1822717 - Loading module causes tab crash

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jim Blandy :jimb]

Attachment: Files to serve via `python3 -m http.server`

Loading an async module causes Firefox to display the "Gah. Your tab just crashed" message in changeset c47b3b28fb48 (2023-3-14) on x86_64 Linux.

To reproduce, download the attached file repro.zip, and then:

$ unzip repro.zip 
Archive:  repro.zip
   creating: repro/
  inflating: repro/index.html        
  inflating: repro/triangle.js       
$ cd repro/
$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

Then, in a Firefox tree:

$ mach run http://127.0.0.1:8000

Comment 1

[Jim Blandy :jimb]

Attachment: mozconfig used to build firefox

Comment 2

[Jim Blandy :jimb]

This may not be very helpful, but, bisection says the crash was introduced in this change:

changeset: 727237:7dfd43c2efc6
user: Jon Coppeard <[e-mail]>
date: Tue Feb 07 11:55:51 2023 +0000
summary: Bug 1813494 - Part 3: Add more cancellation checks and state assertions to module load requests r=smaug

Comment 3

[Jim Blandy :jimb]

Note that the code in triangle.js file is almost entirely commented out. There's nothing in here that could run WebGPU code.

Comment 4

[Jim Blandy :jimb]

Another clue may be that, if you delete the comments in triangle.js, it doesn't crash any more. You instead get an error in the web console:

Uncaught SyntaxError: redeclaration of const error
note: Previously declared at line 4, column 10

If you do modify the test input, don't forget to blow away your browser cache:

$ rm -rf obj-x86_64-pc-linux-gnu/tmp/profile-default && mach run http://localhost:8000

Comment 5

[Jim Blandy :jimb]

https://crash-stats.mozilla.org/report/index/c367f44d-0eec-4853-9297-df0640230320

Comment 6

[Andrew McCreight [:mccr8]]

It looks like that crash report is rather old so I've marked the comment obsolete.

Comment 8

[Jon Coppeard (:jonco)]

Thanks for the report and easy repro.

Comment 9

[Jon Coppeard (:jonco)]

Attachment: Bug 1822717 - Relax assertion about module request state when an error occurs r?yulia

ModuleErrored() can be called when we are in the compiling state too, if we are
parsing the module off-thread.

Comment 10

[Jared Hirsch [:jhirsch] (he/him) (Needinfo please)]

:jonco, FYI we could potentially pick this up for a 111 release. Is that something you'd like to try for?

Comment 11

[Jon Coppeard (:jonco)]

The fix is to change a debug-only assertion, so there's no user impact. IMO not worth it unless this will help with testing.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b68aca161658
Relax assertion about module request state when an error occurs r=yulia

Comment 13

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/b68aca161658

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:jonco, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox112 to wontfix.

For more information, please visit auto_nag documentation.