Closed Bug 1978585 Opened 8 months ago Closed 8 months ago

Assertion failure: !HasTimeouts(), at /dom/base/TimeoutManager.cpp:956

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
143 Branch
Tracking Flags:
Tracking Status
firefox-esr128 --- unaffected
firefox-esr140 --- unaffected
firefox141 --- unaffected
firefox142 --- fixed
firefox143 --- fixed

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: crash, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(1 file)

Testcase
4.59 KB, application/octet-stream
Details

Testcase found while fuzzing mozilla-central rev 09ffd71305bc (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 09ffd71305bc --asan --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !HasTimeouts(), at /dom/base/TimeoutManager.cpp:956

    =================================================================
    ==782956==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x745b16ff4a19 bp 0x745ae9463550 sp 0x745ae94633e0 T31)
    ==782956==The signal is caused by a WRITE memory access.
    ==782956==Hint: address points to the zero page.
        #0 0x745b16ff4a19 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
        #1 0x745b16ff4a19 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /dom/base/TimeoutManager.cpp:956:11
        #2 0x745b16ff2763 in mozilla::dom::TimeoutExecutor::MaybeExecute() /dom/base/TimeoutExecutor.cpp:179:11
        #3 0x745b16ff587a in Notify /dom/base/TimeoutExecutor.cpp:246:5
        #4 0x745b16ff587a in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /dom/base/TimeoutExecutor.cpp
        #5 0x745b12df41b4 in operator() /xpcom/threads/nsTimerImpl.cpp:725:44
        #6 0x745b12df41b4 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:725:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:726:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:729:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:730:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
        #7 0x745b12df41b4 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:724:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:725:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:726:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:729:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:730:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
        #8 0x745b12df41b4 in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:724:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:725:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:726:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:729:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:730:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:910:12
        #9 0x745b12df41b4 in match<(lambda at /xpcom/threads/nsTimerImpl.cpp:724:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:725:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:726:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:729:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:730:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:865:12
        #10 0x745b12df41b4 in nsTimerImpl::Fire(unsigned long) /xpcom/threads/nsTimerImpl.cpp:723:22
        #11 0x745b12df2b5d in nsTimerEvent::Run() /xpcom/threads/TimerThread.cpp:565:11
        #12 0x745b1cd0428a in mozilla::dom::(anonymous namespace)::ExternalRunnableWrapper::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*) /dom/workers/WorkerPrivate.cpp:225:37
        #13 0x745b1ccec66d in mozilla::dom::WorkerThreadRunnable::Run() /dom/workers/WorkerRunnable.cpp:443:12
        #14 0x745b12e077cc in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1153:16
        #15 0x745b12e11d28 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #16 0x745b1cccfe6a in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3956:7
        #17 0x745b1cc96553 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2265:42
        #18 0x745b12e077cc in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1153:16
        #19 0x745b12e11d28 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #20 0x745b144b3ce1 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:299:20
        #21 0x745b14395bb4 in RunInternal /ipc/chromium/src/base/message_loop.cc:369:10
        #22 0x745b14395bb4 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #23 0x745b14395bb4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #24 0x745b12e00610 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:366:10
        #25 0x745b3688a8ab in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:191:3
        #26 0x63069b9925a6 in asan_thread_start(void*) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28
        #27 0x745b36e16aa3 in start_thread nptl/pthread_create.c:447:8
        #28 0x745b36ea3c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
    
