Closed Bug 2044843 Opened 5 months ago Closed 3 months ago

Assertion failure: !cx->brittleMode (ArrayBuffer length pinned), at checkouts/gecko/js/src/vm/ArrayBufferObject.cpp:3180

Categories

(Core :: JavaScript Engine, defect, P3)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
155 Branch
Tracking Flags:
Tracking Status
firefox-esr140 --- wontfix
firefox-esr153 --- fixed
firefox153 --- wontfix
firefox154 --- wontfix
firefox155 --- verified

People

(Reporter: tsmith, Assigned: sfink)

References

(Blocks 3 open bugs)

Details

(Keywords: assertion, testcase, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(1 file, 6 external files)

testcase.html
451 bytes, text/html
Details
Attached file testcase.html —

Found while fuzzing m-c 20260413-1f396df9f27e (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !cx->brittleMode (ArrayBuffer length pinned), at checkouts/gecko/js/src/vm/ArrayBufferObject.cpp:3180

#0 0x7a67f6baec3d in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7a67f6baec3d in js::ArrayBufferObject::ensureNonInline(JSContext*, JS::Handle<js::ArrayBufferObject*>) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/ArrayBufferObject.cpp:3180:5
#2 0x7a67f6bb4a54 in js::ArrayBufferViewObject::ensureNonInline(JSContext*, JS::Handle<js::ArrayBufferViewObject*>) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/ArrayBufferViewObject.cpp:107:10
#3 0x7a67f6bb7b6a in JS::EnsureNonInlineArrayBufferOrView(JSContext*, JSObject*) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/ArrayBufferViewObject.cpp:645:12
#4 0x7a67f33b1a13 in ProcessFixedData<false, (lambda at ./../../../../../checkouts/gecko/dom/media/webcodecs/VideoFrame.cpp:1993:48)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:695:10
#5 0x7a67f33b1a13 in operator()<mozilla::dom::ArrayBufferView_base<&JS_GetArrayBufferViewType> > /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1049:28
#6 0x7a67f33b1a13 in Apply<(lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1048:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:964:1
#7 0x7a67f33b1a13 in Apply<(lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1048:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:978:19
#8 0x7a67f33b1a13 in Apply<(lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1048:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:986:16
#9 0x7a67f33b1a13 in ApplyToTypedArrays<mozilla::dom::MaybeSharedArrayBufferOrMaybeSharedArrayBufferView, (lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1048:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:998:7
#10 0x7a67f33b1a13 in ProcessTypedArraysFixed<mozilla::dom::MaybeSharedArrayBufferOrMaybeSharedArrayBufferView, (lambda at ./../../../../../checkouts/gecko/dom/media/webcodecs/VideoFrame.cpp:1993:48), 0> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1047:10
#11 0x7a67f33b1a13 in mozilla::dom::VideoFrame::CopyTo(mozilla::dom::MaybeSharedArrayBufferOrMaybeSharedArrayBufferView const&, mozilla::dom::VideoFrameCopyToOptions const&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/media/webcodecs/./../../../../../checkouts/gecko/dom/media/webcodecs/VideoFrame.cpp:1993:10
#12 0x7a67f172d50a in copyTo /builds/worker/workspace/obj-build/dom/bindings/./VideoFrameBinding.cpp:1330:60
#13 0x7a67f172d50a in mozilla::dom::VideoFrame_Binding::copyTo_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./VideoFrameBinding.cpp:1344:13
#14 0x7a67f1de3cd6 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./../../../../checkouts/gecko/dom/bindings/BindingUtils.cpp:3217:13
#15 0x7a67f6b42384 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:498:13
#16 0x7a67f6b41c2f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:594:12
#17 0x7a67f6b53af2 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:666:10
#18 0x7a67f6b53af2 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3280:16
#19 0x7a67f6b41686 in MaybeEnterInterpreterTrampoline(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:392:10
#20 0x7a67f6b412ca in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:468:13
#21 0x7a67f6b41c55 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:626:13
#22 0x7a67f6b4306c in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:693:8
#23 0x7a67f6b441d3 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:815:10
#24 0x7a67f6ed9ddc in CallGetter /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/NativeObject.cpp:2177:12
#25 0x7a67f6ed9ddc in bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, js::PropertyInfoBase<unsigned int>, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/NativeObject.cpp:2205:12
#26 0x7a67f6eda527 in bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/NativeObject.cpp:2348:14
#27 0x7a67f59043d3 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:118:10
#28 0x7a67f5a19607 in js::ResolvePromiseInternal(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>) /builds/worker/workspace/obj-build/js/src/builtin/./../../../../../checkouts/gecko/js/src/builtin/Promise.cpp:1538:7
