2048353 - Assertion failure: mRawPtr != nullptr (You can't dereference a NULL RefPtr with operator->().), at /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:341

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect, P2)

Description

[Tyson Smith [:tsmith]]

Found while fuzzing m-c 20260418-cb6a766e9c14 (--enable-debug --enable-fuzzing)

The available testcase has been difficult to reduce. A Pernosco session is available here: https://pernos.co/debug/yCCpyORj_8AicK7g6IHPQw/index.html

Assertion failure: mRawPtr != nullptr (You can't dereference a NULL RefPtr with operator->().), at /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:341

#0 0x7fffe9945d26 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:235:3
#1 0x7fffe9945d26 in operator-> /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:340:5
#2 0x7fffe9945d26 in mozilla::dom::CookieStoreNotificationWatcherWrapper::ResolvePromiseWhenNotified(nsID const&, mozilla::dom::Promise*)::PromiseResolver::Run() /builds/worker/workspace/obj-build/dom/cookiestore/./../../../../checkouts/gecko/dom/cookiestore/CookieStoreNotificationWatcherWrapper.cpp:102:7
#3 0x7fffe5b08189 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1173:16
#4 0x7fffe5b0dc2f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465:10
#5 0x7fffeb439f04 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /builds/worker/workspace/obj-build/dom/workers/./../../../../checkouts/gecko/dom/workers/WorkerPrivate.cpp:3967:7
#6 0x7fffeb41d292 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /builds/worker/workspace/obj-build/dom/workers/./../../../../checkouts/gecko/dom/workers/RuntimeService.cpp:2295:42
#7 0x7fffe5b08189 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1173:16
#8 0x7fffe5b0dc2f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465:10
#9 0x7fffe66e8fb9 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:327:5
#10 0x7fffe66408d1 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
#11 0x7fffe66408d1 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
#12 0x7fffe5b03c5a in nsThread::ThreadFunc(void*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:374:10
#13 0x7ffff79ea41c in _pt_root /builds/worker/workspace/obj-build/config/external/nspr/pr/./../../../../../../checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:190:3
#14 0x7ffff7a86ac2 in start_thread ./nptl/pthread_create.c:442:8

Comment 1

[Andrea Marchesini [:baku]]

Attachment: Bug 2048353 - Improve worker shutdown support in CookieStoreNotificationWatcher

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/74e007f613c1
https://hg.mozilla.org/integration/autoland/rev/c73c5600a962
Improve worker shutdown support in CookieStoreNotificationWatcher r=manuel

Comment 3

[agoloman]

https://hg.mozilla.org/mozilla-central/rev/c73c5600a962

Comment 4

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:baku, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox154 to wontfix.

For more information, please visit BugBot documentation.

Comment 5

[Andrea Marchesini [:baku]]

Attachment: Bug 2048353 - Improve worker shutdown support in CookieStoreNotificationWatcher

Original Revision: https://phabricator.services.mozilla.com/D311765

Comment 6

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: A rare crash can occur in the content process.
• Code covered by automated testing?: no
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: Extremely rare to reproduce, the fix is a variable nullptr check.
• String changes made/needed?: n/a
• Is Android affected?: yes

Comment 7

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/66132894d9fe
https://hg.mozilla.org/releases/mozilla-beta/rev/0f6d2e59b227

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Please add an ESR153 uplift request also.

Comment 9

[Phabricator Automation]

firefox-esr153 Uplift Approval Request

• User impact if declined/Reason for urgency: A rare crash can occur
• Code covered by automated testing?: no
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: This is a null if-stmt check to prevent a crash. It's safe.
• String changes made/needed?: no
• Is Android affected?: yes

Comment 10

[Andrea Marchesini [:baku]]

Attachment: Bug 2048353 - Improve worker shutdown support in CookieStoreNotificationWatcher a=diannaS

Original Revision: https://phabricator.services.mozilla.com/D311765

Comment 11

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr153/rev/a2b2340d1e7b