Closed Bug 1550613 Opened 6 years ago Closed 6 years ago

JSWindowActor crashes when sending messages early in lifecycle for in-process actors

Categories

(Core :: DOM: Content Processes, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla69
Fission Milestone M3
Tracking Status
firefox69 --- fixed

People

(Reporter: nika, Assigned: nika)

References

Details

Attachments

(2 files)

Currently when we send a message within the current process, we get the "other side" of the actor synchronously within the sending side. If the constructor hasn't been received yet, however, this means we'll get a null, and a crash will occur.

It seems like the best option here would be to do one of two things:

  1. Only hold mManager when sending the message, and get the other side actor when in the handler on the other side of the event loop, or:
  2. Synchronously create both sides using ManagedEndpoint<PWindowGlobal> to skip going through IPC to create the WindowGlobalParent object.

As, in general, it would be nice to keep stuff to usual IPC ordering, and avoid needing to do synchronous work in the in-process case, I think the easiest initial option here is (1). I'll attach a bug for this case shortly.

This patch changes the timing of when the other side actor is created to
be after posting the message to the event loop, to avoid situations
early during actor creation when the parent side hasn't been created yet
triggering null pointer crashes.

Blocks: 1467212

Hey nika, these patches look good to go from out here - are these almost ready to land?

Flags: needinfo?(nika)

Yeah, I think they're good to land, just been busy & haven't gotten around to landing them yet. I'll rebase them & queue them up for autoland, so hopefully everything works out :-)

Flags: needinfo?(nika)
Pushed by nlayzell@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/3476eec1fb49 Part 1: Get other side actor after posting to the event loop, r=jdai https://hg.mozilla.org/integration/autoland/rev/00c0737c9721 Part 2: Add test for early-lifecycle in-process messages, r=jdai
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla69
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: