Closed Bug 1390717 Opened 2 years ago Closed 2 years ago

Intermittent /fetch/api/response/response-stream-disturbed-3.html | application crashed [@ bool IsAboutToBeFinalizedInternal<JSObject>(JSObject**)]

Categories

(Core :: DOM: Core & HTML, defect, P5, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla57
Tracking Status
firefox-esr52 --- unaffected
firefox55 --- unaffected
firefox56 --- unaffected
firefox57 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: baku)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

Attachments

(1 file)

The problem here is that FetchStream needs to call HoldJSObjects or mReadableStream won't get traced.
Assignee: nobody → jcoppeard
Blocks: streams
Group: javascript-core-security
Duplicate of this bug: 1392963
Duplicate of this bug: 1390363
Note, this feature is still disabled by default, so not sure the bug needs to be private.
Attached patch stream2.patchSplinter Review
As discussed with Jon on IRC, the issue is that we have 2 JS::Heap<ReadableStreams>, the first one is in FetchBody, and the second one is in FetchStream, but we TRACE only the former one.
Assignee: jcoppeard → amarchesini
Attachment #8903145 - Flags: review?(jcoppeard)
(In reply to Ben Kelly [:bkelly] from comment #5)
I didn't realise that.  Unhiding.
Group: javascript-core-security
Comment on attachment 8903145 [details] [diff] [review]
stream2.patch

Review of attachment 8903145 [details] [diff] [review]:
-----------------------------------------------------------------

Great.  Thanks for fixing.
Attachment #8903145 - Flags: review?(jcoppeard) → review+
Pushed by amarchesini@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a9fba89f65c3
FetchStream should not have an extra JS::Heap<ReadableStream>, r=jonco
https://hg.mozilla.org/mozilla-central/rev/a9fba89f65c3
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.