2014861 - Hit MOZ_CRASH(MozPromise::ThenValue created from 'All' destroyed without being either disconnected, resolved, or rejected (dispatchRv: not dispatched)) at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:549

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[Jason Kratzer [:jkratzer]]

Reproduced on mozilla-central rev 57fbf639ea5b (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build 57fbf639ea5b --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(MozPromise::ThenValue created from 'All' destroyed without being either disconnected, resolved, or rejected (dispatchRv: not dispatched)) at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:549

    ==2691837==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7a9d506c704f bp 0x7a9d440cc360 sp 0x7a9d440cc350 T2824841)
    ==2691837==The signal is caused by a WRITE memory access.
    ==2691837==Hint: address points to the zero page.
        #0 0x7a9d506c704f in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x7a9d506c704f in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:375:3
        #2 0x7a9d506c704f in mozilla::MozPromise<CopyableTArray<bool>, mozilla::ipc::ResponseRejectReason, true>::ThenValueBase::AssertIsDead() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:544:11
        #3 0x7a9d506c8316 in ~ResolveOrRejectRunnable /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:499:23
        #4 0x7a9d506c8316 in mozilla::MozPromise<CopyableTArray<bool>, mozilla::ipc::ResponseRejectReason, true>::ThenValueBase::ResolveOrRejectRunnable::~ResolveOrRejectRunnable() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:497:34
        #5 0x7a9d509520a0 in mozilla::Runnable::Release() /xpcom/threads/nsThreadUtils.cpp:65:1
        #6 0x7a9d561005e0 in Release /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:49:40
        #7 0x7a9d561005e0 in ~nsCOMPtr /xpcom/base/nsCOMPtr.h:344:7
        #8 0x7a9d561005e0 in mozilla::dom::WorkerEventTarget::Dispatch(already_AddRefed<nsIRunnable>, nsIEventTarget::DispatchFlags) /dom/workers/WorkerEventTarget.cpp:221:1
        #9 0x7a9d51283c63 in mozilla::MozPromise<mozilla::Maybe<mozilla::dom::LlamaChatResponse>, nsTString<char>, true>::ThenValueBase::Dispatch(mozilla::MozPromise<mozilla::Maybe<mozilla::dom::LlamaChatResponse>, nsTString<char>, true>*) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:607:38
        #10 0x7a9d54fae79b in mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::DispatchAll() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1297:18
        #11 0x7a9d54faeafe in void mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::Private::Resolve<mozilla::dom::MediaCapabilitiesInfo>(mozilla::dom::MediaCapabilitiesInfo&&, mozilla::StaticString) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1383:5
        #12 0x7a9d54fae7e6 in mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::DispatchAll() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1302:7
        #13 0x7a9d54faeafe in void mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::Private::Resolve<mozilla::dom::MediaCapabilitiesInfo>(mozilla::dom::MediaCapabilitiesInfo&&, mozilla::StaticString) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1383:5
        #14 0x7a9d54fae7e6 in mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::DispatchAll() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1302:7
        #15 0x7a9d54faeafe in void mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::Private::Resolve<mozilla::dom::MediaCapabilitiesInfo>(mozilla::dom::MediaCapabilitiesInfo&&, mozilla::StaticString) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1383:5
        #16 0x7a9d54fae29c in mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::ChainTo(already_AddRefed<mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::Private>, mozilla::StaticString) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1238:7
        #17 0x7a9d54fb037c in void mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::MaybeChain<mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>>(mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>*, RefPtr<mozilla::MozPromise<mozilla::dom::MediaCapabilitiesInfo, mozilla::MediaResult, true>::Private>&&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:695:14
        #18 0x7a9d54fb09d9 in mozilla::MozPromise<mozilla::TrackInfo::TrackType, mozilla::MediaResult, true>::ThenValue<mozilla::dom::MediaCapabilities::CreateMediaCapabilitiesDecodingInfo(mozilla::dom::MediaDecodingConfiguration const&, mozilla::ErrorResult&, mozilla::dom::Promise*)::$_1::operator()()::'lambda'(mozilla::MozPromise<RefPtr<mozilla::MediaDataDecoder>, mozilla::MediaResult, true>::ResolveOrRejectValue&&)::operator()(mozilla::MozPromise<RefPtr<mozilla::MediaDataDecoder>, mozilla::MediaResult, true>::ResolveOrRejectValue&&)::'lambda'(mozilla::MozPromise<mozilla::TrackInfo::TrackType, mozilla::MediaResult, true>::ResolveOrRejectValue&&)>::DoResolveOrRejectInternal(mozilla::MozPromise<mozilla::TrackInfo::TrackType, mozilla::MediaResult, true>::ResolveOrRejectValue&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:950:7
        #19 0x7a9d54c8ef55 in mozilla::MozPromise<mozilla::TrackInfo::TrackType, mozilla::MediaResult, true>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:505:21
        #20 0x7a9d509416f0 in mozilla::TaskQueue::Runner::Run() /xpcom/threads/TaskQueue.cpp:311:20
        #21 0x7a9d5096829e in nsThreadPool::Run() /xpcom/threads/nsThreadPool.cpp:446:14
        #22 0x7a9d5095fac2 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1162:16
        #23 0x7a9d5096554f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #24 0x7a9d51556018 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:299:20
        #25 0x7a9d514ae291 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #26 0x7a9d514ae291 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #27 0x7a9d5095b6ee in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:373:10
        #28 0x7a9d628f93ac in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:191:3
        #29 0x7a9d6229caa3 in start_thread ./nptl/pthread_create.c:447:8
        #30 0x7a9d62329c6b in clone3 ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0
    
