1426562 - Creating new Response() in add-on crashes the tab

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Michael]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36

Steps to reproduce:

In my browser extension (add-on) JavaScript code, I attempted to create a Response object by calling new Response().


Actual results:

The tab crashed and showed me the page: "Gah.  Your tab just crashed."


Expected results:

A Response object should have been created.  Calling new Response() from the Dev Console does not crash the tab.

Comment 1

[YF (Yang)]

Attachment: testcase.zip

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

Looks like this is also crashing on android with a nullptr global.

Probably what we want to do is:

1. Make Response::Constructor throw InvalidStateError if the global is nullptr.
2. Only call InitFromChromeGlobal if we don't have a window, but we do have a system principal
3. Otherwise, let the response get created but without any channel security info

Comment 3

[Marcia Knous [:marcia]]

This still crashes periodically in Fennec, but usually it is a single installation crash.

Comment 5

[:Gijs (he/him)]

Based on the stack from https://crash-stats.mozilla.com/report/index/42565032-450b-4f76-ad82-cfd2b0190425 we're hitting this release assert: https://searchfox.org/mozilla-central/rev/d143f8ce30d1bcfee7a1227c27bf876a85f8cede/dom/fetch/ChannelInfo.cpp#50-51

Which seems to suggest this codepath should only be usable from browser/Firefox code, not from add-ons. See also https://searchfox.org/mozilla-central/rev/d143f8ce30d1bcfee7a1227c27bf876a85f8cede/dom/fetch/Response.cpp#200-214 and comment #2.

:hsinyi, based on the steps in the dupe (bug 1540109) this is blocking people from releasing Firefox add-on updates. Any chance it could be prioritized?

Workaround in the add-on might be invoking the Response constructor somewhere else and passing the response to where it's needed (e.g. as blob).

Comment 6

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Hi Gijs, thanks for bringing this up. I think Service Worker team would have a better view on this, so NI Andrew. :)

Hi Andrew, please let me know if there's anything my team can help with.

Comment 7

[Andrew Overholt [:overholt]]

Perry, let's try to get this fixed as soon as parent intercept lands (or before?).

Comment 8

[Perry Jiang [:perry] [no longer employee, use ni?]]

Attachment: Bug 1426562 - Don't crash on `Response` constructor in WebExtensions. r?baku

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dac784d695b3
Don't crash on `Response` constructor in WebExtensions. r=baku

Comment 10

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/dac784d695b3