2009527 - Assertion failure: ref, at /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:5046

Status: NEW

(Core :: DOM: Workers, defect, P3)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20260105-f3c4f3651e2d (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting the URL from crash report https://crash-stats.mozilla.org/report/index/240d9ed4-eeef-4629-b090-39e660260105. I am able to reproduce the issue but not under rr.

Assertion failure: ref, at /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:5046

32|0|libxul.so|mozilla::dom::WorkerPrivate::JSAsyncTaskStarted(JS::Dispatchable*)|git:github.com/mozilla-firefox/firefox:dom/workers/WorkerPrivate.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|5046|0x132
32|1|libxul.so|js::OffThreadPromiseTask::init(JSContext*, js::AutoLockHelperThreadState const&)|git:github.com/mozilla-firefox/firefox:js/src/vm/OffThreadPromiseRuntimeState.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|66|0xc0
32|2|libxul.so|js::OffThreadPromiseTask::init(JSContext*)|git:github.com/mozilla-firefox/firefox:js/src/vm/OffThreadPromiseRuntimeState.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|55|0x67
32|3|libxul.so|AsyncInstantiate(JSContext*, js::wasm::Module const&, JS::Handle<JSObject*>, Ret, JS::Handle<js::PromiseObject*>)|git:github.com/mozilla-firefox/firefox:js/src/wasm/WasmJS.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|4487|0x60
32|4|libxul.so|js::OffThreadPromiseTask::run(JSContext*, JS::Dispatchable::MaybeShuttingDown)|git:github.com/mozilla-firefox/firefox:js/src/vm/OffThreadPromiseRuntimeState.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|140|0xb4
32|5|libxul.so|mozilla::dom::workerinternals::(anonymous namespace)::JSDispatchableRunnable::WorkerRun(JSContext*, mozilla::dom::WorkerPrivate*)|git:github.com/mozilla-firefox/firefox:dom/workers/RuntimeService.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|666|0x8a
32|6|libxul.so|mozilla::dom::WorkerThreadRunnable::Run()|git:github.com/mozilla-firefox/firefox:dom/workers/WorkerRunnable.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|440|0x2fa
32|7|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThread.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|1158|0x794
32|8|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThreadUtils.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|461|0x4f
32|9|libxul.so|mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*)|git:github.com/mozilla-firefox/firefox:dom/workers/WorkerPrivate.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|3990|0x554
32|10|libxul.so|mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run()|git:github.com/mozilla-firefox/firefox:dom/workers/RuntimeService.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|2329|0x522
32|11|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThread.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|1158|0x794
32|12|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThreadUtils.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|461|0x4f
32|13|libxul.so|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|299|0xc6
32|14|libxul.so|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:fd219ed8433994befcbfa5d3b8387597de836bde|343|0x61
32|15|libxul.so|nsThread::ThreadFunc(void*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThread.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|373|0x1be
32|16|libnspr4.so|_pt_root|git:github.com/mozilla-firefox/firefox:nsprpub/pr/src/pthreads/ptthread.c:fd219ed8433994befcbfa5d3b8387597de836bde|191|0x18c
32|17|firefox-bin|set_alt_signal_stack_and_start(PthreadCreateParams*)|git:github.com/mozilla-firefox/firefox:mozglue/interposers/pthread_create_interposer.cpp:fd219ed8433994befcbfa5d3b8387597de836bde|81|0x10c

Comment 1

[Eden Chuang[:edenchuang]]

https://phabricator.services.mozilla.com/D265016#inline-1493411

I think it is the case that a JSAsyncTask starts when the Worker is in the wrong status. Maybe in "Canceling" status.
I guess it is the situation that the JSAsyncTask is dispatched in "Running," but executing in "Canceling" status.

Ryan, could you take a look?

Comment 2

[Andrew Sutherland [:asuth] (he/him)]

A particular question here would be whether the async JS logic should be checking if the global is dying before proceeding to this call point. Another possibility is that this situation is okay and we should remove the assertion because this is just a normal race relating to shutdown of the worker.

Comment 3

[Ryan Hunt [:rhunt]]

Re-reading the code here, it looks like we fire the callbacks in this order:

1. AsyncTaskStarted - called when we create an async task internally
2. DispatchToEventLoop - called when we dispatch the task to be run by gecko
3. AsyncTaskFinished - called when a task is internally destroyed or immediately before it is run by gecko

Step 2 has special handling where gecko can fail to dispatch the task because of shutdown and spidermonkey will handle that. But we're getting a failure in step 1 (presumably due to shutdown).

I think that's safe, because step 2 will correctly handle shutdown. But it's a little confusing.

We could adjust the async task started callback to return false during shutdown, and eagerly cancel the async tasks by moving them to the 'failed' list immediately in our 'init' method. But I could be missing something here, our async task code is too complicated.

Comment 4

[Pascal Chevrel (relman team) -> :pascalc]

Ryan is there something actionable for 149? Thanks!

Comment 5

[Ryan Hunt [:rhunt]]

This is just a debug assert and shouldn't lead to any crashes for users. From my analysis, I think we should keep the assert but rework some spidermonkey code so that we don't trigger it anymore and have clearer invariants. But the fact the assert is firing in this case is likely okay.

I'll assign it to myself and try to get to it when I can, but I don't think it's something we need to urgently have in 149.

Comment 6

[Pascal Chevrel (relman team) -> :pascalc]

Thanks, adjusting tracking flags then.

Comment 7

[Intermittent Failures Robot]

1 failures were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 1

Table

	http3
linux2404-x86_64/debug	1

For more details, see:

https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=2009527&startday=2026-04-20&endday=2026-04-26&tree=all

Comment 8

[Intermittent Failures Robot]

1 failures were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-beta: 1

Table

	no_variant
linux2404-x86_64/debug	1

For more details, see:

https://treeherder.mozilla.org/intermittent-failures/bugdetails?bug=2009527&startday=2026-04-27&endday=2026-05-03&tree=all