug mode and not crashing on MOZ_ASSERT in the first drag&drop event.

As far as I can tell, the bad timestamp is coming from drag_drop_event_cb: https://docs.gtk.org/gtk3/vfunc.Widget.drag_drop.html

Comment 5

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20240202164508-90d84a362f05) but not with tip (mozilla-central 20250201090348-eb7c95baf7aa.)

Unable to bisect testcase (End build crashes!):

Start: 90d84a362f057a96158ef63f7aa96d639916e390 (20240202164508)
End: eb7c95baf7aa4d0ffb27fb353d97dcb2fa138676 (20250201090348)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 6

[Tyson Smith [:tsmith]]

This issue has been has also been detected via live site testing.

Comment 7

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:padenot, could you have a look please?

For more information, please visit BugBot documentation.

Comment 8

[Karl Tomlinson (:karlt)]

Comment 4 looks like a separate issue, tracked in bug 1921769.