#29 0x7a67f58f2671 in ResolveOrRejectPromise(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, bool) /builds/worker/workspace/obj-build/js/src/./../../../../checkouts/gecko/js/src/jsapi.cpp:3049:19
#30 0x7a67f41f5949 in mozilla::dom::Promise::MaybeResolve(JSContext*, JS::Handle<JS::Value>) /builds/worker/workspace/obj-build/dom/promise/./../../../../checkouts/gecko/dom/promise/Promise.cpp:439:31
#31 0x7a67f33bb2b5 in void mozilla::dom::Promise::MaybeSomething<mozilla::dom::Sequence<mozilla::dom::PlaneLayout>&>(mozilla::dom::Sequence<mozilla::dom::PlaneLayout>&, void (mozilla::dom::Promise::*)(JSContext*, JS::Handle<JS::Value>)) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Promise.h:481:5
#32 0x7a67f33bac88 in MaybeResolve<mozilla::dom::Sequence<mozilla::dom::PlaneLayout> &> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Promise.h:98:5
#33 0x7a67f33bac88 in mozilla::dom::VideoFrame::CopyTo(mozilla::dom::MaybeSharedArrayBufferOrMaybeSharedArrayBufferView const&, mozilla::dom::VideoFrameCopyToOptions const&, mozilla::ErrorResult&)::$_0::operator()(mozilla::Span<unsigned char, 18446744073709551615ul> const&) const /builds/worker/workspace/obj-build/dom/media/webcodecs/./../../../../../checkouts/gecko/dom/media/webcodecs/VideoFrame.cpp:2038:8
#34 0x7a67f33b1a81 in CallProcessor<(lambda at ./../../../../../checkouts/gecko/dom/media/webcodecs/VideoFrame.cpp:1993:48)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:594:12
#35 0x7a67f33b1a81 in ProcessFixedData<false, (lambda at ./../../../../../checkouts/gecko/dom/media/webcodecs/VideoFrame.cpp:1993:48)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:700:12
#36 0x7a67f33b1a81 in operator()<mozilla::dom::ArrayBufferView_base<&JS_GetArrayBufferViewType> > /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1049:28
#37 0x7a67f33b1a81 in Apply<(lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1048:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:964:1
#38 0x7a67f33b1a81 in Apply<(lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1048:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:978:19
#39 0x7a67f33b1a81 in Apply<(lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1048:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:986:16
#40 0x7a67f33b1a81 in ApplyToTypedArrays<mozilla::dom::MaybeSharedArrayBufferOrMaybeSharedArrayBufferView, (lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1048:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:998:7
#41 0x7a67f33b1a81 in ProcessTypedArraysFixed<mozilla::dom::MaybeSharedArrayBufferOrMaybeSharedArrayBufferView, (lambda at ./../../../../../checkouts/gecko/dom/media/webcodecs/VideoFrame.cpp:1993:48), 0> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1047:10
#42 0x7a67f33b1a81 in mozilla::dom::VideoFrame::CopyTo(mozilla::dom::MaybeSharedArrayBufferOrMaybeSharedArrayBufferView const&, mozilla::dom::VideoFrameCopyToOptions const&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/media/webcodecs/./../../../../../checkouts/gecko/dom/media/webcodecs/VideoFrame.cpp:1993:10
#43 0x7a67f172d50a in copyTo /builds/worker/workspace/obj-build/dom/bindings/./VideoFrameBinding.cpp:1330:60
#44 0x7a67f172d50a in mozilla::dom::VideoFrame_Binding::copyTo_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./VideoFrameBinding.cpp:1344:13
#45 0x7a67f1de3cd6 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/./../../../../checkouts/gecko/dom/bindings/BindingUtils.cpp:3217:13
#46 0x7a67f6b42384 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:498:13
#47 0x7a67f6b41c2f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:594:12
#48 0x7a67f6b53af2 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:666:10
#49 0x7a67f6b53af2 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3280:16
#50 0x7a67f6b41686 in MaybeEnterInterpreterTrampoline(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:392:10
#51 0x7a67f6b412ca in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:468:13
#52 0x7a67f6b41c55 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:626:13
#53 0x7a67f6b4306c in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:693:8
#54 0x7a67f6b441d3 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:815:10
#55 0x7a67f6ed9ddc in CallGetter /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/NativeObject.cpp:2177:12
#56 0x7a67f6ed9ddc in bool GetExistingProperty<(js::AllowGC)1>(JSContext*, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, js::PropertyInfoBase<unsigned int>, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/NativeObject.cpp:2205:12
#57 0x7a67f6eda527 in bool NativeGetPropertyInline<(js::AllowGC)1>(JSContext*, js::MaybeRooted<js::NativeObject*, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::Value, (js::AllowGC)1>::HandleType, js::MaybeRooted<JS::PropertyKey, (js::AllowGC)1>::HandleType, IsNameLookup, js::MaybeRooted<JS::Value, (js::AllowGC)1>::MutableHandleType) /builds/worker/workspace/obj-build/js/src/vm/./../../../../../checkouts/gecko/js/src/vm/NativeObject.cpp:2348:14
