Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Chromium 149 headless shell crashes in service-worker DevTools resource loading during context teardown

クローズ
  • 何か問題がありますか？
#43,374 コメント 2 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@yury-s がすでに取り組んでいます。

2026年10月14日 から。

  • #43384 @yury-s による — マージされずにクローズ

評価

この issue はまだ評価されていません。

説明

browser-chromium upstream v1.65

Chromium 149 service-worker DevTools resource load dereferences a missing live version during context teardown

Observed with Playwright 1.61.0, chromium_headless_shell revision 1228 / Chrome Headless Shell 149.0.7827.55 on GitHub Actions ubuntu-latest. Two public CI failures:

The application registers a service worker, and Playwright runs short renderer tests in fresh contexts with trace: 'retain-on-failure'. Both failures terminate the browser with SIGSEGV at address 0x1b0, reported while starting the next context. The launch already includes --disable-dev-shm-usage.

The exact Linux binary is available at https://cdn.playwright.dev/builds/cft/149.0.7827.55/linux64/chrome-headless-shell-linux64.zip, build ID c97a9c1daed9622d2d0f626ce0e85170e6e105f2. It is stripped, so the following attribution uses disassembly and embedded debug strings, not a symbolized stack:

  • Return frame 0x653e673 is in code referencing NetworkHandler::LoadNetworkResource.
  • Return frame 0x6574d16 is in code referencing SWDTAH::CreateNetworkFactoryParamsForDevTools. At 0x6574cfa it calls the live-version lookup, then adds 0xa8 to the returned pointer and passes that storage-key address to an isolation-info routine, with no null check.
  • The fault at 0x2af9eed is cmpl $0x0, 0x108(%rsi). The CI register dumps have rax=0 and si=0xa8, producing the exact fault address 0xa8 + 0x108 = 0x1b0.

The matching source unconditionally uses version->key() after context_wrapper_->GetLiveVersion(version_id_):
https://github.com/chromium/chromium/blob/149.0.7827.55/content/browser/devtools/service_worker_devtools_agent_host.cc#L426-L449

The network handler invokes that factory for non-frame resources:
https://github.com/chromium/chromium/blob/149.0.7827.55/content/browser/devtools/protocol/network_handler.cc#L4362-L4468

An inferred caller is Playwright's response-body fallback: an empty Network.getResponseBody response with nonzero expected content length triggers Network.loadNetworkResource, including on a service-worker session. Trace collection can overlap context teardown. The original logs do not capture the exact request or event ordering, so that sequence remains a hypothesis; the native null live-version dereference is directly supported by the registers and disassembly.

Repository mitigation: block service workers in smoke contexts that do not test PWA behavior. All real PNG decoding, canvas drawing and pixel assertions remain. Local macOS smoke and 30 wonder-spec repetitions pass. The mitigation also passed the full 42-test smoke suite and all 180 wonder tests on ubuntu-latest using the lockfile-pinned browser, with --repeat-each=30 --workers=1 --retries=0: https://github.com/a1flecke/conquestoria/actions/runs/38556914066/job/115828240726. A minimal standalone reproducer has not yet been established.

Could the DevTools factory handle an absent live version during resource loading, and could Playwright avoid or cancel this fallback for a closing service-worker session? Playwright #43009 concerns a separate service-worker session teardown leak; it is not claimed as this crash's cause.

主要言語
TypeScript
スター
98.5k
フォーク
6.7k
平均マージ
16時間 5分
マージ済み PR（30日）
286

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

microsoft/playwright のほかの issue

microsoft/playwright の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。