1583659 - Race between inheriting controller and client shutdown for Service-Worker-controlled Blob URI workers under SW-e10s

Status: RESOLVED DUPLICATE of bug 1584007

(Core :: DOM: Service Workers, defect, P2)

Description

[Perry Jiang [:perry] [no longer employee, use ni?]]

This race condition is exposed by browser_storage_permission.js

The racy interleaving of events is as follows:

Inheriting a controller:

• Blob URI worker inherits controller on a content process worker thread
• InheritController IPC call received on parent process background thread
• Runnable dispatch to inherit the controller on parent process main thread
• Attempt to link the ClientHandle that inherits the controller to a ClientSourceParent on the parent process background thread
  • If the ClientSourceParent hasn't been created and registered yet, wait for it to do so

Client shutdown (initiated by DedicatedWorkerGlobalScope.close):

• Call to close on a content process worker thread
• Call to WorkerPrivate::Cancel on the worker's owning thread
• WorkerPrivate destructor releases the single owning ClientSource reference on its owning thread, which shuts down the client
• ClientSourceParent unregisters with the ClientManagerService on the parent process background thread

It's possible that the ClientSourceParent gets created and destroyed in the parent before the ClientHandle tries to find the ClientSourceParent (in this case it'll never be found). As a result, this keeps the controlling Service Worker alive because the controlled client counter is always non-zero.

Comment 2

[Perry Jiang [:perry] [no longer employee, use ni?]]

Attachment: Bug 1583659 - Explicitly stop controlling clients when they're destroyed r?asuth

This avoids the race condition where a ClientHandle tries to connect to its
ClientSource (via their actors), but the ClientSource's actor has already
unregistered itself from the ClientManagerService.

Depends on D43170