Closed Bug 1374916 Opened 7 years ago Closed 7 years ago

Intermittent /service-workers/service-worker/xhr.https.html | application crashed [@ mozilla::dom::FetchBodyConsumer<mozilla::dom::Response>::BeginConsumeBodyMainThread()]

Categories

(Core :: DOM: Service Workers, defect)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1374922

People

(Reporter: intermittent-bug-filer, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

Attachments

(1 obsolete file)

Assignee: nobody → bugmail
Status: NEW → ASSIGNED
The crash report addresses look like UAF, setting security bit.  And indeed, it looks like BeginConsumeBodyRunnable's held `FetchBody<Derived>* mFetchBody;` which is explicitly not refcounted is already freed.  The lifecycle depends on FetchBody<Derived>::BeginConsumeBody() to AddRef and FetchBody<Derived>::ContinueConsumeBody to ReleaseObject.

Unfortunately, the FetchbodyWorkerHolder looks deficient.  It synchronously invokes ContinueConsumeBody and makes no attempt to cancel the (non-cancelable) BeginConsumeBodyRunnable (that no one holds a reference to).  :bkelly, thoughts?
Assignee: bugmail → nobody
Group: core-security
Status: ASSIGNED → NEW
Crash Signature: [@ mozilla::dom::FetchBodyConsumer<mozilla::dom::Response>::BeginConsumeBodyMainThread()] → [@ mozilla::dom::FetchBody<T>::BeginConsumeBodyMainThread] [@ mozilla::dom::FetchBodyConsumer<mozilla::dom::Response>::BeginConsumeBodyMainThread()]
Flags: needinfo?(bkelly)
Andrea, is this the thing you just fixed?
Flags: needinfo?(bkelly) → needinfo?(amarchesini)
The refcounting part yes. It's already in central.
The rest, see bug 1374922.
Status: NEW → RESOLVED
Closed: 7 years ago
Flags: needinfo?(amarchesini)
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: