Closed Bug 1301519 Opened 3 years ago Closed 3 years ago
Current Thread Worker Private() crashes if called due to ns Cycle Collector _shutdown()
While working on bug 1300658 I have run into a crash in GetCurrentThreadWorkerPrivate(). Basically we are getting a nullptr context private here: https://dxr.mozilla.org/mozilla-central/source/dom/workers/RuntimeService.cpp#1459 This is happening because the GetCurrentThreadWorkerPrivate() is being called in clean up code triggered by the nsCycleCollector_shutdown() here: https://dxr.mozilla.org/mozilla-central/source/dom/workers/RuntimeService.cpp#1071 The cycle collector shutdown occurs after clearing the context private.
Currently there is a window during ~WorkerJSRuntime() where the context private has been cleared, but the CycleCollectedRuntime::Get() method will still return non-nullptr. This is a problem if anything tries to call GetCurrentThreadWorkerPrivate() during this window. Unfortunately, ~WorkerJSRuntime() also calls nsCycleCollector_shutdown() at this point. This can execute arbitrary code through the destructors of cycle collected objects. This patch makes us handle the nullptr context private a bit better. https://treeherder.mozilla.org/#/jobs?repo=try&revision=a95c0fdabb09
Removed unrelated code from patch. Please see previous comments for explanation.
Attachment #8789573 - Flags: review?(amarchesini) → review+
Pushed by email@example.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/00f3449636ba Don't crash if GetCurrentThreadWorkerPrivate() is called during worker shutdown. r=baku
You need to log in before you can comment on or make changes to this bug.