1336529 - Crash in nsRefPtrHashtable<T>::Get | mozilla::dom::workers::ServiceWorkerManager::GetRegistration

Status: RESOLVED FIXED

(Core :: DOM: Service Workers, defect)

Description

[Ben Kelly [:bkelly, not reviewing]]

This bug was filed from the Socorro interface and is 
report bp-0f9e0613-c545-4c34-9eea-8111d2170203.
=============================================================

This appears to be due to ServiceWorkerPrivate::NoteDeadServiceWorker() being called while we are trying to proxy release the KeepAliveToken.  This leads to a possible nullptr mInfo being passed ServiceWorkerManager::WorkerIsIdle().

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

Attachment: Handle ServiceWorkerInfo destruction while released KeepAliveToken. r=asuth

I believe this crash is due to a race where a service worker is unregistered or an old SW version is doomed at the same time a KeepAliveToken is being async released via a runnable.  The ReleaseToken() method assumes mInfo is non-nullptr, but can be nullptr if the ServiceWorkerInfo is destroyed at the same time.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7d9895066136
Handle ServiceWorkerInfo destruction while released KeepAliveToken. r=asuth

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7d9895066136

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Looks like the one report I see with this signature came from 51.0.1, so I guess that means 52/53 are also affected? Assuming that's the case, please request approval when you get a chance :)

Comment 5

[Ben Kelly [:bkelly, not reviewing]]

Comment on attachment 8833431 [details] [diff] [review]
Handle ServiceWorkerInfo destruction while released KeepAliveToken. r=asuth

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1170543
[User impact if declined]: Low frequency crashes
[Is this code covered by automated tests?]: Many tests, but they don't trigger this race
[Has the fix been verified in Nightly?]: Its low frequency without exact STR, so can't verify.
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: None
[Is the change risky?]: Minimal risk
[Why is the change risky/not risky?]: It just adds a nullptr check.
[String changes made/needed]: None

Comment 6

[Gerry Chang [:gchang]]

Comment on attachment 8833431 [details] [diff] [review]
Handle ServiceWorkerInfo destruction while released KeepAliveToken. r=asuth

Fix a crash. Aurora53+.

Comment 7

[Julien Cristau [:jcristau]]

Comment on attachment 8833431 [details] [diff] [review]
Handle ServiceWorkerInfo destruction while released KeepAliveToken. r=asuth

service worker crash fix for beta52

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/2885c756fcf8

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-beta/rev/cb083bb2dd7d