1957512 - Assertion failure: mIPCOpen, at /builds/worker/checkouts/gecko/netwerk/protocol/data/DataChannelChild.cpp:59

Status: RESOLVED FIXED

(Core :: Networking, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20250130-2bc2e0070931 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid> --no-harness

Assertion failure: mIPCOpen, at /builds/worker/checkouts/gecko/netwerk/protocol/data/DataChannelChild.cpp:59

#0 0x78b26c6d7bc8 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:267:3
#1 0x78b26c6d7bc8 in mozilla::net::DataChannelChild::NotifyListeners() /builds/worker/checkouts/gecko/netwerk/protocol/data/DataChannelChild.cpp:59:3
#2 0x78b26c6da37f in nsDataChannel::MaybeSendDataChannelOpenNotification() /builds/worker/checkouts/gecko/netwerk/protocol/data/nsDataChannel.cpp:155:5
#3 0x78b26c6d99e9 in nsDataChannel::OpenContentStream(bool, nsIInputStream**, nsIChannel**) /builds/worker/checkouts/gecko/netwerk/protocol/data/nsDataChannel.cpp:118:3
#4 0x78b26c351367 in nsBaseChannel::BeginPumpingData() /builds/worker/checkouts/gecko/netwerk/base/nsBaseChannel.cpp:187:8
#5 0x78b26c354998 in nsBaseChannel::AsyncOpen(nsIStreamListener*) /builds/worker/checkouts/gecko/netwerk/base/nsBaseChannel.cpp:688:8
#6 0x78b26fed9f9e in mozilla::dom::HTMLMediaElement::ChannelLoader::LoadInternal(mozilla::dom::HTMLMediaElement*) /builds/worker/checkouts/gecko/dom/html/HTMLMediaElement.cpp:1918:19
#7 0x78b26c31c99a in operator()<StoreRefPtrPassByPtr<mozilla::net::ConnectionData> &> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
#8 0x78b26c31c99a in __invoke_impl<nsresult, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), StoreRefPtrPassByPtr<mozilla::net::ConnectionData> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#9 0x78b26c31c99a in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), StoreRefPtrPassByPtr<mozilla::net::ConnectionData> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#10 0x78b26c31c99a in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<StoreRefPtrPassByPtr<mozilla::net::ConnectionData> > &, 0UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#11 0x78b26c31c99a in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<StoreRefPtrPassByPtr<mozilla::net::ConnectionData> > &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#12 0x78b26c31c99a in apply<mozilla::net::Dashboard, nsresult (mozilla::net::Dashboard::*)(mozilla::net::ConnectionData *)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
#13 0x78b26c31c99a in mozilla::detail::RunnableMethodImpl<mozilla::ChildProfilerController*, void (mozilla::ChildProfilerController::*)(mozilla::ProfileAndAdditionalInformation*), true, (mozilla::RunnableKind)0, mozilla::ProfileAndAdditionalInformation*>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
#14 0x78b26c14c5f7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:703:16
#15 0x78b26c14597e in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1252:20
#16 0x78b26c1446b7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1075:15
#17 0x78b26c144b35 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:639:36
#18 0x78b26c1536c6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:333:37
#19 0x78b26c1536c6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#20 0x78b26c165723 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1159:16
#21 0x78b26c16bd4f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#22 0x78b26ccd46e7 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#23 0x78b26cc2f651 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#24 0x78b26cc2f651 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#25 0x78b2719c5958 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#26 0x78b271a8b754 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:539:33
#27 0x78b2729a5b7b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:646:20
#28 0x78b26ccd5594 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#29 0x78b26cc2f651 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#30 0x78b26cc2f651 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#31 0x78b2729a4fb9 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:584:34
#32 0x579fcd97e0ae in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:397:22

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250331215235-4bbc39703afd.
The bug appears to have been introduced in the following build range:

Start: 8b099f2b18f3af46c2624ade20b2b0bbd2417ebb (20241101051853)
End: d31b823cd764697e858c61b46cc032d4715ccb38 (20241031232525)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8b099f2b18f3af46c2624ade20b2b0bbd2417ebb&tochange=d31b823cd764697e858c61b46cc032d4715ccb38

Comment 2

[Tyson Smith [:tsmith]]

Test case uses FuzzingFunctions.spinEventLoopFor() it was added by bug 1928492 which is in the above range.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Well, spinEventLoopFor() was added to catch issues like this easier.
The issue is somewhere else

Comment 4

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1957512 using build mozilla-central 20250130092924-2bc2e0070931. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 5

[Kershaw Chang [:kershaw]]

This is fixed by bug 1958756.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #1, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:jdescottes, if possible, could you fill the Regressed by field?

For more information, please visit BugBot documentation.