    ==2691837==Register values:
    rax = 0x0000000000000225  rbx = 0x0000580df8dfd120  rcx = 0x0000000000000000  rdx = 0x00007a9d62404563
    rdi = 0x00007a9d62405700  rsi = 0x0000000000000000  rbp = 0x00007a9d440cc360  rsp = 0x00007a9d440cc350
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0xaaaaaaaaaaaaaaaa  r13 = 0x00007a9d440cc610  r14 = 0x0000000000000000  r15 = 0x0000000080004005
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/jkratzer/builds/m-c-20260205090734-fuzzing-debug/libxul.so+0x46c704f) (BuildId: c143802c55c45c489dd220fc3aaf3f64e16a58ac)
    ==2691837==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Detailed Crash Information

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260205213633-279b57ef4bf0.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: ce0f77cae5a91e2cb4b1ec859117e08aa1182c52 (20250207164009)
End: 57fbf639ea5bd2e56dd9e1bef16497372385229d (20260205090734)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 4

[Frederik Braun [:freddy]]

Our team might need some help assigning a security severity here. E.g., is this assertion preventing a security bug from occuring or do we think there is proper error handling after that?

The symptom is a safe MOZ_CRASH but the root cause is that the promise is somehow "disconnected". We should find out if that's able to cause problems elsewhere.

Comment 5

[Alastor Wu [:alwu]]

I will update the security severity later after finishing my investigation.

Comment 6

[Alastor Wu [:alwu]]

Attachment: (secure)

Comment 7

[Alastor Wu [:alwu]]

Attachment: (secure)

Comment 8

[Alastor Wu [:alwu]]

Suggested sec-low: Crash during worker shutdown when mediaCapabilities.decodingInfo() operations are in-flight. DoS only (content process crash), no memory corruption or exploitation potential. Requires timing-dependent race between worker shutdown and decoder queries.

Comment 9

[Alastor Wu [:alwu]]

After some thought, I believe this should be classified as sec-other based on following reasons.

1. It does not crash in release builds.
2. When the issue occurs, it indicates that the Then() objects were not disconnected correctly. This does not lead to UAF, memory leaks, or
   exposure of an attack surface. The assertion exists solely to ensure workflow correctness.

Comment 10

[Alastor Wu [:alwu]]

Ni my self to land test separately.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5c35a72319f5
https://hg.mozilla.org/integration/autoland/rev/ebbeef561d6c
Use taskQueue for MediaCapabilities promise aggregation. r=pehrsons

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/ebbeef561d6c

Comment 13

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260213093634-c898f98e4898.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/df67f3dd09ea
https://hg.mozilla.org/integration/autoland/rev/96c5619a38c8
add test. r=media-playback-reviewers,pehrsons