Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Chromium 149 headless shell crashes in service-worker DevTools resource loading during context teardown

Đã đóng
  • Có gì không ổn?
#43,374 2 bình luận 0 reaction 1 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

@yury-s đang làm issue này rồi.

Từ ngày 14/10/2026.

  • #43384 của @yury-s — đã đóng, không merge

Đánh giá

Issue này chưa được đánh giá.

Mô tả

browser-chromium upstream v1.65

Chromium 149 service-worker DevTools resource load dereferences a missing live version during context teardown

Observed with Playwright 1.61.0, chromium_headless_shell revision 1228 / Chrome Headless Shell 149.0.7827.55 on GitHub Actions ubuntu-latest. Two public CI failures:

The application registers a service worker, and Playwright runs short renderer tests in fresh contexts with trace: 'retain-on-failure'. Both failures terminate the browser with SIGSEGV at address 0x1b0, reported while starting the next context. The launch already includes --disable-dev-shm-usage.

The exact Linux binary is available at https://cdn.playwright.dev/builds/cft/149.0.7827.55/linux64/chrome-headless-shell-linux64.zip, build ID c97a9c1daed9622d2d0f626ce0e85170e6e105f2. It is stripped, so the following attribution uses disassembly and embedded debug strings, not a symbolized stack:

  • Return frame 0x653e673 is in code referencing NetworkHandler::LoadNetworkResource.
  • Return frame 0x6574d16 is in code referencing SWDTAH::CreateNetworkFactoryParamsForDevTools. At 0x6574cfa it calls the live-version lookup, then adds 0xa8 to the returned pointer and passes that storage-key address to an isolation-info routine, with no null check.
  • The fault at 0x2af9eed is cmpl $0x0, 0x108(%rsi). The CI register dumps have rax=0 and si=0xa8, producing the exact fault address 0xa8 + 0x108 = 0x1b0.

The matching source unconditionally uses version->key() after context_wrapper_->GetLiveVersion(version_id_):
https://github.com/chromium/chromium/blob/149.0.7827.55/content/browser/devtools/service_worker_devtools_agent_host.cc#L426-L449

The network handler invokes that factory for non-frame resources:
https://github.com/chromium/chromium/blob/149.0.7827.55/content/browser/devtools/protocol/network_handler.cc#L4362-L4468

An inferred caller is Playwright's response-body fallback: an empty Network.getResponseBody response with nonzero expected content length triggers Network.loadNetworkResource, including on a service-worker session. Trace collection can overlap context teardown. The original logs do not capture the exact request or event ordering, so that sequence remains a hypothesis; the native null live-version dereference is directly supported by the registers and disassembly.

Repository mitigation: block service workers in smoke contexts that do not test PWA behavior. All real PNG decoding, canvas drawing and pixel assertions remain. Local macOS smoke and 30 wonder-spec repetitions pass. The mitigation also passed the full 42-test smoke suite and all 180 wonder tests on ubuntu-latest using the lockfile-pinned browser, with --repeat-each=30 --workers=1 --retries=0: https://github.com/a1flecke/conquestoria/actions/runs/38556914066/job/115828240726. A minimal standalone reproducer has not yet been established.

Could the DevTools factory handle an absent live version during resource loading, and could Playwright avoid or cancel this fallback for a closing service-worker session? Playwright #43009 concerns a separate service-worker session teardown leak; it is not claimed as this crash's cause.

Ngôn ngữ chính
TypeScript
Star
98.5k
Fork
6.7k
Merge trung bình
16 giờ 10 phút
Pull request đã merge (30 ngày)
305

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của microsoft/playwright

Tất cả issue của microsoft/playwright

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.