Open Bug 1700446 Opened 4 years ago Updated 3 years ago

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Could not get main thread; leaking an object!), at src/xpcom/threads/nsProxyRelease.h:168

Categories

(Core :: Graphics: ImageLib, defect, P3)

defect

Tracking

()

Tracking Status
firefox88 --- wontfix
firefox89 --- wontfix
firefox90 --- wontfix
firefox91 --- fix-optional

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

Attached file testcase.html (deleted) —

Found while fuzzing m-c 20210122-5dc361e890c3 (--enable-debug --enable-fuzzing)

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Could not get main thread; leaking an object!), at src/xpcom/threads/nsProxyRelease.h:168

#0 0x7f3cadfb1267 in NS_ReleaseOnMainThread<mozilla::image::Image> src/xpcom/threads/nsProxyRelease.h:168:7
#1 0x7f3cadfb1267 in mozilla::image::SurfaceCache::ReleaseImageOnMainThread(already_AddRefed<mozilla::image::Image>, bool) src/image/SurfaceCache.cpp:1829:5
#2 0x7f3cadf6d769 in DropImageReference src/image/DecodedSurfaceProvider.cpp:46:3
#3 0x7f3cadf6d769 in mozilla::image::DecodedSurfaceProvider::FinishDecoding() src/image/DecodedSurfaceProvider.cpp:200:3
#4 0x7f3cadf6cee8 in mozilla::image::DecodedSurfaceProvider::Run() src/image/DecodedSurfaceProvider.cpp:129:5
#5 0x7f3cadf858b3 in mozilla::image::DecodingTask::Run() src/image/DecodePool.cpp:143:12
#6 0x7f3cac61e053 in mozilla::TaskController::RunPoolThread() src/xpcom/threads/TaskController.cpp:259:33
#7 0x7f3cc15ebcdb in _pt_root src/nsprpub/pr/src/pthreads/ptthread.c:201:5
#8 0x7f3cc1c6e608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
#9 0x7f3cc1837292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Flags: in-testsuite?
Attached image include.jpg (deleted) —

A Pernosco session is available here: https://pernos.co/debug/juqgvzoZAJufmDGUxCQgIw/index.html

The assert is happening during shutdown, so doesn't seem too bad.

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210323214359-ea38e210ba4d.
The bug appears to have been introduced in the following build range:

Start: ab6218dd84f501adbdd38817c71ee6ffee87ee63 (20201027154103)
End: 6e193e6ff95d1ed585ff20566ed5e03b0a94fcf0 (20201027185506)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=ab6218dd84f501adbdd38817c71ee6ffee87ee63&tochange=6e193e6ff95d1ed585ff20566ed5e03b0a94fcf0

Whiteboard: [bugmon:bisected,confirmed]
Regressed by: 1672597
Has Regression Range: --- → yes
Severity: -- → S3
Priority: -- → P3

Bugmon Analysis
Failed to bisect testcase (End build crashes!):

Start: 5dc361e890c3b80e8ed645d93461520aa1fbef30 (20210122212755)
End: 2fc1d893c8517acd5c0b6fd6cd83fa897876bd01 (20210817160311)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: