Repository navigation
[BUG] Firefox: page crashes (DOM Worker segfault) when just-created workers are terminated #42923
Closed as not planned
Description
Version
1.63.0 (firefox-1543, Firefox 155.0)
Steps to reproduce
const { firefox } = require('playwright');
(async () => {
const browser = await firefox.launch();
let crashes = 0;
for (let run = 0; run < 40; run++) {
const page = await browser.newPage();
page.on('crash', () => crashes++);
await page.setContent('<p>x</p>');
await page.evaluate(async () => {
const src = URL.createObjectURL(new Blob(['onmessage = () => postMessage(1)'], { type: 'text/javascript' }));
const workers = [];
for (let i = 0; i < 16; i++) workers.push(new Worker(src));
await new Promise((resolve) => { workers[0].onmessage = resolve; workers[0].postMessage(0); });
for (const worker of workers) worker.terminate();
}).catch(() => {});
await page.close().catch(() => {});
}
console.log('crashes', crashes);
await browser.close();
})();Expected behavior
No crashes.
Actual behavior
Around 6 of 40 pages crash with Target crashed. Each crash leaves the same kernel line:
DOM Worker[1927112]: segfault at 8 ip 0000129038846b30 sp 00001290246ff0f8 error 4 in libxul.so[6a45b30,129035129000+7659000]
A null dereference at the same offset every time. With 4 workers instead of 16, or with terminate() delayed by 200 ms, there are no crashes in the same 40 runs.
Additional context
We hit it in e2e with the ALTCHA widget (altcha 3.2.2): it starts min(16, navigator.hardwareConcurrency) workers and terminates the rest as soon as one of them finds the solution, which with an easy challenge happens while the others are still starting up.
Environment
Linux x86_64, Ubuntu 24.04, 16 cores, Node 24, headless.
Activity
github-actions commentedon Sep 24, 2026
Hi, I'm the Playwright bot and I took a first look at this.
Reproduced on 1.63.0 (firefox-1543, Firefox 155.0), but it looks fixed on tip-of-tree. Running your script on 1.63.0, 3 and then 6 of 40 pages crashed with
Target crashed. On tip-of-tree (npm1.64.0-alpha-2026-09-24, repo sha9db1942, firefox-1551, Firefox 156.0) I got 0 crashes in 4 runs of 40 pages, and 0 with 32 workers too. The Firefox roll to r1551 landed in #42843 and hasn't shipped in a stable release yet. Could you trynpm i -D @playwright/test@nextand confirm it clears the ALTCHA flake for you? My runs used 4 cores and you have 16, so I'd like to hear back from your machine.What I ran
Your script, parameterized by worker count
N, a delay beforeterminate(), and browser. Headless, Linux x86_64, 4 cores, Node 24.21.0.terminate()Triaged on Linux by the Playwright bot - agent run
yury-s commentedon Sep 24, 2026
Thanks for the report! This is the same crash as #42565: a worker terminated while its script is still being compiled makes the script loader shut down too early. It was fixed in
firefox-1544(https://github.com/microsoft/playwright-browsers/pull/2514).With your repro,
firefox-1543crashes 3–10 of 40 pages per run, whilefirefox-1544and later have no crashes. The fix is available in@playwright/test@nextand will ship in 1.64.Closing as a duplicate of #42565.