2014592 - Assertion failure: navigation->mUpcomingTraverseAPIMethodTrackers.Contains(*key), at /dom/navigation/Navigation.cpp:1823

Status: VERIFIED FIXED

(Core :: DOM: Navigation, defect)

Description

[Jason Kratzer [:jkratzer]]

Reproduced on mozilla-central rev ab79c347a784 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build ab79c347a784 --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Assertion failure: navigation->mUpcomingTraverseAPIMethodTrackers.Contains(*key), at /dom/navigation/Navigation.cpp:1823

    ==1377021==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7b34e1fe604c bp 0x7ffe0de7c640 sp 0x7ffe0de7c600 T1377021)
    ==1377021==The signal is caused by a WRITE memory access.
    ==1377021==Hint: address points to the zero page.
        #0 0x7b34e1fe604c in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x7b34e1fe604c in mozilla::dom::Navigation::CleanUp(mozilla::dom::NavigationAPIMethodTracker*) /dom/navigation/Navigation.cpp:1822:3
        #2 0x7b34e1fe6342 in CleanUp /dom/navigation/Navigation.cpp:101:46
        #3 0x7b34e1fe6342 in mozilla::dom::NavigationAPIMethodTracker::RejectFinishedPromise(JS::Handle<JS::Value>) /dom/navigation/Navigation.cpp:140:3
        #4 0x7b34e1ff9223 in operator() /dom/navigation/Navigation.cpp:738:23
        #5 0x7b34e1ff9223 in __invoke_impl<void, (lambda at /dom/navigation/Navigation.cpp:691:42) &, nsresult> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
        #6 0x7b34e1ff9223 in __invoke_r<void, (lambda at /dom/navigation/Navigation.cpp:691:42) &, nsresult> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:110:2
        #7 0x7b34e1ff9223 in std::_Function_handler<void (nsresult), mozilla::dom::Navigation::PerformNavigationTraversal(JSContext*, nsID const&, mozilla::dom::NavigationOptions const&, mozilla::dom::NavigationResult&)::$_0>::_M_invoke(std::_Any_data const&, nsresult&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:291:9
        #8 0x7b34e2a39c7e in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:622:14
        #9 0x7b34e2a39c7e in operator() /docshell/shistory/ChildSHistory.cpp:309:49
        #10 0x7b34e2a39c7e in __invoke_impl<void, (lambda at /docshell/shistory/ChildSHistory.cpp:309:7) &, nsresult> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
        #11 0x7b34e2a39c7e in __invoke_r<void, (lambda at /docshell/shistory/ChildSHistory.cpp:309:7) &, nsresult> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:110:2
        #12 0x7b34e2a39c7e in std::_Function_handler<void (nsresult), mozilla::dom::ChildSHistory::GotoKey(nsID const&, mozilla::dom::BrowsingContext*, bool, bool, bool, std::function<void (nsresult)> const&, mozilla::ErrorResult&)::$_1>::_M_invoke(std::_Any_data const&, nsresult&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:291:9
        #13 0x7b34e29bf7b5 in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:622:14
        #14 0x7b34e29bf7b5 in invoke<std::function<void (nsresult)> &, nsresult> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10
        #15 0x7b34e29bf7b5 in fu2::abi_400::detail::type_erasure::invocation_table::function_trait<void (nsresult&&)>::internal_invoker<fu2::abi_400::detail::type_erasure::box<false, std::function<void (nsresult)>, std::allocator<std::function<void (nsresult)>>>, false>::invoke(fu2::abi_400::detail::type_erasure::data_accessor*, unsigned long, nsresult&&) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:638:1
        #16 0x7b34e19e7252 in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &, nsresult> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1046:12
        #17 0x7b34e19e7252 in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, void (nsresult &&)> > &, nsresult> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1270:37
        #18 0x7b34e19e7252 in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:826:1
        #19 0x7b34e19e7252 in operator() /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:6873:13
        #20 0x7b34e19e7252 in decltype(std::forward<mozilla::dom::PContentChild::SendNavigationTraverse(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, nsID const&, unsigned long const&, bool const&, bool const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (nsresult&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&>(fp)(std::forward<IPC::MessageReader*>(fp0))) fu2::abi_400::detail::invocation::invoke<mozilla::dom::PContentChild::SendNavigationTraverse(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, nsID const&, unsigned long const&, bool const&, bool const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (nsresult&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&, IPC::MessageReader*>(mozilla::dom::PContentChild::SendNavigationTraverse(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, nsID const&, unsigned long const&, bool const&, bool const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (nsresult&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&, IPC::MessageReader*&&) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10
        #21 0x7b34e19e74d7 in fu2::abi_400::detail::type_erasure::invocation_table::function_trait<mozilla::ipc::HasResultCodes::Result (IPC::MessageReader*)>::internal_invoker<fu2::abi_400::detail::type_erasure::box<false, mozilla::dom::PContentChild::SendNavigationTraverse(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, nsID const&, unsigned long const&, bool const&, bool const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (nsresult&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0, std::allocator<mozilla::dom::PContentChild::SendNavigationTraverse(mozilla::dom::MaybeDiscarded<mozilla::dom::BrowsingContext> const&, nsID const&, unsigned long const&, bool const&, bool const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (nsresult&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0>>, false>::invoke(fu2::abi_400::detail::type_erasure::data_accessor*, unsigned long, IPC::MessageReader*) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:638:1
        #22 0x7b34dcf641c7 in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &, IPC::MessageReader *> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1046:12
        #23 0x7b34dcf641c7 in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, mozilla::ipc::HasResultCodes::Result (IPC::MessageReader *)> > &, IPC::MessageReader *> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1270:37
        #24 0x7b34dcf641c7 in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:826:1
        #25 0x7b34dcf641c7 in mozilla::ipc::IPDLAsyncReturnsCallbacks::GotReply(mozilla::ipc::IProtocol*, IPC::Message const&) /ipc/glue/ProtocolUtils.cpp:908:17
        #26 0x7b34e19b8cc2 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:0:13
        #27 0x7b34dcf4ae8e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1793:25
        #28 0x7b34dcf48410 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /ipc/glue/MessageChannel.cpp:1719:9
        #29 0x7b34dcf48e17 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1508:3
        #30 0x7b34dcf49df9 in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1610:14
        #31 0x7b34dc340097 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:705:16
        #32 0x7b34dc33a764 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1325:20
        #33 0x7b34dc3393e7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1148:15
        #34 0x7b34dc339865 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:641:36
        #35 0x7b34dc3493d9 in operator() /xpcom/threads/TaskController.cpp:336:37
        #36 0x7b34dc3493d9 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /xpcom/threads/nsThreadUtils.h:549:5
        #37 0x7b34dc35b8f3 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1168:16
        #38 0x7b34dc36154f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #39 0x7b34dcf50683 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #40 0x7b34dcea9ad1 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #41 0x7b34dcea9ad1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #42 0x7b34e205b948 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:152:27
        #43 0x7b34e2127264 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:555:33
        #44 0x7b34e316e9cb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:656:20
        #45 0x7b34dcf51574 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #46 0x7b34dcea9ad1 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #47 0x7b34dcea9ad1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #48 0x7b34e316e12f in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:594:34
        #49 0x56d11156535c in main /browser/app/nsBrowserApp.cpp:465:22
        #50 0x7b34edc2a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #51 0x7b34edc2a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #52 0x56d1115391b8 in _start ??:0:0
    
