Closed Bug 1268849 Opened 3 years ago Closed 3 years ago

crash in nsPIDOMWindowOuter::GetServiceWorkersTestingEnabled

Categories

(Core :: DOM: Service Workers, defect, critical)

48 Branch
Unspecified
Windows
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla49
Tracking Status
firefox46 --- unaffected
firefox47 --- unaffected
firefox48 --- fixed
firefox49 --- fixed

People

(Reporter: marco, Assigned: bkelly)

References

Details

(Keywords: crash, regression, Whiteboard: btpp-active)

Crash Data

Attachments

(2 files)

This bug was filed from the Socorro interface and is 
report bp-bd0815ec-2571-4884-b0ba-2db3b2160428.
=============================================================

This signature first appeared on 2016-04-26, so just a few days ago. There are 9 crashes from a single installation of Firefox 48, 6 crashes from 5 installations of Firefox 49.

Looks like a null pointer access (EXCEPTION_ACCESS_VIOLATION_READ at address 0x88).
Every one I looked at is coming from nsGlobalWindow::GetCaches.
Ben, WDYT?
Flags: needinfo?(bkelly)
Whiteboard: btpp-followup-2016-05-06
This is almost certainly from bug 1266221.
Assignee: nobody → bkelly
Blocks: 1266221
Status: NEW → ASSIGNED
Flags: needinfo?(bkelly)
It's not clear to me how to reproduce this in a test.
Attachment #8747250 - Flags: review?(khuey)
Assignee: bkelly → josh
Whiteboard: btpp-followup-2016-05-06 → btpp-active
Comment on attachment 8747250 [details] [diff] [review]
Guard against a null outer window when calling GetCaches

Nevermind, this is probably incorrect given the previous diagnosis.
Attachment #8747250 - Flags: review?(khuey)
Assignee: josh → bkelly
I'm pretty confident this is the problem based on the timeline.  Bug 1266221 landed on April 25 and crashes began on April 26.
Comment on attachment 8747253 [details] [diff] [review]
Don't crash in GetServiceWorkersTestingEnabled if window is torn down and GetScriptableTop() returns nullptr. r=bz

r=me
Attachment #8747253 - Flags: review?(bzbarsky) → review+
Comment on attachment 8747253 [details] [diff] [review]
Don't crash in GetServiceWorkersTestingEnabled if window is torn down and GetScriptableTop() returns nullptr. r=bz

Approval Request Comment
[Feature/regressing bug #]: bug 1266221
[User impact if declined]: Possible crashes if certain js code races with a closing window.
[Describe test coverage new/current, TreeHerder]: Just existing tests which did not catch this problem.  Its hard to reproduce the race.  We caught this in crashstats.
[Risks and why]: Minimal.  We're simply adding a nullptr check.
[String/UUID change made/needed]: None.
Attachment #8747253 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/f3a5c8b5e170
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla49
Comment on attachment 8747253 [details] [diff] [review]
Don't crash in GetServiceWorkersTestingEnabled if window is torn down and GetScriptableTop() returns nullptr. r=bz

Crash fix, recent regression from 48, please uplift to aurora.
Attachment #8747253 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Version: unspecified → 48 Branch
You need to log in before you can comment on or make changes to this bug.