    ==782956==Register values:
    rax = 0x0000000000000001  rbx = 0x0000000000000001  rcx = 0x00000000000003bc  rdx = 0x0000000000000000  
    rdi = 0x000063069bb0fed0  rsi = 0x0000745ae9463398  rbp = 0x0000745ae9463550  rsp = 0x0000745ae94633e0  
     r8 = 0x0000000000000000   r9 = 0x0000000000000000  r10 = 0xffffff0000000000  r11 = 0x4000000000000000  
    r12 = 0x00000a220002d136  r13 = 0x00000000003d0900  r14 = 0x0000511000168900  r15 = 0x0000000000000000  
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3 in MOZ_CrashSequence
    Thread T31 created by T0 (Isolated Web Co) here:
        #0 0x63069b97bb81 in pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
        #1 0x745b3687b419 in _PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:429:10
        #2 0x745b3686965e in PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:496:10
        #3 0x745b12e03011 in nsThread::Init(nsTSubstring<char> const&) /xpcom/threads/nsThread.cpp:615:20
        #4 0x745b1ccff173 in mozilla::dom::WorkerThread::Create(mozilla::dom::WorkerThreadFriendKey const&) /dom/workers/WorkerThread.cpp:97:7
        #5 0x745b1cc6e0a7 in mozilla::dom::workerinternals::RuntimeService::ScheduleWorker(mozilla::dom::WorkerPrivate&) /dom/workers/RuntimeService.cpp:1411:37
        #6 0x745b1cc6cdb3 in mozilla::dom::workerinternals::RuntimeService::RegisterWorker(mozilla::dom::WorkerPrivate&) /dom/workers/RuntimeService.cpp:1294:19
        #7 0x745b1ccc8a24 in mozilla::dom::WorkerPrivate::Constructor(JSContext*, nsTSubstring<char16_t> const&, bool, mozilla::dom::WorkerKind, mozilla::dom::RequestCredentials, mozilla::dom::WorkerType, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::WorkerLoadInfo*, mozilla::ErrorResult&, nsTString<char16_t>, std::function<void (bool)>&&, std::function<void ()>&&, mozilla::ipc::Endpoint<mozilla::dom::PRemoteWorkerNonLifeCycleOpControllerChild>&&) /dom/workers/WorkerPrivate.cpp:3134:24
        #8 0x745b1cc86d27 in mozilla::dom::Worker::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::TrustedScriptURLOrUSVString const&, mozilla::dom::WorkerOptions const&, mozilla::ErrorResult&) /dom/workers/Worker.cpp:80:41
        #9 0x745b18358fd6 in mozilla::dom::Worker_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./WorkerBinding.cpp:1084:52
        #10 0x745b1f912e45 in CallJSNative /js/src/vm/Interpreter.cpp:501:13
        #11 0x745b1f912e45 in CallJSNativeConstructor /js/src/vm/Interpreter.cpp:519:8
        #12 0x745b1f912e45 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:725:14
        #13 0x745b1f92ee9a in ConstructFromStack /js/src/vm/Interpreter.cpp:772:10
        #14 0x745b1f92ee9a in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3272:16
        #15 0x745b1f90f299 in MaybeEnterInterpreterTrampoline /js/src/vm/Interpreter.cpp:395:10
        #16 0x745b1f90f299 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:471:13
        #17 0x745b1f91062d in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:629:13
        #18 0x745b1f912331 in InternalCall /js/src/vm/Interpreter.cpp:664:10
        #19 0x745b1f912331 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:696:8
        #20 0x745b1fa54ada in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #21 0x745b1866cf95 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventListenerBinding.cpp:62:8
        #22 0x745b199b1499 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObjectBase::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #23 0x745b199b0b6d in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1386:43
        #24 0x745b199b2bf0 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /dom/events/EventListenerManager.cpp:1698:12
        #25 0x745b199b1b49 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1603:35
        #26 0x745b19999f39 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:466:5
        #27 0x745b19999f39 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:365:17
        #28 0x745b19997a48 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:606:16
        #29 0x745b1999e902 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1261:11
        #30 0x745b1df6626f in nsDocumentViewer::LoadComplete(nsresult) /layout/base/nsDocumentViewer.cpp:1024:7
        #31 0x745b1e85c8ab in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /docshell/base/nsDocShell.cpp:6440:13
        #32 0x745b1e85b832 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp:5760:7
        #33 0x745b1e85dcb2 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /docshell/base/nsDocShell.cpp
        #34 0x745b1498cc65 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /uriloader/base/nsDocLoader.cpp:1477:3
        #35 0x745b1498ba55 in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:1010:14
        #36 0x745b14987c57 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /uriloader/base/nsDocLoader.cpp:831:9
        #37 0x745b1498a779 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /uriloader/base/nsDocLoader.cpp:712:5
        #38 0x745b1e8a8fe4 in nsDocShell::OnStopRequest(nsIRequest*, nsresult) /docshell/base/nsDocShell.cpp:14405:23
        #39 0x745b131d00b4 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /netwerk/base/nsLoadGroup.cpp:657:22
        #40 0x745b131d24b3 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /netwerk/base/nsLoadGroup.cpp:541:10
        #41 0x745b16caa9f2 in DoUnblockOnload /dom/base/Document.cpp:12340:18
        #42 0x745b16caa9f2 in mozilla::dom::Document::UnblockOnload(bool) /dom/base/Document.cpp:12279:7
        #43 0x745b16cdb9fa in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:8626:3
        #44 0x745b16e09bef in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #45 0x745b16e09bef in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #46 0x745b16e09bef in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #47 0x745b16e09bef in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #48 0x745b16e09bef in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #49 0x745b16e09bef in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #50 0x745b16e09bef in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #51 0x745b12dd79da in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:703:16
        #52 0x745b12dc52e8 in mozilla::TaskController::RunTask(mozilla::Task*) /xpcom/threads/TaskController.cpp:196:19
        #53 0x745b12dcc3ad in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1310:20
        #54 0x745b12dc9ee8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1133:15
        #55 0x745b12dca506 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:639:36
        #56 0x745b12de8591 in operator() /xpcom/threads/TaskController.cpp:333:37
        #57 0x745b12de8591 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #58 0x745b12e0742b in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1159:16
        #59 0x745b12e11d28 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #60 0x745b144b267e in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #61 0x745b14395bb4 in RunInternal /ipc/chromium/src/base/message_loop.cc:369:10
        #62 0x745b14395bb4 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #63 0x745b14395bb4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #64 0x745b1d6dd406 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #65 0x745b1d8b5dcb in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:471:33
        #66 0x745b1f6530bd in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:647:20
        #67 0x745b14395bb4 in RunInternal /ipc/chromium/src/base/message_loop.cc:369:10
        #68 0x745b14395bb4 in RunHandler /ipc/chromium/src/base/message_loop.cc:362:3
        #69 0x745b14395bb4 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:344:3
        #70 0x745b1f65162e in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:585:34
        #71 0x63069b9d8cb1 in main /browser/app/nsBrowserApp.cpp:397:22
        #72 0x745b36da41c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #73 0x745b36da428a in __libc_start_main csu/../csu/libc-start.c:360:3
        #74 0x63069b8f8a48 in _start (/home/jkratzer/builds/m-c-20250722042657-fuzzing-asan-opt/firefox+0xc9a48) (BuildId: 5f1140453c1374f3ec5883bf081e0e7a11e1ad07)
    