#58 0x7a67f59043d3 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/ObjectOperations-inl.h:118:10
#59 0x7a67f5a19607 in js::ResolvePromiseInternal(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>) /builds/worker/workspace/obj-build/js/src/builtin/./../../../../../checkouts/gecko/js/src/builtin/Promise.cpp:1538:7
#60 0x7a67f58f2671 in ResolveOrRejectPromise(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, bool) /builds/worker/workspace/obj-build/js/src/./../../../../checkouts/gecko/js/src/jsapi.cpp:3049:19
#61 0x7a67f41f5949 in mozilla::dom::Promise::MaybeResolve(JSContext*, JS::Handle<JS::Value>) /builds/worker/workspace/obj-build/dom/promise/./../../../../checkouts/gecko/dom/promise/Promise.cpp:439:31
#62 0x7a67f289613a in void mozilla::dom::Promise::MaybeSomething<RefPtr<mozilla::dom::FileSystemDirectoryHandle>&>(RefPtr<mozilla::dom::FileSystemDirectoryHandle>&, void (mozilla::dom::Promise::*)(JSContext*, JS::Handle<JS::Value>)) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Promise.h:481:5
#63 0x7a67f289551a in MaybeResolve<RefPtr<mozilla::dom::FileSystemDirectoryHandle> &> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/Promise.h:98:5
#64 0x7a67f289551a in void mozilla::dom::fs::(anonymous namespace)::ResolveCallback<mozilla::dom::fs::FileSystemGetHandleResponse, RefPtr<mozilla::dom::FileSystemDirectoryHandle> const&, RefPtr<mozilla::dom::FileSystemManager>&>(mozilla::dom::fs::FileSystemGetHandleResponse&&, RefPtr<mozilla::dom::Promise>, RefPtr<mozilla::dom::FileSystemDirectoryHandle> const&, RefPtr<mozilla::dom::FileSystemManager>&) /builds/worker/workspace/obj-build/dom/fs/child/./../../../../../checkouts/gecko/dom/fs/child/FileSystemRequestHandler.cpp:195:13
#65 0x7a67f28965ee in __invoke_impl<void, void (*&)(mozilla::dom::fs::FileSystemGetHandleResponse &&, RefPtr<mozilla::dom::Promise>, const RefPtr<mozilla::dom::FileSystemDirectoryHandle> &, RefPtr<mozilla::dom::FileSystemManager> &), mozilla::dom::fs::FileSystemGetHandleResponse, RefPtr<mozilla::dom::Promise> &, RefPtr<mozilla::dom::FileSystemDirectoryHandle> &, RefPtr<mozilla::dom::FileSystemManager> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
#66 0x7a67f28965ee in __invoke<void (*&)(mozilla::dom::fs::FileSystemGetHandleResponse &&, RefPtr<mozilla::dom::Promise>, const RefPtr<mozilla::dom::FileSystemDirectoryHandle> &, RefPtr<mozilla::dom::FileSystemManager> &), mozilla::dom::fs::FileSystemGetHandleResponse, RefPtr<mozilla::dom::Promise> &, RefPtr<mozilla::dom::FileSystemDirectoryHandle> &, RefPtr<mozilla::dom::FileSystemManager> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:95:14
#67 0x7a67f28965ee in __call<void, mozilla::dom::fs::FileSystemGetHandleResponse &&, 0UL, 1UL, 2UL, 3UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/functional:416:11
#68 0x7a67f28965ee in operator()<mozilla::dom::fs::FileSystemGetHandleResponse, void> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/functional:499:17
#69 0x7a67f28965ee in __invoke_impl<void, std::_Bind<void (*(std::_Placeholder<1>, RefPtr<mozilla::dom::Promise>, RefPtr<mozilla::dom::FileSystemDirectoryHandle>, RefPtr<mozilla::dom::FileSystemManager>))(mozilla::dom::fs::FileSystemGetHandleResponse &&, RefPtr<mozilla::dom::Promise>, const RefPtr<mozilla::dom::FileSystemDirectoryHandle> &, RefPtr<mozilla::dom::FileSystemManager> &)> &, mozilla::dom::fs::FileSystemGetHandleResponse> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:60:14
#70 0x7a67f28965ee in __invoke_r<void, std::_Bind<void (*(std::_Placeholder<1>, RefPtr<mozilla::dom::Promise>, RefPtr<mozilla::dom::FileSystemDirectoryHandle>, RefPtr<mozilla::dom::FileSystemManager>))(mozilla::dom::fs::FileSystemGetHandleResponse &&, RefPtr<mozilla::dom::Promise>, const RefPtr<mozilla::dom::FileSystemDirectoryHandle> &, RefPtr<mozilla::dom::FileSystemManager> &)> &, mozilla::dom::fs::FileSystemGetHandleResponse> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/invoke.h:110:2
#71 0x7a67f28965ee in std::_Function_handler<void (mozilla::dom::fs::FileSystemGetHandleResponse&&), std::_Bind<void (* (std::_Placeholder<1>, RefPtr<mozilla::dom::Promise>, RefPtr<mozilla::dom::FileSystemDirectoryHandle>, RefPtr<mozilla::dom::FileSystemManager>))(mozilla::dom::fs::FileSystemGetHandleResponse&&, RefPtr<mozilla::dom::Promise>, RefPtr<mozilla::dom::FileSystemDirectoryHandle> const&, RefPtr<mozilla::dom::FileSystemManager>&)>>::_M_invoke(std::_Any_data const&, mozilla::dom::fs::FileSystemGetHandleResponse&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/bits/std_function.h:291:9
#72 0x7a67f28f3b74 in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &, mozilla::dom::fs::FileSystemGetHandleResponse> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1046:12
