Service worker crashes tab when using postMessage during install
Reported by
asa.kus...@gmail.com,
Mar 15 2018
|
|
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36 Steps to reproduce the problem: Given a service worker that sends a postMessage to the active worker during installation (and waits for a channel response): 1. Open a bunch of tabs all within the scope of the service worker 2. Change the service worker file The issue is intermittent. Chance of happening seems to be increased by using skipWaiting(). Example repo and video screencast of reproduction here: https://github.com/asakusuma/sw-postmessage-crash Can't reproduce in Firefox or Chrome canary. What is the expected behavior? Tabs don't crash What went wrong? A tab (usually the first one opened) crashes. [34853:46083:0314/181649.900791:ERROR:bad_message.cc(25)] Terminating renderer for bad IPC message, reason 67 Did this work before? N/A Does this work in other browsers? Yes Chrome version: 65.0.3325.162 Channel: stable OS Version: OS X 10.12.6 Flash Version: The issue does not happen on Canary. From looking at the chromium code, it looks the issue might have been fixed by this commit: https://chromium.googlesource.com/chromium/src/+/fa23f2ad198386c864ec998452d9f6d916b2219a However, I'd like to understand the root cause of the issue and how to mitigate in chrome versions that have the issue.
,
Mar 15 2018
Thanks shimazu! How do I get access to view the other related ticket, 781702? "You do not have permission to view the requested page. Reason: User is not allowed to view this issue"
,
Mar 16 2018
Unfortunately I don't think we know how to mitigate this crash. It's a crash with unknown root cause that happens when a ServiceWorker JavaScript object reference goes out of scope. We were trying to track the reference count but there's a mismatch somewhere that causes an assertion to fail. We fixed the crash by removing the manual reference counting. The crash is fixed in Chrome 66. I've added you to the crash bug. |
|
►
Sign in to add a comment |
|
Comment 1 by shimazu@chromium.org
, Mar 15 2018Mergedinto: 781702
Status: Duplicate (was: Unconfirmed)