1838246 - Crash in [@ mozilla::dom::Promise::MaybeSomething<T> | mozilla::dom::Promise::MaybeResolve | mozilla::dom::(anonymous namespace)::GetSubscriptionResultRunnable::WorkerRun]

Status: RESOLVED FIXED

(Core :: DOM: Push Subscriptions, defect, P2)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/4346f607-19d4-4954-aeba-ed7970230613

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  RefPtr<nsIGlobalObject>::get const  mfbt/RefPtr.h:325
0  xul.dll  RefPtr<nsIGlobalObject>::operator nsIGlobalObject* const  mfbt/RefPtr.h:338
0  xul.dll  mozilla::dom::Promise::MaybeSomething<const JS::Handle<JS::Value>&>  dom/promise/Promise.h:419
1  xul.dll  mozilla::dom::Promise::MaybeResolve  dom/promise/Promise.h:94
1  xul.dll  mozilla::dom::  dom/push/PushManager.cpp:119
2  xul.dll  mozilla::dom::WorkerRunnable::Run  dom/workers/WorkerRunnable.cpp:372
3  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1234
4  xul.dll  NS_ProcessNextEvent  xpcom/threads/nsThreadUtils.cpp:479
5  xul.dll  mozilla::dom::WorkerPrivate::DoRunLoop  dom/workers/WorkerPrivate.cpp:3341
6  xul.dll  mozilla::dom::workerinternals::  dom/workers/RuntimeService.cpp:2141

This is only on nightly so it appears to be a regression, the first affected buildid is 20230607033033.

Comment 1

[Jens Stutte [:jstutte]]

Could be related to bug 1800659?

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

This bug has been marked as a regression. Setting status flag for Nightly to affected.

Comment 3

[Dianna Smith [:diannaS]]

This is a low volume crash, but is there a plan to fix this for fx116?
If anyone can set the priority/severity on this bug, it would be helpful.

Comment 4

[Eden Chuang[:edenchuang]]

Attachment: Bug 1838246 - Return true directly in GetSubscriptionResultRunnable::WorkerRun when Worker is shutting down. r=asuth

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a62ecca2aaf0
Return true directly in GetSubscriptionResultRunnable::WorkerRun when Worker is shutting down. r=asuth

Comment 6

[Eden Chuang[:edenchuang]]

Comment on attachment 9344375 [details]
Bug 1838246 - Return true directly in GetSubscriptionResultRunnable::WorkerRun when Worker is shutting down. r=asuth

Beta/Release Uplift Approval Request

• User impact if declined: User could meet unexpected UAFs when using the subscription functions with Worker.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The change is low risky since we just adding a if statement for checking the Worker status.
• String changes made/needed: No
• Is Android affected?: Yes

Comment 7

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/a62ecca2aaf0

Comment 8

[Dianna Smith [:diannaS]]

Comment on attachment 9344375 [details]
Bug 1838246 - Return true directly in GetSubscriptionResultRunnable::WorkerRun when Worker is shutting down. r=asuth

Approved for 116.0b8

Comment 9

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/552dc030ee17