#73 0x7a67f28f3b74 in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, void (mozilla::dom::fs::FileSystemGetHandleResponse &&)> > &, mozilla::dom::fs::FileSystemGetHandleResponse> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1270:37
#74 0x7a67f28f3b74 in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:826:1
#75 0x7a67f28f3b74 in operator() /builds/worker/workspace/obj-build/dom/fs/shared/./../../../ipc/ipdl/PFileSystemManagerChild.cpp:206:13
#76 0x7a67f28f3b74 in decltype(std::forward<mozilla::dom::PFileSystemManagerChild::SendGetFileHandle(mozilla::dom::fs::FileSystemGetHandleRequest const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::dom::fs::FileSystemGetHandleResponse&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&>(fp)(std::forward<IPC::MessageReader*>(fp0))) fu2::abi_400::detail::invocation::invoke<mozilla::dom::PFileSystemManagerChild::SendGetFileHandle(mozilla::dom::fs::FileSystemGetHandleRequest const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::dom::fs::FileSystemGetHandleResponse&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&, IPC::MessageReader*>(mozilla::dom::PFileSystemManagerChild::SendGetFileHandle(mozilla::dom::fs::FileSystemGetHandleRequest const&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::dom::fs::FileSystemGetHandleResponse&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0&, IPC::MessageReader*&&) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:222:10
#77 0x7a67f28f3d44 in fu2::abi_400::detail::type_erasure::invocation_table::function_trait<mozilla::ipc::HasResultCodes::Result (IPC::MessageReader*)>::internal_invoker<fu2::abi_400::detail::type_erasure::box<false, mozilla::dom::PFileSystemManagerChild::SendGetRootHandle(fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::dom::fs::FileSystemGetHandleResponse&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0, std::allocator<mozilla::dom::PFileSystemManagerChild::SendGetRootHandle(fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::dom::fs::FileSystemGetHandleResponse&&)>>&&, fu2::abi_400::detail::function<fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16ul, 8ul>>, fu2::abi_400::detail::property<false, false, void (mozilla::ipc::ResponseRejectReason)>>&&)::$_0>>, false>::invoke(fu2::abi_400::detail::type_erasure::data_accessor*, unsigned long, IPC::MessageReader*) /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:638:1
#78 0x7a67ef3d69c7 in invoke<0UL, fu2::abi_400::detail::type_erasure::data_accessor *, const unsigned long &, IPC::MessageReader *> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1046:12
#79 0x7a67ef3d69c7 in invoke<0UL, fu2::abi_400::detail::type_erasure::erasure<true, fu2::abi_400::detail::config<true, false, fu2::capacity_fixed<16UL, 8UL> >, fu2::abi_400::detail::property<false, false, mozilla::ipc::HasResultCodes::Result (IPC::MessageReader *)> > &, IPC::MessageReader *> /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:1270:37
#80 0x7a67ef3d69c7 in operator() /builds/worker/workspace/obj-build/dist/include/function2/function2.hpp:826:1
#81 0x7a67ef3d69c7 in mozilla::ipc::IPDLAsyncReturnsCallbacks::GotReply(mozilla::ipc::IProtocol*, IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/ProtocolUtils.cpp:907:17
#82 0x7a67f28ef055 in mozilla::dom::PFileSystemManagerChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/dom/fs/shared/./../../../ipc/ipdl/PFileSystemManagerChild.cpp:0:13
#83 0x7a67ef3bcbee in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1797:25
#84 0x7a67ef3ba164 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1723:9
#85 0x7a67ef3bab77 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1512:3
#86 0x7a67ef3bbb59 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1614:14
#87 0x7a67ef29ec09 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1173:16
#88 0x7a67ef2a478f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:472:10
#89 0x7a67f415faa2 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /builds/worker/workspace/obj-build/dom/workers/./../../../../checkouts/gecko/dom/workers/WorkerPrivate.cpp:4062:7
#90 0x7a67f41424e2 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /builds/worker/workspace/obj-build/dom/workers/./../../../../checkouts/gecko/dom/workers/RuntimeService.cpp:2310:42
#91 0x7a67ef29ec09 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1173:16
#92 0x7a67ef2a478f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:472:10
#93 0x7a67ef3c3c78 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:297:20
#94 0x7a67ef31a4c1 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#95 0x7a67ef31a4c1 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#96 0x7a67ef29a7ba in nsThread::ThreadFunc(void*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:374:10
#97 0x7a68009003ac in _pt_root /builds/worker/workspace/obj-build/config/external/nspr/pr/./../../../../../../checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:190:3
#98 0x7a680099cac2 in start_thread ./nptl/pthread_create.c:442:8
Flags: in-testsuite?

