Closed Bug 1473074 Opened 2 years ago Closed 2 years ago

Crash in mozilla::dom::ServiceWorker::SetState

Categories

(Core :: DOM: Service Workers, defect, critical)

Unspecified
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla63
Tracking Status
firefox-esr52 --- unaffected
firefox-esr60 --- unaffected
firefox61 --- unaffected
firefox62 --- unaffected
firefox63 --- fixed

People

(Reporter: calixte, Assigned: mrbkap)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is
report bp-b30fa7b3-3b62-4ae0-a8ad-edc480180703.
=============================================================

Top 10 frames of crashing thread:

0 libxul.so mozilla::dom::ServiceWorker::SetState mfbt/UniquePtr.h:326
1 libxul.so mozilla::dom::ServiceWorkerRegistration::UpdateState dom/serviceworkers/ServiceWorkerRegistration.cpp:207
2 libxul.so mozilla::dom::ServiceWorkerRegistration::ServiceWorkerRegistration dom/serviceworkers/ServiceWorkerRegistration.cpp:49
3 libxul.so mozilla::dom::ServiceWorkerRegistration::CreateForMainThread dom/serviceworkers/ServiceWorkerRegistration.cpp:75
4 libxul.so nsGlobalWindowInner::GetOrCreateServiceWorkerRegistration dom/base/nsGlobalWindowInner.cpp:6438
5 libxul.so std::_Function_handler<void> >::_M_invoke dom/serviceworkers/ServiceWorkerContainer.cpp:374
6 libxul.so mozilla::MozPromise<mozilla::dom::ServiceWorkerRegistrationDescriptor, mozilla::CopyableErrorResult, false>::ThenValue<mozilla::dom::ServiceWorkerContainerImpl::Register> >::DoResolveOrRejectInternal xpcom/threads/MozPromise.h:529
7 libxul.so mozilla::MozPromise<mozilla::dom::ServiceWorkerRegistrationDescriptor, mozilla::CopyableErrorResult, false>::ThenValueBase::ResolveOrRejectRunnable::Run xpcom/threads/MozPromise.h:411
8 libxul.so mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:337
9 libxul.so nsThread::ProcessNextEvent 

=============================================================

There is 1 crash in nightly 63 with buildid 20180703100028. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1462772.

[1] https://hg.mozilla.org/mozilla-central/rev?node=2ba0b36ac85d
Flags: needinfo?(ben)
In legacy mode GetOrCreateServiceWorker() can return nullptr.  So I guess you need to check for that here.
Flags: needinfo?(mrbkap)
Flags: needinfo?(bugmail)
Flags: needinfo?(ben)
Note, it can return nullptr because of races with propagating SWM state across processes.
Crash Signature: [@ mozilla::dom::ServiceWorker::SetState] → [@ mozilla::dom::ServiceWorker::SetState] [@ mozilla::dom::ServiceWorkerRegistration::UpdateState]
Blake, Andrew -- any insight here?
I'm going to get to this today.
Flags: needinfo?(bugmail)
Assignee: nobody → mrbkap
Flags: needinfo?(mrbkap)
I guess because, in the old world, registrations were propagated everywhere we
could end up in a state with an old ServiceWorkerRegistrationInfo while our
ServiceWorkerRegistration thought that everything was up to date. I think that
what should eventually happen will be that when we eventually get our updated
Info, we'll update the state of the ServiceWorkerRegistration accordingly and
things should work themselves out.
Comment on attachment 8991387 [details]
Bug 1473074 - Don't assume these are non-null. r=asuth

Andrew Sutherland [:asuth] has approved the revision.

https://phabricator.services.mozilla.com/D2077
Attachment #8991387 - Flags: review+
Pushed by mrbkap@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/b62d582090e1
Don't assume these are non-null. r=asuth
https://hg.mozilla.org/mozilla-central/rev/b62d582090e1
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla63
Blocks: 1473994
You need to log in before you can comment on or make changes to this bug.