    ==1377021==Register values:
    rax = 0x0000000000000000  rbx = 0x000056d117eba830  rcx = 0x000000000000071f  rdx = 0x00007b34ede04563
    rdi = 0x00007b34ede05700  rsi = 0x0000000000000000  rbp = 0x00007ffe0de7c640  rsp = 0x00007ffe0de7c600
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x00007b34c401cb00  r13 = 0x0000000000000030  r14 = 0x000056d117eba8d8  r15 = 0x00007b34d7c421e4
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/jkratzer/builds/m-c-20260204094524-fuzzing-debug/libxul.so+0xa5e604c) (BuildId: 6324a18a77ec64a491609780586d8badab323adb)
    ==1377021==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Detailed Crash Information

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 2014592 using build mozilla-central 20260204094524-ab79c347a784. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260205042023-4779d1a57487.
The bug appears to have been introduced in the following build range:

Start: a3ddc7278467e7fdc06ba96e92ff883aba52b208 (20250213024418)
End: c3a89fb5e4e1c924168064dff2edba09f5934719 (20250213032836)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a3ddc7278467e7fdc06ba96e92ff883aba52b208&tochange=c3a89fb5e4e1c924168064dff2edba09f5934719

Comment 5

[Andreas Farre [:farre]]

Most likely not a bug. We assert that a key exists, then promptly remove it. And it's the exists test that asserts. This is an assert lifted from spec, so probably a spec bug, but not a sec bug.

Comment 6

[BugBot [:suhaib / :marco]]

This bug has been marked as a regression. Setting status flag for Nightly to affected.

Comment 7

[BugBot [:suhaib / :marco]]

Based on comment #4, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:farre, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Comment 8

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced testcase.

Comment 9

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1890747

Comment 10

[Andreas Farre [:farre]]

I can't reproduce this. Tyson, in the reduced testcase there is no mention of the Navigation API, do you have any further instructions of how to reproduce. grizzly-replay turns up nothing.

Comment 11

[Andreas Farre [:farre]]

Ok, helps if you not look at what bugzilla is loading but what's saved.

Comment 12

[Tyson Smith [:tsmith]]

The testcase doesn't seem to be very reliable, I guess I got lucky when I tried locally.

I reproduced it locally using grizzly-replay <bin> <testcase> --repeat 10 --display headless --time-limit 10.

A Pernosco session is available here: https://pernos.co/debug/V36QiSZA9HcW3p27FrPZ8w/index.html

Comment 13

[Andreas Farre [:farre]]

Thanks Tyson, we were able to reduce further yesterday and spending a whopping 12 man hours on it we were able to find the root cause.

It's a spec bug: https://github.com/whatwg/html/issues/12176

I have a fix for Gecko that I'll upload in minutes, and I'll have a spec PR before lunch :D

Comment 14

[Andreas Farre [:farre]]

Attachment: (secure)

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/104f309ed4c1
https://hg.mozilla.org/integration/autoland/rev/167c39a96122
Abort traversal if tracker is no longer ongoing. r=jjaschke

Comment 16

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/167c39a96122

Comment 17

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260220092058-abf3d62a5908.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.