Closed Bug 1546603 Opened 3 years ago Closed 3 years ago

Firefox crashes when debugging the sourcemap worker used by devtools

Categories

(DevTools :: Debugger, defect)

Product:
DevTools
Component:
Debugger
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(firefox68 fixed)

Status:
RESOLVED FIXED
Milestone:
Firefox 68
Tracking Flags:
Tracking Status
firefox68 --- fixed

People

(Reporter: pbro, Assigned: bhackett1024)

References

(Blocks 1 open bug)

Details

Crash Data

Attachments

(1 file)

Bug 1546603 - Don't finalize stream sources from JS if creating the stream object failed, r=arai.
47 bytes, text/x-phabricator-request
Details | Review

Here are the steps I took:

  • open Firefox Nightly on https://tromey.github.io/source-map-examples/less/index.html (this page uses a CSS source map, defined as a data-uri)
  • open DevTools, with the Style Editor panel selected, on that page
  • open the Browser Toolbox, and select the debugger panel there
  • now, locate the worker thread and the worker.js file that's running inside it, and set a breakpoint inside the networkRequest function (this is where the CSS sourcemap is fetched)
  • go back to the main Firefox window and reload it, this will cause the source map to be downloaded again
  • once the browser toolbox worker debugger pauses, continue to various locations inside the function, and switch back and forth between the main Firefox window and the browser toolbox window

==> Firefox crashes.
Here is the crash report I submitted:
https://crash-stats.mozilla.org/report/index/9bb3ce47-0903-4173-bffe-b3a4b0190424#tab-details

I also found yesterday that sometimes the source-map-worker/worker.js file would not load.

Brian, would you be able to look into this?

Flags: needinfo?(bhackett1024)
Crash Signature: [@ <name omitted> | std::__1::__function::__func<T>::destroy_deallocate]

The problem here isn't related to the worker debugger work that has been going on, but the attached patch should fix it. Inconsistent behavior in a JS API for streams was causing an object to have unbalanced reference counts, leading to an infinite recursion when the object was destroyed.

Flags: needinfo?(bhackett1024)
Pushed by bhackett@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2dcd3edb3c5d
Don't finalize stream sources from JS if creating the stream object failed, r=arai.

https://hg.mozilla.org/mozilla-central/rev/2dcd3edb3c5d

Status: NEW → RESOLVED
Closed: 3 years ago
status-firefox68: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → Firefox 68
Assignee: nobody → bhackett1024

Hello,

I verified this issue on Fx Beta 68.0b14 on Windows 10 and mac OS 10.13. I can confirm that this issue is fixed in Windows 10 x64 and mac OS 10.13, that being said while on mac OS 10.13 there is no crash when the debugger pauses after I close Fx, Fx crashes. This has a reproduction rate of 100%.

Here is the crash report: https://crash-stats.mozilla.com/report/index/08effd21-ddfd-4fe0-84f1-8639d0190701

Can you please take a look at this?

Flags: needinfo?(bhackett1024)

Sorry for the late reply. I'm not familiar with the code this bug is related to, and I don't really have time to look into this.

Flags: needinfo?(bhackett1024)
You need to log in before you can comment on or make changes to this bug.