1426162 - Crash in (anonymous namespace)::LoaderListener::OnStreamComplete

Status: VERIFIED FIXED

(Core :: DOM: Workers, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-6b3da792-05a4-4022-b52b-1a0c80171219.
=============================================================

Seen while looking at Mac crash stats - crashes started using 20171218220523: http://bit.ly/2kKtCBQ. Possible regression range based on build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5d203926da51a7e949a20818664b19d5b115572d&tochange=7c4579e705c4a3a3610183fe6f44affff3ad57ef

crash reason MOZ_RELEASE_ASSERT(mWorkerPrivate->FinalChannelPrincipalIsValid(channel))

Top 10 frames of crashing thread:

0 XUL  dom/workers/ScriptLoader.cpp:1204
1 XUL mozilla::net::nsStreamLoader::OnStopRequest netwerk/base/nsStreamLoader.cpp:108
2 XUL mozilla::net::nsStreamListenerTee::OnStopRequest netwerk/base/nsStreamListenerTee.cpp:52
3 XUL mozilla::net::nsHTTPCompressConv::OnStopRequest netwerk/streamconv/converters/nsHTTPCompressConv.cpp:169
4 XUL mozilla::net::HttpChannelChild::DoOnStopRequest netwerk/protocol/http/HttpChannelChild.cpp:1208
5 XUL mozilla::net::HttpChannelChild::OnStopRequest netwerk/protocol/http/HttpChannelChild.cpp:1099
6 XUL mozilla::net::ChannelEventQueue::FlushQueue netwerk/ipc/ChannelEventQueue.cpp:93
7 XUL mozilla::net::ChannelEventQueue::ResumeInternal netwerk/ipc/ChannelEventQueue.h:324
8 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1039
9 XUL NS_ProcessPendingEvents xpcom/threads/nsThreadUtils.cpp:450

=============================================================

Comment 1

[Marcia Knous [:marcia]]

Windows signature with same crash reason - [@ `anonymous namespace''::ScriptLoaderRunnable::OnStreamCompleteInternal ]

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Fallout from bug 1424336 maybe?

Comment 3

[Ben Kelly [:bkelly, not reviewing]]

Yea, probably just hitting a later assertion now.

Andrea, any ideas?  We could make it another runtime check.

I wonder if we are:

a. Failing to get a load group sometimes. Or
b. The principal is changing

Perhaps this is an extension using a worker with some weird principal that gets changed?

I guess if we make the runtime checks fail maybe someone will eventually give us a test case that is failing.

Comment 4

[Marcia Knous [:marcia]]

Adding Android signature.

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Topcrash for Mac, tracking for 59.

Comment 6

[Ted Campbell [:tcampbell]]

Happened to me on Win 10. No extensions but containers and profiler. I clicked a link in about:serviceworkers and the tab that opened crashed.

Comment 7

[Marcia Knous [:marcia]]

`anonymous namespace''::ScriptLoaderRunnable::OnStreamCompleteInternal signature is #2 overall top crash on 59 with over 1800 crashes in the last 7 days.

Comment 8

[Ben Kelly [:bkelly, not reviewing]]

I'm going to make this another runtime check instead of an assertion.

Comment 9

[Ben Kelly [:bkelly, not reviewing]]

BTW, I have learned another way channel principals can change.  Its possible for browser chrome script to set `nsIChannel.owner`.  Maybe some browser chrome or an addon is doing that for some worker scripts.

Comment 10

[Ben Kelly [:bkelly, not reviewing]]

Attachment: Convert worker main script principal assertion to runtime check. r=baku

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3c5811b083f9
Convert worker main script principal assertion to runtime check. r=baku

Comment 12

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/3c5811b083f9

Comment 13

[Sylvestre Ledru [:Sylvestre]]

crash stop shows that it isn't happening anymore.