529797 - thread-safety problems with works, xmlhttprequests and 302 redirects

Status: RESOLVED INCOMPLETE

(Core :: DOM: Workers, defect)

Description

[Petko D. (pdp) Petkov]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_2; en-us) AppleWebKit/531.21.8 (KHTML, like Gecko) Version/4.0.4 Safari/531.21.10
Build Identifier: http://releases.mozilla.org/pub/mozilla.org/xulrunner/releases/1.9.1.4/source/xulrunner-1.9.1.4.source.tar.bz2

There are several thread-safety issues when installing own notificationCallbacks on nsIChannels created by DOM Worker threads.

The problem can be illustrated like this:

we have a dom worker which fires a XMLHttpRequest. We have also a component which observes http-on-modify-request for nsIHttpChannel from the dom Worker. if the observing component tries to replace the notificationCallback property of nsIHttpChannel with its own implementation and the result of the request fired by the dom worker is a 302 redirect, we have a thread safety problem and the Worker freezes. Here is what I see in the console... you can ignore the lines starting with >>>>

>>>> ProcessResponse before ProcessRedirection 
>>>> after checking redirect type
>>>> after OnChannelRedirect
>>>> after SetOriginalURI
>>>> after OnRedirect
>>>> after AsyncOpen
>>>> after Cancel
>>>> after nulification
WARNING: NS_ENSURE_TRUE(mCacheEntry) failed: file /home/dev/Desktop/mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp, line 2487
>>>> ProcessResponse after InitCacheEntry 
>>>> ProcessResponse after CloseCacheEntry 
>>>> ProcessResponse after mCacheForOfflineUse check 
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 55
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 56
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 55
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 56
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 55
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 56
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 55
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 56
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 55
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 56
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 55
###!!! ASSERTION: XPCVariant not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file /home/dev/Desktop/mozilla/js/src/xpconnect/src/xpcvariant.cpp, line 56

This only happens when 302 redirects are encountered.

I did not spend much time on debugging due to a very busy schedule.

Reproducible: Always

Steps to Reproduce:
See above!

1.
2.
3.

Comment 1

[Petko D. (pdp) Petkov]

As a workaround of this issue you can implement a code similar to this:

http://code.google.com/p/websecurify/source/browse/trunk/xul/extensions/basic%40websecurify.gnucitizen.org/components/TestMonitor.js

However, the code will fail to respond properly when we have a 3xx redirect combined with a SSL or Auth problem.

pdp

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

In the process of migrating remaining bugs to the new severity system, the severity for this bug cannot be automatically determined. Please retriage this bug using the new severity system.

Comment 3

[Andrew McCreight [:mccr8]]

This kind of sounds like a worker issue, but I think also the answer here might be "don't use XPCVariants off the main thread".