1903676 - Assertion failure: !sourceSignal->Aborted() && !sourceSignal->Dependent(), at /builds/worker/checkouts/gecko/dom/abort/AbortSignal.cpp:294

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240610-9e49a1b86e40 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !sourceSignal->Aborted() && !sourceSignal->Dependent(), at /builds/worker/checkouts/gecko/dom/abort/AbortSignal.cpp:294

#0 0x785e3f6ec55c in mozilla::dom::AbortSignal::Any(mozilla::dom::GlobalObject&, mozilla::dom::Sequence<mozilla::OwningNonNull<mozilla::dom::AbortSignal>> const&) /builds/worker/checkouts/gecko/dom/abort/AbortSignal.cpp:294:9
#1 0x785e3fd5c26e in mozilla::dom::AbortSignal_Binding::any(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./AbortSignalBinding.cpp:179:57
#2 0x785e445380e4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:487:13
#3 0x785e445378cf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:581:12
#4 0x785e4506bc36 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1670:10
#5 0x1d5669d9aa5e  ([anon:js-executable-memory]+0xba5e)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240619213942-7999d1a5d574.
The bug appears to have been introduced in the following build range:

Start: 2437c2ca5bec35fe4ab02eb938e0e02457cd079b (20240123142542)
End: f3efca74da0f43269bd8ac07e2a5d27e89c4d7c3 (20240123145016)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=2437c2ca5bec35fe4ab02eb938e0e02457cd079b&tochange=f3efca74da0f43269bd8ac07e2a5d27e89c4d7c3

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

:vhilla, since you are the author of the regressor, bug 1830781, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1830781

Comment 4

[Vincent Hilla [:vhilla]]

Another testcase to check whether the created signal will still be aborted despite the assertion not holding.

<script>
    let b;
    window.addEventListener("DOMContentLoaded", () => {
      let a = new AbortController()
      b = AbortSignal.any([a.signal])
      let c;
      a.signal.addEventListener("abort", () => {
        c = AbortSignal.any([b])
        console.log(b.aborted, a.signal.aborted);
    })
      a.abort();
      setTimeout(() => setTimeout(() => {
        console.log(c.aborted);
      }, 0), 0);
    })
</script>

As c still becomes aborted, I do not think there is any impact to users and the severity is low.

What happens is that we abort the signal which sets a to aborted, then fires an event.
During the event handler, a is aborted but b is not - same in Chrome. Therefore, we create a dependent signal c via AbortSignal::Any (this check is passed), which expects that if b is not aborted, a also is not and therefore we get an assertion failure.
As this is a debug assertion, in release, c is still created as a dependent signal on the already aborted a. Though as a did not yet abort the signal dependent on it all is good and c gets aborted.

The code above has the same output in Firefox and Chrome, I expect the control flow is the same and also what the spec expects. So I would say this is a spec issue, maybe firing of the event and aborting of dependent signals should be switched in order.

Comment 5

[Kagami Rosylight [:saschanaz] (they/them)]

Taking this bug. Thank you for the great investigation and the previous implementation, Vincent!

Comment 6

[Intermittent Failures Robot]

16 failures in 3218 pushes (0.005 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 9
• mozilla-central: 5
• try: 2

Platform and build breakdown:

• macosx1015-64-qr: 5
  • debug: 5
• linux1804-64-qr: 6
  • debug: 6
• windows11-64-2009-qr: 2
  • debug: 2
• windows11-32-2009-qr: 3
  • debug: 3

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1903676&startday=2024-08-19&endday=2024-08-25&tree=all

Comment 7

[Intermittent Failures Robot]

21 failures in 3879 pushes (0.005 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 5
• autoland: 13
• try: 3

Platform and build breakdown:

• windows11-32-2009-qr: 6
  • debug: 6
• macosx1015-64-qr: 13
  • debug: 13
• linux1804-64-qr: 1
  • debug: 1
• windows11-64-2009-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1903676&startday=2024-08-26&endday=2024-09-01&tree=all

Comment 8

[Kagami Rosylight [:saschanaz] (they/them)]

Attachment: Bug 1903676 - Update the signal abort algorithm r=#dom-core,smaug

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/943536ef24da
Update the signal abort algorithm r=smaug

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/47985 for changes under testing/web-platform/tests

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Attachment: Bug 1903676 - set some scheduler signal tests as passing

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/877b8dbf447c
Backed out changeset 943536ef24da for causing wpt failures in cache-abort.https.any.html.
https://hg.mozilla.org/integration/autoland/rev/0bb1dab143e7
set some scheduler signal tests as passing. CLOSED TREE

Comment 13

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR was closed without merging

Comment 14

[Serban Stanca [:SerbanS]]

Backed out for causing wpt failures in cache-abort.https.any.html.

• Backout link
• Push with failures
• Failure Log
• Failure line: TEST-UNEXPECTED-FAIL | /service-workers/cache-storage/cache-abort.https.any.sharedworker.html | add() on an already-aborted request should reject with AbortError - promise_rejects_dom: add should reject function "function() { throw e }" threw object "TypeError: NetworkError when attempting to fetch resource." that is not a DOMException AbortError: property "code" is equal to undefined, expected 20

Also, please be aware about these wpt failures. For those ones, there's a patch in https://bugzilla.mozilla.org/show_bug.cgi?id=1903676#c11.

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e577f2498b11
Update the signal abort algorithm r=smaug
https://hg.mozilla.org/integration/autoland/rev/62dae41dc66a
set some scheduler signal tests as passing. CLOSED TREE

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6bdd2da6661b
Fix bad rebase. r=me on a CLOSED TREE

Comment 17

[Kagami Rosylight [:saschanaz] (they/them)]

The patches are relanded by sheriffs, let's fix this in bug 1917150.

Comment 18

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/e577f2498b11
https://hg.mozilla.org/mozilla-central/rev/62dae41dc66a
https://hg.mozilla.org/mozilla-central/rev/6bdd2da6661b

Comment 19

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 20

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20240906093607-9df162c80958.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 21

[Intermittent Failures Robot]

20 failures in 3668 pushes (0.005 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 8
• mozilla-central: 8
• mozilla-beta: 4

Platform and build breakdown:

• macosx1015-64-qr: 7
  • debug: 7
• linux1804-64-qr: 7
  • debug: 7
• windows11-32-2009-qr: 5
  • debug: 5
• windows11-64-2009-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1903676&startday=2024-09-02&endday=2024-09-08&tree=all

Comment 22

[Intermittent Failures Robot]

5 failures in 4448 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-beta: 5

Platform and build breakdown:

• windows11-64-2009-qr: 1
  • debug: 1
• windows11-32-2009-qr: 3
  • debug: 3
• macosx1015-64-qr: 1
  • debug: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1903676&startday=2024-09-09&endday=2024-09-15&tree=all

Comment 23

[Intermittent Failures Robot]

4 failures in 4860 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-beta: 4

Platform and build breakdown:

• windows11-32-2009-qr: 2
  • debug: 2
• macosx1015-64-qr: 2
  • debug: 2

For more details, see:
https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=1903676&startday=2024-09-16&endday=2024-09-22&tree=all