    ==782956==ABORTING
Attached file Testcase —
Attachment #9502135 - Attachment filename: testcase.zip.undefined → testcase.zip

Got a crash from the testcase on nightly: https://crash-stats.mozilla.org/report/index/8363739b-b3eb-4345-a5c6-a59c40250722

Crash Signature: [@ mozilla::dom::TimeoutManager::RunTimeout ]
Keywords: crash

Bisection:
Bug 1964605 - Use nsIGlobalObject::GetTimeoutManager for AbortSignal.timeout r=aiunusov

Differential Revision: https://phabricator.services.mozilla.com/D247895

2025-07-22T21:22:55.079000: DEBUG : Did not find a branch, checking all integration branches
2025-07-22T21:22:55.095000: INFO : The bisection is done.

Keywords: regression
Regressed by: 1964605

Set release status flags based on info from the regressing bug 1964605

:saschanaz, since you are the author of the regressor, bug 1964605, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

status-firefox141: --- → unaffected
status-firefox142: --- → affected
status-firefox143: --- → affected
status-firefox-esr128: --- → unaffected
status-firefox-esr140: --- → unaffected
Flags: needinfo?(krosylight)

Verified bug as reproducible on mozilla-central 20250722093426-47d8d7840ccb.
The bug appears to have been introduced in the following build range:

Start: d0192257fee25cf5ebc544a9dfa56bd954eb2233 (20250716093734)
End: b53d14963f735c7fb08d11b90f8902035a09629c (20250716125703)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=d0192257fee25cf5ebc544a9dfa56bd954eb2233&tochange=b53d14963f735c7fb08d11b90f8902035a09629c

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Hmm, maybe Artur has some idea? https://searchfox.org/mozilla-central/rev/1838f847aa3bf909c3d34a94a8f0cd7e37fca086/dom/base/TimeoutManager.cpp#955-956

// Since ClearAllTimeouts() was called the lists should be empty.

I'm not sure why this assumption holds?

Flags: needinfo?(krosylight) → needinfo?(aiunusov)

looking

https://bugzilla.mozilla.org/show_bug.cgi?id=1953171

fixed similar assert in the past. I think this is a data race
(looking at the test case)

Flags: needinfo?(aiunusov)

Ahh. Now I realized.

In short: TimeoutManager is owned exclusively by WorkerPrivate and does not even know anything about worker and it's status
We have a corner case there:
"the timeout manager is trying to call setTimeout/setInterval and the worker itself which has initiated the close process"

So, unfortunately, we cannot use TimeoutManager::SetTimeout() directly in worker thread without involving WorkerPrivate

https://searchfox.org/mozilla-central/rev/86878e73a24fe32ea09dbae5b55362efaf7485c8/dom/workers/WorkerPrivate.cpp#5900,5913-5914 - WorkerPrivate::SetTimeout() accesses mStatus field and therefore changes the behavior

My suggestion is to revert the patch (or rework, although I am still thinking how do it in a correct way)

I believe, further refactoring is needed in order to get rid of WorkerPrivate::SetTimeout completely and use only generic TimeoutManager. Although, it's almost done (except these lines)

Flags: needinfo?(krosylight)

(I will think how to do this in a better way)

Does comment #10 imply that you have soon-enough change in mind, or should I backout the patch for now?

Flags: needinfo?(krosylight) → needinfo?(aiunusov)

(Probably backout is the safer approach as we also need to uplift)

For now I'll do the backout for now because it's affecting 142 too. Thanks!

Flags: needinfo?(aiunusov)

marking 142 as fixed by back out because the regressor was backed out beta (for 142.0b3) as requested

status-firefox142: affected → fixed

(In reply to Kagami Rosylight [:saschanaz] (they/them) from comment #13)

For now I'll do the backout for now because it's affecting 142 too. Thanks!

I will prepare the code for your patch. Just need to do a small refactor :)
Thanks for catching the corner case

created a follow up bug
https://bugzilla.mozilla.org/show_bug.cgi?id=1979284

(I guess this bug can be closed then)

👍

Status: NEW → RESOLVED
Closed: 8 months ago
Resolution: --- → FIXED

Verified bug as fixed on rev mozilla-central 20250725093757-12bf685e7003.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon
Target Milestone: --- → 143 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: