1333082 - Crash in mozilla::dom::workers::ServiceWorkerRegistrationInfo::TransitionInstallingToWaiting

Status: RESOLVED FIXED

(Core :: DOM: Service Workers, defect)

Description

[Ben Kelly [:bkelly, not reviewing]]

This bug was filed from the Socorro interface and is 
report bp-e2eef747-f0dd-48c1-b2f8-156282170123.
=============================================================

It appears ServiceWorkerUpdateJob::ContinueAfterInstallEvent() is getting called when mRegistration is nullptr.  I don't see how this could be happening, but lets try to protect against it and assert it doesn't happen.

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

Attachment: Handle nullptr mRegistration in ServiceWorkerUpdateJob::ContinueAfterInstallEvent(). r=asuth

Somehow we are triggering a FailUpdate() call and then also still calling ContinueAfterInstallEvent().  This makes us try to continue on a nullptr mRegistration.  I can't find which path triggers this, but lets try not to crash here and add an assertion.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/323cb4def9fd
Handle nullptr mRegistration in ServiceWorkerUpdateJob::ContinueAfterInstallEvent(). r=asuth

Comment 3

[Ben Kelly [:bkelly, not reviewing]]

Comment on attachment 8829466 [details] [diff] [review]
Handle nullptr mRegistration in ServiceWorkerUpdateJob::ContinueAfterInstallEvent(). r=asuth

Approval Request Comment
[Feature/Bug causing the regression]: Service workers
[User impact if declined]: Low frequency crashes.  This patch will mitigate some of the crashes and help narrow down the problem.
[Is this code covered by automated tests?]: We have extensive tests, but they don't trigger this condition.
[Has the fix been verified in Nightly?]: We do not have steps to reproduce, so we can't manually verify.
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: Minimal risk
[Why is the change risky/not risky?]: It only adds a nullptr check and a diagnostic assertion.  The chance of a regression is very low.
[String changes made/needed]:

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/323cb4def9fd

Comment 5

[Julien Cristau [:jcristau] (back on 2026-01-06)]

Comment on attachment 8829466 [details] [diff] [review]
Handle nullptr mRegistration in ServiceWorkerUpdateJob::ContinueAfterInstallEvent(). r=asuth

service worker crash fix, aurora53+, beta52+

Comment 6

[Ben Kelly [:bkelly, not reviewing]]

https://hg.mozilla.org/releases/mozilla-beta/rev/005d7fcffdd3103ef2504c086614c61e40d9c50f

Aurora is closed at the moment.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/2aa800c5c8f8