Testcase found while fuzzing mozilla-central rev 32d6a3f1f83c (built with --enable-address-sanitizer).

Testcase produces the following assertion on debug builds:
Hit MOZ_CRASH(Failed to make IPC call to IsWindowSupportingWebVR) at /builds/worker/checkouts/gecko/dom/base/Navigator.cpp:1508

=================================================================
==12191==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f397b73275d bp 0x7fff10597fe0 sp 0x7fff10597fd0 T0)
==12191==The signal is caused by a WRITE memory access.
==12191==Hint: address points to the zero page.
    #0 0x7f397b73275c in mozilla::MozPromise<bool, mozilla::ipc::ResponseRejectReason, true>::ThenValue<mozilla::dom::Navigator::GetVRDisplays(mozilla::ErrorResult&)::$_2, mozilla::dom::Navigator::GetVRDisplays(mozilla::ErrorResult&)::$_3>::DoResolveOrRejectInternal(mozilla::MozPromise<bool, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h
    #1 0x7f3978f61551 in mozilla::MozPromise<bool, mozilla::ipc::ResponseRejectReason, true>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:403:21
    #2 0x7f39785438ce in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1220:14
    #3 0x7f397854e35c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:481:10
    #4 0x7f39795bde6a in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #5 0x7f39794eafe7 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:315:10
    #6 0x7f39794eafe7 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:308:3
    #7 0x7f39794eafe7 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:290:3
    #8 0x7f397f5e0ff8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #9 0x7f3982d87cb6 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:911:20
    #10 0x7f39794eafe7 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:315:10
    #11 0x7f39794eafe7 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:308:3
    #12 0x7f39794eafe7 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:290:3
    #13 0x7f3982d8736a in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:742:34
    #14 0x56478ebe020f in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #15 0x56478ebe020f in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
    #16 0x7f3998bf2b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #17 0x56478eb35bbc in _start (/home/user/builds/mc-asan/firefox+0x9ebbc)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h in mozilla::MozPromise<bool, mozilla::ipc::ResponseRejectReason, true>::ThenValue<mozilla::dom::Navigator::GetVRDisplays(mozilla::ErrorResult&)::$_2, mozilla::dom::Navigator::GetVRDisplays(mozilla::ErrorResult&)::$_3>::DoResolveOrRejectInternal(mozilla::MozPromise<bool, mozilla::ipc::ResponseRejectReason, true>::ResolveOrRejectValue&)
==12191==ABORTING

The previously attached testcase may require a few attempts in order to reproduce. This testcase should be more reliable.

Bugbug thinks this bug is a regression, but please revert this change in case of error.

:thomasmo, it looks like this is a regression caused by Bug 1589913. Any thought?

It seems like it could be caused by it, but it's not obvious to me.
Assigning to myself for now and will start investigating

...::ErrorResult&)::$_2, mozilla::dom:

This change fixes a failfast where an outstanding permissions dialog can cause an IPC call to fail while determining whether to enumerate VR displays. This change now rejects the promise in that case.

https://hg.mozilla.org/mozilla-central/rev/96eedd640ac4