1974293 - Assertion failure: false (How did this happen?), at /docshell/base/BrowsingContext.cpp:4021

Status: VERIFIED FIXED

(Core :: DOM: Navigation, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev b6b97a2645ba (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build b6b97a2645ba --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: false (How did this happen?), at /docshell/base/BrowsingContext.cpp:4021

    ==733274==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7774d7c01854 bp 0x7ffd514906b0 sp 0x7ffd514906b0 T733274)
    ==733274==The signal is caused by a WRITE memory access.
    ==733274==Hint: address points to the zero page.
        #0 0x7774d7c01854 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
        #1 0x7774d7c01854 in operator()<mozilla::ipc::ResponseRejectReason> /docshell/base/BrowsingContext.cpp:4021:28
        #2 0x7774d7c01854 in invoke<(lambda at /docshell/base/BrowsingContext.cpp:4021:9) &, mozilla::ipc::ResponseRejectReason> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10
        #3 0x7774d7c01854 in fu2::abi_400::detail::type_erasure::invocation_table::function_trait<void (mozilla::ipc::ResponseRejectReason)>::internal_invoker<fu2::abi_400::detail::type_erasure::box<false, mozilla::dom::BrowsingContext::GetContiguousHistoryEntries(mozilla::dom::SessionHistoryInfo&, mozilla::dom::Navigation*)::$_1, std::allocator<mozilla::dom::BrowsingContext::GetContiguousHistoryEntries(mozilla::dom::SessionHistoryInfo&, mozilla::dom::Navigation*)::$_1>>, true>::invoke(fu2::abi_400::detail::type_erasure::data_accessor*, unsigned long, mozilla::ipc::ResponseRejectReason) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:638:1
        #4 0x7774d251e050 in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &, mozilla::ipc::ResponseRejectReason> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1046:12
        #5 0x7774d251e050 in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)> > &, mozilla::ipc::ResponseRejectReason> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1268:37
        #6 0x7774d251e050 in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:826:1
        #7 0x7774d251e050 in mozilla::ipc::IPDLAsyncReturnsCallbacks::GotReply(mozilla::ipc::IProtocol*, IPC::Message const&) /ipc/glue/ProtocolUtils.cpp
        #8 0x7774d6c55bbc in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp
        #9 0x7774d250405e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1795:25
        #10 0x7774d2501248 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1721:9
        #11 0x7774d2501e30 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1512:3
        #12 0x7774d2502f39 in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1612:14
        #13 0x7774d1928037 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:703:16
        #14 0x7774d19210ae in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1310:20
        #15 0x7774d191fde7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1133:15
        #16 0x7774d1920265 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:639:36
        #17 0x7774d192f239 in operator() /xpcom/threads/TaskController.cpp:336:37
        #18 0x7774d192f239 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #19 0x7774d19410f3 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1159:16
        #20 0x7774d194785f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #21 0x7774d2509a43 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #22 0x7774d2462231 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #23 0x7774d2462231 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #24 0x7774d72deb78 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #25 0x7774d73a1524 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:471:33
        #26 0x7774d82cd67b in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:652:20
        #27 0x7774d250a934 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #28 0x7774d2462231 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #29 0x7774d2462231 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #30 0x7774d82ccab9 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:590:34
        #31 0x59109e79c82e in main /browser/app/nsBrowserApp.cpp:397:22
        #32 0x7774e240c1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #33 0x7774e240c28a in __libc_start_main csu/../csu/libc-start.c:360:3
        #34 0x59109e770098 in _start (/home/jkratzer/builds/m-c-20250626034703-fuzzing-debug/firefox-bin+0x57098) (BuildId: 3fbddf2d9ee9ee767cb949c3267152e77213c490)
    
    ==733274==Register values:
    rax = 0x0000000000000000  rbx = 0x00007774d7c01820  rcx = 0x0000000000000fb5  rdx = 0x00007774e25e6563  
    rdi = 0x00007774e25e7700  rsi = 0x0000000000000000  rbp = 0x00007ffd514906b0  rsp = 0x00007ffd514906b0  
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000000  r11 = 0x0000000000000293  
    r12 = 0x00007ffd51490780  r13 = 0x00007ffd51490790  r14 = 0x0000000000000004  r15 = 0x0000000000000000  
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3 in MOZ_CrashSequence
    ==733274==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250626214351-f0c5045b9e8a.
The bug appears to have been introduced in the following build range:

Start: a3ddc7278467e7fdc06ba96e92ff883aba52b208 (20250213024418)
End: c3a89fb5e4e1c924168064dff2edba09f5934719 (20250213032836)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a3ddc7278467e7fdc06ba96e92ff883aba52b208&tochange=c3a89fb5e4e1c924168064dff2edba09f5934719

Comment 3

[Sean Feng [:sefeng211]]

This is likely coming from bug 1890747

Comment 4

[Adam Vandolder [:avandolder]]

I believe this is the same failure as bug 1967838. I had hoped that would be fixed once Bug 1952913: Directly link contiguous SessionHistoryEntrys landed, but it seems to still be occurring. Now with the testcase I should hopefully be able to fully resolve it.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

This bug prevents fuzzing from making progress; however, it has low severity. It is important for fuzz blocker bugs to be addressed in a timely manner (see here why?).
:sefeng, could you consider increasing the severity?

For more information, please visit BugBot documentation.

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

This bug has been marked as a regression. Setting status flag for Nightly to affected.

Comment 7

[Sean Feng [:sefeng211]]

I think we are making active progress now, so I'd like to stick with S3 and see how it goes.

Comment 8

[Adam Vandolder [:avandolder]]

Attachment: Bug 1974293 - Always resolve the promise in ContentParent::RecvGetContiguousSessionHistoryInfos. r?#dom-core

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #2, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:avandolder, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Comment 10

[Tyson Smith [:tsmith]]

Attachment: prefs.js

prefs.js file for bugmon.

Comment 11

[Tyson Smith [:tsmith]]

This is no longer a fuzzblocker since the pref had been disabled for fuzzing but it will need to be resolved before we can resume fuzzing.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/306e908f18dc
https://hg.mozilla.org/integration/autoland/rev/65ba74c32f76
Always resolve the promise in ContentParent::RecvGetContiguousSessionHistoryInfos. r=dom-core,smaug

Comment 13

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/65ba74c32f76

Comment 14

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20250723155040-c6c802b9d454.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.