1793405 - Crash in [@ RefPtr<T>::operator bool | mozilla::dom::workerinternals::loader::CacheCreator::DeleteCache]

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Gabriele Svelto [:gsvelto] (PTO)]

Crash report: https://crash-stats.mozilla.org/report/index/b11fffad-29d0-4db0-88f1-91bdb0221001

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll RefPtr<mozilla::dom::cache::CacheStorage>::operator bool const mfbt/RefPtr.h:310
0 xul.dll mozilla::dom::workerinternals::loader::CacheCreator::DeleteCache dom/workers/loader/CacheLoadHandler.cpp:212
1 xul.dll mozilla::dom::workerinternals::loader::CachePromiseHandler::RejectedCallback dom/workers/loader/CacheLoadHandler.cpp:82
2 xul.dll mozilla::dom:: dom/promise/Promise.cpp:453
3 xul.dll mozilla::dom::NativeHandlerCallback dom/promise/Promise.cpp:365
4 xul.dll CallJSNative js/src/vm/Interpreter.cpp:459
4 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:547
4 xul.dll InternalCall js/src/vm/Interpreter.cpp:614
4 xul.dll js::Call js/src/vm/Interpreter.cpp:646
5 xul.dll js::Call js/src/vm/Interpreter.h:116

This looks like a NULL pointer access, the call to mLoadContext->GetCacheCreator() here seems to return a NULL pointer.

Comment 1

[Jens Stutte [:jstutte]]

Hi Yulia, it seems WorkerScriptLoader::MaybeExecuteFinishedScripts cleared the cache creator before a promise gets rejected during CC. We might just want to have a null check always when using GetCacheCreator ?

Comment 2

[Yulia Startsev [:yulia]]

This looks like it may be independent. We have null checks elsewhere for this, and it may be missing here.

Comment 3

[Yulia Startsev [:yulia]]

Attachment: Bug 1793405 - Add missing check for cacheCreator;

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ebb575338c40
Add missing check for cacheCreator; r=dom-worker-reviewers,smaug

Comment 5

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/ebb575338c40

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Copying crash signatures from duplicate bugs.