Closed Bug 1797096 Opened 2 years ago Closed 2 years ago

Assertion failure: !Exists(), at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1456

Categories

(Core :: DOM: File, defect, P2)

Product:
Core
Component:
DOM: File
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1751681

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 3 open bugs)

Details

(Keywords: testcase, Whiteboard: [bugmon:confirm])

Attachments

(1 file)

Testcase
(deleted), text/plain
Details

Testcase found while fuzzing mozilla-central rev d1982cee06ca (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build d1982cee06ca --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !Exists(), at /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1456

    =================================================================
    ==141377==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f3359b111ac bp 0x7f333d65e910 sp 0x7f333d65e660 T20)
    ==141377==The signal is caused by a WRITE memory access.
    ==141377==Hint: address points to the zero page.
        #0 0x7f3359b111ac in Track /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1456:5
        #1 0x7f3359b111ac in Track /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1014:22
        #2 0x7f3359b111ac in mozilla::dom::FileSystemManager::BeginRequest(std::function<void (RefPtr<mozilla::dom::FileSystemManagerChild> const&)>&&, std::function<void (nsresult)>&&) /dom/fs/api/FileSystemManager.cpp:114:9
        #3 0x7f3359b1a9ed in mozilla::dom::fs::FileSystemRequestHandler::GetRootHandle(RefPtr<mozilla::dom::FileSystemManager>, RefPtr<mozilla::dom::Promise>, mozilla::ErrorResult&) /dom/fs/child/FileSystemRequestHandler.cpp:320:13
        #4 0x7f3359b1204d in mozilla::dom::FileSystemManager::GetDirectory(mozilla::ErrorResult&) /dom/fs/api/FileSystemManager.cpp:127:20
        #5 0x7f335b17b2dd in mozilla::dom::StorageManager::GetDirectory(mozilla::ErrorResult&) /dom/quota/StorageManager.cpp:766:30
        #6 0x7f335812c6b7 in mozilla::dom::StorageManager_Binding::getDirectory(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/StorageManagerBinding.cpp:310:60
        #7 0x7f335812c549 in mozilla::dom::StorageManager_Binding::getDirectory_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/StorageManagerBinding.cpp:326:13
        #8 0x7f3358e8b861 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3287:13
        #9 0x7f33637273b3 in CallJSNative /js/src/vm/Interpreter.cpp:459:13
        #10 0x7f33637273b3 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:547:12
        #11 0x7f3363715d39 in InternalCall /js/src/vm/Interpreter.cpp:614:10
        #12 0x7f3363715d39 in CallFromStack /js/src/vm/Interpreter.cpp:619:10
        #13 0x7f3363715d39 in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3375:16
        #14 0x7f33636fb33e in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:431:13
        #15 0x7f33637274d5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:579:13
        #16 0x7f3363728f7e in InternalCall /js/src/vm/Interpreter.cpp:614:10
        #17 0x7f3363728f7e in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:646:8
        #18 0x7f3361d18415 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #19 0x7f3358a801ef in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventHandlerBinding.cpp:65:37
        #20 0x7f33599535a3 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
        #21 0x7f3359951b18 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /dom/events/JSEventHandler.cpp:201:12
        #22 0x7f3359917688 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /dom/events/EventListenerManager.cpp:1316:22
        #23 0x7f3359918bf2 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1506:17
        #24 0x7f3359906d2e in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:348:17
        #25 0x7f3359905591 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:550:16
        #26 0x7f3359909775 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1119:11
        #27 0x7f335990f0f1 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp
        #28 0x7f33598b839d in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/events/DOMEventTargetHelper.cpp:176:17
        #29 0x7f3359925f93 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&) /dom/events/EventTarget.cpp:180:13
        #30 0x7f335bd1d68c in mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool) /dom/workers/MessageEventRunnable.cpp:104:12
        #31 0x7f335bd896ce in mozilla::dom::WorkerRunnable::Run() /dom/workers/WorkerRunnable.cpp:377:12
        #32 0x7f3353b6138e in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1198:16
        #33 0x7f3353b6b614 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #34 0x7f335bd7186c in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3205:7
        #35 0x7f335bd4812e in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2042:42
        #36 0x7f3353b6138e in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1198:16
        #37 0x7f3353b6b614 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #38 0x7f3355318cd5 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:300:20
        #39 0x7f33551946a1 in RunInternal /ipc/chromium/src/base/message_loop.cc:381:10
        #40 0x7f33551946a1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #41 0x7f33551946a1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #42 0x7f3353b584e8 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:383:10
        #43 0x7f337bc8eb7e in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #44 0x7f337c10ab42 in start_thread nptl/./nptl/pthread_create.c:442:8
        #45 0x7f337c19c9ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1456:5 in Track
    Thread T20 created by T0 (Isolated Web Co) here:
        #0 0x555f30c2f49c in __interceptor_pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:208:3
        #1 0x7f337bc7ec2c in _PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:458:14