Verified bug as reproducible on mozilla-central 20260603204655-14f381ab3699.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 8cf3b09b71da83703e0b0285ff6d81b01ddc3c1d (20250605212508)
End: 1f396df9f27ea8e040163abdc72d06c35d410257 (20260413155321)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Whiteboard: [bugmon:bisected,confirmed]

Got a crash from the testcase on nightly: https://crash-stats.mozilla.org/report/index/1982cff7-f7c1-45dd-9afb-f07c10260604#tab-bugzilla

crash in js--> marking as s-s

Group: core-security
Crash Signature: [@ js::ArrayBufferObject::ensureNonInline ]
Group: core-security → javascript-core-security
Flags: needinfo?(sphink)
Blocks: js-lang, sm-security
Severity: -- → S3
Priority: -- → P3

The rating assigned by our bug rating tool (currently under development) is:

Rating: Not a security issue

Explanation: This is a MOZ_DIAGNOSTIC_ASSERT failure that only fires in debug/fuzzing builds. The brittleMode mechanism is a purely diagnostic tool (set via JS::SetBrittleMode for development diagnostics, not active in production). In release builds, when isLengthPinned() is true, the function properly reports a JS error and returns false, no crash, no memory corruption. The underlying issue is a logic error in WebCodecs (VideoFrame) code that calls ensureNonInline on a pinned-length ArrayBuffer, but the error path is handled gracefully in all build configurations. There is no demonstrated exploitable condition.

sfink: Is this accurate? Please remove the sec-rating if you agree (or ni? me and I can).

Group: javascript-core-security

I agree with the security rating. I want to look into this, though, since it seems like it's something that maybe should be throwing a meaningful error much sooner.

CC'ing mgaudet because it turns out to be an instance of the Promise.then hazard that he's been working on fixing at a spec level, iiuc.

The problem is that there's a ProcessTypedArraysFixed(buffer, []() { ... }) that pins buffer's memory in place and runs the lambda. In this case, the lambda can resolve a promise, which looks up "then" on the promise, which runs a getter. This getter can do anything it wants, including things that again call ProcessTypedArraysFixed on the same buffer. Which (safely) fails because it is already pinned.

