2000997 - Assertion failure: !Failed(), at /builds/worker/workspace/obj-build/dist/include/mozilla/ErrorResult.h:583

Status: NEW

(Core :: Privacy: Anti-Tracking, defect, P5)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20251116-8436033e179a (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting the URL provided by the report found here: https://crash-stats.mozilla.org/report/index/529b70e2-706a-40ec-8033-e987f0251116. A Pernosco session is available here: https://pernos.co/debug/Fo1G3fyAJOu_DcQpKdjekA/index.html

Assertion failure: !Failed(), at /builds/worker/workspace/obj-build/dist/include/mozilla/ErrorResult.h:583

37|0|libxul.so|mozilla::CanvasUtils::GetCanvasExtractDataPermission(nsIPrincipal*)|git:github.com/mozilla/firefox:dom/canvas/CanvasUtils.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|128|0x427
37|1|libxul.so|mozilla::nsRFPService::RandomizeElements(nsICookieJarSettings*, nsIPrincipal*, unsigned char*, unsigned int, unsigned char, unsigned char, unsigned char, bool)|git:github.com/mozilla/firefox:toolkit/components/resistfingerprinting/nsRFPService.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|1806|0x9a
37|2|libxul.so|mozilla::ClientWebGLContext::ReadPixels(int, int, int, int, unsigned int, unsigned int, mozilla::dom::ArrayBufferView_base<&JS_GetArrayBufferViewType(JSObject*)> const&, unsigned int, mozilla::dom::CallerType, mozilla::ErrorResult&) const|git:github.com/mozilla/firefox:dom/canvas/ClientWebGLContext.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|5337|0x630
37|3|libxul.so|mozilla::dom::WebGL2RenderingContext_Binding::readPixels(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:ea0be2690a6943df1d432dd72e49f7b6bd1a11e59bb36c01452fe2e60f7d3f9e6ad4b3f3f90abb31bfb214aab88006339ed4c365e87fd30032130e2b589f9f33/dom/bindings/WebGL2RenderingContextBinding.cpp:|7526|0x852
37|4|libxul.so|mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|git:github.com/mozilla/firefox:dom/bindings/BindingUtils.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|3306|0x1dd
37|5|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|490|0xf4
37|6|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|586|0x2bf
37|7|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|685|0x12c
37|8|libxul.so|js::jit::InvokeFunction(JSContext*, JS::Handle<JSObject*>, bool, bool, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>)|git:github.com/mozilla/firefox:js/src/jit/VMFunctions.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|567|0x7c4
37|9|||||
37|10|||||
37|11|||||
37|12|libxul.so|js::jit::MaybeEnterJit(JSContext*, js::RunState&)|git:github.com/mozilla/firefox:js/src/jit/Jit.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|255|0x49b
37|13|libxul.so|js::RunScript(JSContext*, js::RunState&)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|450|0x3c1
37|14|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|618|0x2e5
37|15|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|685|0x12c
37|16|libxul.so|js::fun_apply(JSContext*, unsigned int, JS::Value*)|git:github.com/mozilla/firefox:js/src/vm/JSFunction.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|1159|0x43c
37|17|||||
37|18|||||
37|19|||||
37|20|libxul.so|js::jit::MaybeEnterJit(JSContext*, js::RunState&)|git:github.com/mozilla/firefox:js/src/jit/Jit.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|255|0x49b
37|21|libxul.so|js::Interpret(JSContext*, js::RunState&)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|3311|0xad6f
37|22|libxul.so|js::RunScript(JSContext*, js::RunState&)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|460|0x3da
37|23|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|618|0x2e5
37|24|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|git:github.com/mozilla/firefox:js/src/vm/Interpreter.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|685|0x12c
37|25|libxul.so|js::wasm::Instance::callImport(JSContext*, unsigned int, unsigned int, unsigned long*)|git:github.com/mozilla/firefox:js/src/wasm/WasmInstance.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|351|0x692
37|26|libxul.so|js::wasm::Instance::callImport_general(js::wasm::Instance*, int, int, unsigned long*)|git:github.com/mozilla/firefox:js/src/wasm/WasmInstance.cpp:1c2b83c1fdb8ba523831bcdb63947f5f7a4cfa5e|429|0x72
37|27|||||
...

Comment 1

[Tim Huang[:timhuang]]

Tom, is this related to the recent change on Canvas Randomization?

Comment 2

[Tom Ritter [:tjr]]

It's got to be failing on one of these two - I don't think it would be related, I'm more inclined to believe it's a corner case caused by the page.

Perhaps its time to learn pernosco...

Comment 3

[Tom Ritter [:tjr]]

Things I've learned from pernsco:

• This happens on a worker thread
• We're in PBM
• We fail with NS_ERROR_INTERNAL_ERRORRESULT_DOMEXCEPTION
• I found us hitting this log statement: "WorkerMainThreadRunnable::Dispatch %p Creating a SyncLoop when the Worker is shutting down"
• We then hit this code:

mSyncLoopTarget = syncLoop.GetSerialEventTarget();
  if (!mSyncLoopTarget) {  // mSyncLoopTarget is null
    // SyncLoop creation can fail if the worker is shutting down.
    aRv.ThrowInvalidStateError("The worker is shutting down");
    return;
  }

So my conclusion is that this is a really badly timed worker shutdown when we're trying to do something with it.