1707473 - Crash in [@ mozilla::dom::AbortSignalProxy::GetOrCreateSignalImplForMainThread]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

[Tracking Requested - why for this release]:
Crash new in Firefox 89

This is a regression from bug 1660555. Tom, can you investigate this, please?

Crash report: https://crash-stats.mozilla.org/report/index/09adab0e-0c4b-4c28-ad4a-130ba0210425

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::AbortSignalProxy::GetOrCreateSignalImplForMainThread dom/fetch/Fetch.cpp:216
1 xul.dll mozilla::dom::MainThreadFetchRunnable::Run dom/fetch/Fetch.cpp:501
2 xul.dll mozilla::ThrottledEventQueue::Inner::Executor::Run xpcom/threads/ThrottledEventQueue.cpp:81
3 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:757
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp
5 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:109
6 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:328
7 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:310
8 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137
9 xul.dll nsAppShell::Run widget/windows/nsAppShell.cpp:602

Comment 1

[Tom S. (please needinfo tschuster)]

I think this crash means the AbortSignalProxy this pointer is invalid. (rcx is 0xe5e5e5e5e5e5e5e5, which I think is usually the this pointer). This however means mResolver would be invalid in mozilla::dom::MainThreadFetchRunnable::Run. In that case I would have expected an earlier crash.

We could also just backout these patches they don't really bring any advantage as is. Smaug what do you think?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

I couldn't immediately what is going wrong, so backing out sounds reasonable.

Comment 3

[Tom S. (please needinfo tschuster)]

Would you mind backing out the patches from https://bugzilla.mozilla.org/show_bug.cgi?id=1660555#c41 on beta and central/nightly?

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Trunk backout pushed, Pascal will take care of the beta one tomorrow.

Comment 5

[Tom S. (please needinfo tschuster)]

Thank you both!