The code is robust against this problem, but it shouldn't need to be. Really the promise shouldn't be resolved until the outer operation completes its copy operation.

Assignee: nobody → sphink
Status: NEW → ASSIGNED
Attachment #9603658 - Attachment description: WIP: Bug 2044843 - Avoid Promise resolution inside VideoFrame::CopyTo to prevent nested pinning → Bug 2044843 - Avoid Promise resolution inside VideoFrame::CopyTo to prevent nested pinning
Attachment #9603659 - Attachment description: WIP: Bug 2044843 - Defensive fix against reentrant ProcessFixedData in ImageDecoder::Initialize → Bug 2044843 - Defensive fix against reentrant ProcessFixedData in ImageDecoder::Initialize
Attachment #9603660 - Attachment description: WIP: Bug 2044843 - In release builds, allow re-pinning an already-pinned ArrayBufferOrView. Safe because it will have been moved out of line. → Bug 2044843 - In release builds, allow re-pinning an already-pinned ArrayBufferOrView. Safe because it will have been moved out of line.

There are some r+ patches which didn't land and no activity in this bug for 1 week.
:sfink, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit BugBot documentation.

Flags: needinfo?(sphink)
Flags: needinfo?(afarre)
Pushed by sfink@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/8694d5f5ffe5 https://hg.mozilla.org/integration/autoland/rev/2b82ec85f766 Avoid Promise resolution inside VideoFrame::CopyTo to prevent nested pinning r=media-playback-reviewers,padenot https://github.com/mozilla-firefox/firefox/commit/8d674dec3f20 https://hg.mozilla.org/integration/autoland/rev/ed39deb5dec5 Defensive fix against reentrant ProcessFixedData in ImageDecoder::Initialize r=media-playback-reviewers,padenot https://github.com/mozilla-firefox/firefox/commit/3e9110371851 https://hg.mozilla.org/integration/autoland/rev/838bf23a766e In release builds, allow re-pinning an already-pinned ArrayBufferOrView. Safe because it will have been moved out of line. r=farre,smaug https://github.com/mozilla-firefox/firefox/commit/732939b9a063 https://hg.mozilla.org/integration/autoland/rev/63d3c11eb5bb apply code formatting via Lando
Flags: needinfo?(sphink)
Flags: needinfo?(afarre)

Verified bug as fixed on rev mozilla-central 20260721094648-fec71d8cf2bd.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
status-firefox155: fixed → verified
Keywords: bugmon

Since nightly and release are affected, beta will likely be affected too.
For more information, please visit BugBot documentation.

status-firefox154: --- → affected
Flags: needinfo?(sphink)

The patch landed in nightly and beta is affected.
:sfink, is this bug important enough to require an uplift?

For more information, please visit BugBot documentation.

Flags: needinfo?(sphink)
See Also: → 2057143
status-firefox153: affected → wontfix
status-firefox-esr140: --- → wontfix
status-firefox-esr153: --- → affected
Flags: in-testsuite? → in-testsuite+

I'd like to get this in the esr just to avoid future conflicts, but I don't feel much need to uplift to beta -- the metronome will tick that one away soon enough.

status-firefox154: affected → wontfix
Flags: needinfo?(sphink)
Attachment #9624479 - Flags: approval-mozilla-esr153?
Attachment #9624480 - Flags: approval-mozilla-esr153?
Attachment #9624481 - Flags: approval-mozilla-esr153?

firefox-esr153 Uplift Approval Request

  • User impact if declined/Reason for urgency: No user impact. I'd like to uplift this just because I could imagine people needing to backport future fixes in these regions of code, and this could cause nuisance conflicts.
  • Code covered by automated testing?: yes
  • Fix verified in Nightly?: yes
  • Needs manual QE testing?: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: At the least there's a risk of it being a nuisance get the patch to apply properly. This is somewhat fiddly code, so I don't think it's out of the question that it could accidentally cause unintended behavioral differences, but assuming it's all correct it's really just a refactoring that should change no behavior at all. And if it did break something, I would expect tests to find that pretty easily.
  • String changes made/needed?: none
  • Is Android affected?: yes
Attachment #9624481 - Flags: approval-mozilla-esr153? → approval-mozilla-esr153+
Attachment #9624479 - Flags: approval-mozilla-esr153? → approval-mozilla-esr153+
Attachment #9624480 - Flags: approval-mozilla-esr153? → approval-mozilla-esr153+
QA Whiteboard: [qa-triage-done-c157/b156]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: