1329668 - Crash in mozilla::dom::cache::CacheStorage::Delete

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Ben Kelly [:bkelly, not reviewing]]

This bug was filed from the Socorro interface and is 
report bp-53d9068a-3025-4bdc-9769-2d2422170109.
=============================================================

Fair number of crashes in the worker ScriptLoader at address 0x2c when using CacheStorage.  Guessing this is a ScriptLoader problem and not a CacheStorage problem.

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

This is happening because we try to delete the Cache when we cancel, but we may not be fully initialized if the cancel is initiated here:

https://dxr.mozilla.org/mozilla-central/source/dom/workers/ScriptLoader.cpp#601

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

Attachment: Handle partial initialized when ScriptLoader is canceled. r=baku

Andrea, this handles the case where we cancel worker script loading here:

https://dxr.mozilla.org/mozilla-central/source/dom/workers/ScriptLoader.cpp#601

Depending on when RunInternal() returns an error we may not have initialized the mCacheStorage yet.  So we cannot unconditionally use it in cancellation.

Comment 3

[Ben Kelly [:bkelly, not reviewing]]

BTW, this accounts for 70% of the crashes related to dom::cache between Dec 1 and Jan 9.  About 500 crashes.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8bb63d1c87d7
Handle partial initialized when ScriptLoader is canceled. r=baku

Comment 5

[Ben Kelly [:bkelly, not reviewing]]

Comment on attachment 8825095 [details] [diff] [review]
Handle partial initialized when ScriptLoader is canceled. r=baku

Approval Request Comment
[Feature/Bug causing the regression]: Service workers
[User impact if declined]: About 200 crashes per week in release channel.
[Is this code covered by automated tests?]: Yes, but it does not trigger this corner case.
[Has the fix been verified in Nightly?]: Its very racy, so we have not been able to reproduce manually.
[Needs manual test from QE? If yes, steps to reproduce]: None
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: No
[Why is the change risky/not risky?]: Its simply an extra nullptr check.  Its very low risk.
[String changes made/needed]: None

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/8bb63d1c87d7

Comment 7

[Gerry Chang [:gchang]]

Comment on attachment 8825095 [details] [diff] [review]
Handle partial initialized when ScriptLoader is canceled. r=baku

Fix a crash. Beta51+ & Aurora52+. Should be in 51 beta 14.

Comment 8

[Ben Kelly [:bkelly, not reviewing]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/1cc6ff344a7a94e7f9a43ef7f51d16555933b6bc

Comment 9

[Ben Kelly [:bkelly, not reviewing]]

https://hg.mozilla.org/releases/mozilla-beta/rev/9cec46d51aa3fa090c5375a8b1a7e3dd013a6a86