1806395 - Crash in [@ mozilla::dom::WorkerRunnable::Run]

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Jens Stutte [:jstutte]]

Crash report: https://crash-stats.mozilla.org/report/index/570e2142-c5cb-4712-9630-00c3e0221218

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::dom::WorkerRunnable::Run  dom/workers/WorkerRunnable.cpp:401
1  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1198
2  xul.dll  NS_ProcessNextEvent  xpcom/threads/nsThreadUtils.cpp:474
3  xul.dll  mozilla::dom::WorkerPrivate::RunCurrentSyncLoop  dom/workers/WorkerPrivate.cpp:4238
4  xul.dll  mozilla::dom::AutoSyncLoopHolder::Run  dom/workers/WorkerPrivate.h:1511
5  xul.dll  mozilla::dom::workerinternals::  dom/workers/ScriptLoader.cpp:249
6  xul.dll  mozilla::dom::workerinternals::LoadMainScript  dom/workers/ScriptLoader.cpp:1658
7  xul.dll  mozilla::dom::  dom/workers/WorkerPrivate.cpp:381
8  xul.dll  mozilla::dom::WorkerRunnable::Run  dom/workers/WorkerRunnable.cpp:377
9  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1198

Cracking up https://crash-stats.mozilla.org/report/index/570e2142-c5cb-4712-9630-00c3e0221218 shows me that apparently we try to run an already freed WorkerRunnable while doing a sync loop and fail on reading its mWorkerPrivate member, which sounds weird.

Comment 1

[Jens Stutte [:jstutte]]

Extracted the signature from bug 1806064. For now this is mitigated by backout as of bug 1247687 comment 77.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

:yulia, since you are the author of the regressor, bug 1247687, could you take a look? Also, could you set the severity field?

For more information, please visit auto_nag documentation.

Comment 3

[Yulia Startsev [:yulia]]

It's unclear if this will be also solved by bug 1806390 but this was originally related to those crash signatures. It looks like it has the same cause (issue with refcount, looks like we crash and don't have the full signature in this case) I will do a pass over to see if i can retrigger the NT failures with PDF.js viewer with the new patch stack.

Comment 4

[Andrew McCreight [:mccr8]]

Fixed by backout.

Comment 5

[Andrew McCreight [:mccr8]]

I confirmed that this crash signature isn't showing up any more.

Comment 6

[Yulia Startsev [:yulia]]

I will try to reland the changes now that emilios changes are in. I'll monitor the crashes over the next few days.