New issue
Advanced search Search tips

Issue 822145 link

Starred by 2 users

Issue metadata

Status: Duplicate
Owner: ----
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug



Sign in to add a comment

Service worker crashes tab when using postMessage during install

Reported by asa.kus...@gmail.com, Mar 15 2018

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36

Steps to reproduce the problem:
Given a service worker that sends a postMessage to the active worker during installation (and waits for a channel response):
1. Open a bunch of tabs all within the scope of the service worker
2. Change the service worker file

The issue is intermittent. Chance of happening seems to be increased by using skipWaiting().

Example repo and video screencast of reproduction here: 
https://github.com/asakusuma/sw-postmessage-crash

Can't reproduce in Firefox or Chrome canary.

What is the expected behavior?
Tabs don't crash

What went wrong?
A tab (usually the first one opened) crashes.

[34853:46083:0314/181649.900791:ERROR:bad_message.cc(25)] Terminating renderer for bad IPC message, reason 67

Did this work before? N/A 

Does this work in other browsers? Yes

Chrome version: 65.0.3325.162  Channel: stable
OS Version: OS X 10.12.6
Flash Version: 

The issue does not happen on Canary. From looking at the chromium code, it looks the issue might have been fixed by this commit: https://chromium.googlesource.com/chromium/src/+/fa23f2ad198386c864ec998452d9f6d916b2219a

However, I'd like to understand the root cause of the issue and how to mitigate in chrome versions that have the issue.
 
Cc: leon....@intel.com
Mergedinto: 781702
Status: Duplicate (was: Unconfirmed)
Thanks for your report, great reproduction code and video screencast!
As you mentioned, that has already been fixed in the patch in M66.
Actually I'm not sure why OnDecrementServiceWorkerRefCount() is called in that case...

Leon: do you think we have some mitigation/work around for this issue?
Thanks shimazu!

How do I get access to view the other related ticket, 781702?

"You do not have permission to view the requested page. Reason: User is not allowed to view this issue"

Comment 3 by falken@chromium.org, Mar 16 2018

Unfortunately I don't think we know how to mitigate this crash. It's a crash with unknown root cause that happens when a ServiceWorker JavaScript object reference goes out of scope. We were trying to track the reference count but there's a mismatch somewhere that causes an assertion to fail. We fixed the crash by removing the manual reference counting.

The crash is fixed in Chrome 66.

I've added you to the crash bug.

Sign in to add a comment