Log from CheckedUnsafePtr ``` CheckedUnsafePtr [0x1082406c8] Location of creation: WebTaskSchedulerWorker, WebTaskSchedulerWorker.cpp:22 Stack of creation: #01: mozilla::dom::WebTaskSchedulerWorker::WebTaskSchedulerWorker(mozilla::dom::WorkerPrivate*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x310be6c] #02: mozilla::dom::WebTaskScheduler::CreateForWorker(mozilla::dom::WorkerPrivate*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x310af54] #03: mozilla::dom::WorkerGlobalScope::Scheduler()[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2e04a70] #04: mozilla::dom::WorkerGlobalScope_Binding::get_scheduler(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x1a10420] #05: bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x1d35a8c] #06: js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b8f00] #07: js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b96a4] #08: js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b9d8c] #09: js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x44d83d4] #10: js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43c8d38] #11: js::Interpret(JSContext*, js::RunState&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43bfad8] #12: js::RunScript(JSContext*, js::RunState&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b8b44] #13: js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b9160] #14: js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b96a4] #15: JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x4441b68] #16: mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x1b6000c] #17: mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20f1b00] #18: mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20d72a8] #19: mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20d7f70] #20: mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20d78b8] #21: mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20cf6e4] #22: mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20d166c] #23: mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20b1340] #24: mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20ddd10] #25: mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2dd6c34] #26: mozilla::dom::WorkerRunnable::Run()[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2e00ce8] #27: nsThread::ProcessNextEvent(bool, bool*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x29e130] #28: NS_ProcessNextEvent(nsIThread*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2a2104] #29: mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2df6b3c] #30: mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run()[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2de7308] #31: nsThread::ProcessNextEvent(bool, bool*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x29e130] #32: NS_ProcessNextEvent(nsIThread*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2a2104] #33: mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x99b724] #34: MessageLoop::Run()[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x945058] #35: nsThread::ThreadFunc(void*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x29ba40] #36: _pt_root[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/dist/Nightly.app/Contents/MacOS/libnss3.dylib +0x14b7d0] #37: _pthread_start[/usr/lib/system/libsystem_pthread.dylib +0x7034] Stack of last assignment ``` The case shows a race condition between WorkerPrivate releasing and Cycle-Colloect a WorkerGlobalScope. The CheckedUnsafePtr holder is [WebTaskSchedulerWorker](https://searchfox.org/mozilla-central/rev/f465027ef4d334dbc9ad270718c8a5e8045e7a2b/dom/webscheduling/WebTaskSchedulerWorker.h#43) which is (strong referenced by WorkerGlobalScope](https://searchfox.org/mozilla-central/rev/f465027ef4d334dbc9ad270718c8a5e8045e7a2b/dom/workers/WorkerScope.h#378). And we only release the strong reference while WorkerGlobalScope is released. So if WorkerGlobalScope is cycle-collected after WorkerPrivate released, we hit the CheckedUnsafePtr complaining. I guess we can unlink/nullify WorkerGlobalScope::WebTaskSchedulerWorker earlier at (where we are closing/canceling the worker)[https://searchfox.org/mozilla-central/rev/f465027ef4d334dbc9ad270718c8a5e8045e7a2b/dom/workers/WorkerPrivate.cpp#3299]. Olli, how do you think about it ?
Bug 1874080 Comment 11 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Log from CheckedUnsafePtr ``` CheckedUnsafePtr [0x1082406c8] Location of creation: WebTaskSchedulerWorker, WebTaskSchedulerWorker.cpp:22 Stack of creation: #01: mozilla::dom::WebTaskSchedulerWorker::WebTaskSchedulerWorker(mozilla::dom::WorkerPrivate*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x310be6c] #02: mozilla::dom::WebTaskScheduler::CreateForWorker(mozilla::dom::WorkerPrivate*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x310af54] #03: mozilla::dom::WorkerGlobalScope::Scheduler()[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2e04a70] #04: mozilla::dom::WorkerGlobalScope_Binding::get_scheduler(JSContext*, JS::Handle<JSObject*>, void*, JSJitGetterCallArgs)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x1a10420] #05: bool mozilla::dom::binding_detail::GenericGetter<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x1d35a8c] #06: js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b8f00] #07: js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b96a4] #08: js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b9d8c] #09: js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x44d83d4] #10: js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43c8d38] #11: js::Interpret(JSContext*, js::RunState&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43bfad8] #12: js::RunScript(JSContext*, js::RunState&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b8b44] #13: js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b9160] #14: js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x43b96a4] #15: JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x4441b68] #16: mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x1b6000c] #17: mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20f1b00] #18: mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20d72a8] #19: mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20d7f70] #20: mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20d78b8] #21: mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20cf6e4] #22: mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20d166c] #23: mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20b1340] #24: mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x20ddd10] #25: mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2dd6c34] #26: mozilla::dom::WorkerRunnable::Run()[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2e00ce8] #27: nsThread::ProcessNextEvent(bool, bool*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x29e130] #28: NS_ProcessNextEvent(nsIThread*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2a2104] #29: mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2df6b3c] #30: mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run()[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2de7308] #31: nsThread::ProcessNextEvent(bool, bool*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x29e130] #32: NS_ProcessNextEvent(nsIThread*, bool)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x2a2104] #33: mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x99b724] #34: MessageLoop::Run()[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x945058] #35: nsThread::ThreadFunc(void*)[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/toolkit/library/build/XUL +0x29ba40] #36: _pt_root[/Users/echuang/Firefox/mozilla-central/obj-aarch64-apple-darwin/dist/Nightly.app/Contents/MacOS/libnss3.dylib +0x14b7d0] #37: _pthread_start[/usr/lib/system/libsystem_pthread.dylib +0x7034] Stack of last assignment ``` The case shows a race condition between WorkerPrivate releasing and Cycle-Colloect a WorkerGlobalScope. The CheckedUnsafePtr holder is [WebTaskSchedulerWorker](https://searchfox.org/mozilla-central/rev/f465027ef4d334dbc9ad270718c8a5e8045e7a2b/dom/webscheduling/WebTaskSchedulerWorker.h#43) which is [strong referenced by WorkerGlobalScope](https://searchfox.org/mozilla-central/rev/f465027ef4d334dbc9ad270718c8a5e8045e7a2b/dom/workers/WorkerScope.h#378). And we only release the strong reference while WorkerGlobalScope is released. So if WorkerGlobalScope is cycle-collected after WorkerPrivate released, we hit the CheckedUnsafePtr complaining. I guess we can unlink/nullify WorkerGlobalScope::WebTaskSchedulerWorker earlier at [where we are closing/canceling the worker](https://searchfox.org/mozilla-central/rev/f465027ef4d334dbc9ad270718c8a5e8045e7a2b/dom/workers/WorkerPrivate.cpp#3299). Olli, how do you think about it ?