        #2 0x7f337bc6ffce in PR_CreateThread /nsprpub/pr/src/pthreads/ptthread.c:533:12
        #3 0x7f3353b5b455 in nsThread::Init(nsTSubstring<char> const&) /xpcom/threads/nsThread.cpp:617:18
        #4 0x7f335bd9807a in mozilla::dom::WorkerThread::Create(mozilla::dom::WorkerThreadFriendKey const&) /dom/workers/WorkerThread.cpp:102:7
        #5 0x7f335bd22395 in mozilla::dom::workerinternals::RuntimeService::ScheduleWorker(mozilla::dom::WorkerPrivate&) /dom/workers/RuntimeService.cpp:1323:37
        #6 0x7f335bd2141b in mozilla::dom::workerinternals::RuntimeService::RegisterWorker(mozilla::dom::WorkerPrivate&) /dom/workers/RuntimeService.cpp:1205:19
        #7 0x7f335bd6bcd7 in mozilla::dom::WorkerPrivate::Constructor(JSContext*, nsTSubstring<char16_t> const&, bool, mozilla::dom::WorkerKind, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, mozilla::dom::WorkerLoadInfo*, mozilla::ErrorResult&, nsTString<char16_t>) /dom/workers/WorkerPrivate.cpp:2588:24
        #8 0x7f335bd32395 in mozilla::dom::Worker::Constructor(mozilla::dom::GlobalObject const&, nsTSubstring<char16_t> const&, mozilla::dom::WorkerOptions const&, mozilla::ErrorResult&) /dom/workers/Worker.cpp:43:41
        #9 0x7f33586c60d4 in mozilla::dom::Worker_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/WorkerBinding.cpp:1107:52
        #10 0x7f3363729ca7 in CallJSNative /js/src/vm/Interpreter.cpp:459:13
        #11 0x7f3363729ca7 in CallJSNativeConstructor /js/src/vm/Interpreter.cpp:475:8
        #12 0x7f3363729ca7 in InternalConstruct(JSContext*, js::AnyConstructArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:694:10
        #13 0x7f3363715cde in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3360:16
        #14 0x7f33636fb33e in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:431:13
        #15 0x7f33637274d5 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:579:13
        #16 0x7f3363728f7e in InternalCall /js/src/vm/Interpreter.cpp:614:10
        #17 0x7f3363728f7e in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:646:8
        #18 0x7f3361d18415 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #19 0x7f3358a84fd9 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:62:8
        #20 0x7f3359917b34 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
        #21 0x7f33599175f0 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /dom/events/EventListenerManager.cpp:1310:43
        #22 0x7f3359918bab in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /dom/events/EventListenerManager.cpp:1506:17
        #23 0x7f3359906d2e in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:348:17
        #24 0x7f3359905591 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /dom/events/EventDispatcher.cpp:550:16
        #25 0x7f3359909775 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /dom/events/EventDispatcher.cpp:1119:11
        #26 0x7f335990f0f1 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /dom/events/EventDispatcher.cpp
        #27 0x7f33571b8024 in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /dom/base/nsINode.cpp:1373:17
        #28 0x7f3356aae1cf in nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch) /dom/base/nsContentUtils.cpp:4499:28
        #29 0x7f3356aade96 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*) /dom/base/nsContentUtils.cpp:4469:10
        #30 0x7f3356e02cb3 in mozilla::dom::Document::DispatchContentLoadedEvents() /dom/base/Document.cpp:7843:3
        #31 0x7f3356efe1bd in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1147:12
        #32 0x7f3356efe1bd in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1153:12
        #33 0x7f3356efe1bd in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1200:13
        #34 0x7f3353b2375f in mozilla::SchedulerGroup::Runnable::Run() /xpcom/threads/SchedulerGroup.cpp:140:20
        #35 0x7f3353b37362 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:538:16
        #36 0x7f3353b2e2c7 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:851:26
        #37 0x7f3353b2b558 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:683:15
        #38 0x7f3353b2bc80 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:461:36
        #39 0x7f3353b3d911 in operator() /xpcom/threads/TaskController.cpp:187:37
        #40 0x7f3353b3d911 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #41 0x7f3353b60b68 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1204:16
        #42 0x7f3353b6b614 in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #43 0x7f335531762f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #44 0x7f33551946a1 in RunInternal /ipc/chromium/src/base/message_loop.cc:381:10
        #45 0x7f33551946a1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #46 0x7f33551946a1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #47 0x7f335c67bd97 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:150:27
        #48 0x7f3361841d87 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:880:20
        #49 0x7f33551946a1 in RunInternal /ipc/chromium/src/base/message_loop.cc:381:10
        #50 0x7f33551946a1 in RunHandler /ipc/chromium/src/base/message_loop.cc:374:3
        #51 0x7f33551946a1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:356:3
        #52 0x7f3361840e73 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:739:34
        #53 0x555f30c836b5 in content_process_main(mozilla::Bootstrap*, int, char**) /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #54 0x555f30c83b07 in main /browser/app/nsBrowserApp.cpp:357:18
        #55 0x7f337c09fd8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    
    ==141377==ABORTING
Attached file Testcase (deleted) —
Blocks: OPFS
Severity: -- → S3
Priority: -- → P2

This is fixed with the patches for postMessage etc applied

Status: NEW → RESOLVED
Closed: 2 years ago
Duplicate of bug: 1751681
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: