143821 - Trunk M1RC2 crashes with bad connection [@ nsHttpHandler::ReclaimConnection]

Status: VERIFIED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[greer]

This signature has bubbled up to the top of the M1RC2 day one data. I've 
tried to reproduce this one from the user's comments (including sites and 
installations of BannerBlind and CaScadeS on mozdev.org) with no luck. 

Here are the stack and comments in the hope that someone can produce reliable 
steps to reproduce:

         nsHttpHandler::ReclaimConnection
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpHandler.cpp  line 
431] 
         nsHttpConnection::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpConnection.cpp  
line 623]  

M1RC2 (nsHttpHandler::ReclaimConnection):       10
(6171238)  Comments: Failed when closing the browser. It may have been stuck 
trying to make a network connection when the network was down.
(6171238) - [Windows NT  5.0 build 2195] (Build 2002051008): Failed when closing 
the browser. It may have been stuck trying to make a network connection when the 
network was down. URL: 
(6166345) - [Windows NT  5.1 build 2600] (Build 2002051008): I quit mozilla and 
this crash report appeared.... URL: http://mozdev.org
(6166381) - [Windows NT  5.1 build 2600] (Build 2002051008): I just completed 
the BannerBlind install  and Mozilla crashed apon exiting after the install 
program asked for Mozilla to be restarted. URL: http://mozdev.org
(6166159) - [Linux 2.4.18] (Build 2002051009): clicked the "X" on blackbox to 
close the browser. URL: cnn.com

Trunk (nsHttpHandler::ReclaimConnection):        8

M1BR (nsHttpHandler::ReclaimConnection):       19
(5867487) - [Windows 98  4.10 build 67766446] (Build 2002050208): Closing M 
after having gone to a secure site that did not open URL:
(5988247) - [Windows 98  4.10 build 67766446] (Build 2002050408): No more load 
of the page. Java 1.4 URL: http://www.volkstheater.ch
(6130017) - [Windows 98  4.10 build 67766222] (Build 2002050808): Mozilla was 
slow to load an encrypted website. I realised the time of day and closed the 
incompleted page whilst it was still loading. Crash seemed to occur after that 
was closed and I closed all the other pages...last page to close was the mail 
client. URL:
(6103332) - [Windows NT  5.0 build 2195] (Build 2002050808): Attempting to close 
the application. URL:
(6159792) - [Windows NT  5.0 build 2195] (Build 2002050708): Attempting to login 
to Fleet's HomeLink account management site (card # entered  selected save this 
card number  and pin entered; all fake)  browser never finishes loading
 the next page. URL: https://homelink.fleet.com/HomeLink/
(6131778) - [Windows NT  5.0 build 2195] (Build 2002050808): dglazman...after 
installing Cascades  I've been crashing... URL:
(5937508) - [Windows 98  4.10 build 67766446] (Build 2002050208): crashed after 
closing after trying to go to a site whre pipelining is not enabled. URL:
(5927884) - [Windows 98  4.10 build 67766222] (Build 2002050208): didn't wait 
for this url to complete loading  before hitting stop.Was trying to reproduce 
bug:http://bugzilla.mozilla.org/show_bug.cgi?id=142206 URL: http://www.thai.
net/navigate/
(6131778) Build: 2002050808 Plat: Windows NT  5.0 build 2195 Time: 2002-05-09 
[e-mail]  dglazman...after installing Cascades  I've been crashing...

Comment 1

[greer]

-> darin for first look.

Comment 2

[greer]

6166159 (above) is on Linux. OS -> All

Comment 3

[Darin Fisher]

it looks like were crashing here:

  PR_Lock(mConnectionLock);

so mConnectionLock is probably null or pointing to free'd memory, which means
that the nsHttpHandler singleton has been destroyed.  this conclusion seems
consistent with the comments that mention "closing the browser."

at least one comment says that pipelining was disabled, so maybe this has
nothing to do with pipelining.  hard to say for certain, though.

Comment 4

[Kai Engert (:KaiE:)]

I can reproduce this bug all the time on Linux.

Go to www.bouldernews.com - wait a moment until most has loaded. Press stop.
Click on the subscribe link upper right. Wait until some parts have loaded.
Press stop. Choose File/Exit. Crash.

#0  nsHttpHandler::ReclaimConnection (this=0x0, conn=0x89186d8) at
/home/kaie/100/mozilla/netwerk/protocol/http/src/nsHttpHandler.cpp:431
	this = (nsHttpHandler *) 0x0
	reusable = 0
#1  0x409d7051 in nsHttpConnection::OnStopRequest (this=0x89186d8,
request=0x8945950, ctxt=0x0, status=2152398850) at
/home/kaie/100/mozilla/netwerk/protocol/http/src/nsHttpConnection.cpp:622
	info = {<nsCOMPtr_base> = {mRawPtr = 0x891e900}, <No data fields>}
	secCtrl = {mRawPtr = 0x891e904}
#2  0x40995d5d in nsSocketRequest::OnStop (this=0x8945950) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransport.cpp:2668
No locals.
#3  0x4099621c in nsSocketReadRequest::OnStop (this=0x8945950) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransport.cpp:2804
	this = (nsSocketReadRequest *) 0x8945950
#4  0x40990357 in nsSocketTransport::CompleteAsyncRead (this=0x891e398) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransport.cpp:659
	this = (nsSocketTransport *) 0x891e398
	readRequest = (nsSocketReadRequest *) 0x8945950
#5  0x4098fdd1 in nsSocketTransport::Process (this=0x891e398, aSelectFlags=0) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransport.cpp:498
	this = (nsSocketTransport *) 0x891e398
	aSelectFlags = 0
	done = 0
#6  0x40997524 in nsSocketTransportService::ProcessWorkQ (this=0x8128898) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransportService.cpp:297
	transport = (nsSocketTransport *) 0x891e398
	this = (nsSocketTransportService *) 0x8128898
	rv = 0
	qp = (PRCList *) 0x891e3cc
#7  0x40997c94 in nsSocketTransportService::Run (this=0x8128898) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransportService.cpp:543
	pfd = (PRPollDesc *) 0x8116030
	out_flags = 1
	rv = 0
	count = 1
	intervalNow = 3428632165
	transport = (nsSocketTransport *) 0x0
	i = 0
	this = (nsSocketTransportService *) 0x8128898
	pollTimeout = 35000

Comment 5

[greer]

Tried this one on Win2000 with Kai's steps in comment #4. No crash. Can anyone
else reproduce with these steps Win/Linux? Plussing for now 

Comment 6

[scottputterman]

Getting on rtm radar.  If it turns out this only occurs with pipelining on then
it won't be needed for rtm.

Comment 7

[Kai Engert (:KaiE:)]

It indeed seems to be a pipelining bug. I still can reproduce with pipelining
enabled, but can't with having it disabled.

Darin, besides the crash bug, I also see another problem with that site and
pipelining enabled.

When you go to www.bouldernews.com and click the subscribe link, that page loads
having pipelining disabled, but does not seem to load if it is enabled.

Comment 8

[Shiva Thirumazhusai]

According to kai's comment this crash is reproducible with pipeline enabled and
it is appearing in the talkback topcrash reports. marking it as topcrash+ with
testcase keyword.

Comment 9

[benc]

-> http

Comment 10

[Darin Fisher]

Attachment: v1 patch

trivial bug, trivial patch...

we've always had this bug, but it requires "perfect time slicing" to exercise
it when pipelining is disabled.

Comment 11

[Kai Engert (:KaiE:)]

Comment on attachment 83649 [details] [diff] [review]
v1 patch

r=kaie

I tried the patch and it causes the crash to go away.

Comment 12

[jag (Peter Annema)]

Comment on attachment 83649 [details] [diff] [review]
v1 patch

sr=jag

Comment 13

[Darin Fisher]

fixed-on-trunk

Comment 14

[rpotts (gone)]

Comment on attachment 83649 [details] [diff] [review]
v1 patch

looks good to me.
(r/sr=rpotts)

Comment 15

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 83649 [details] [diff] [review]
v1 patch

a=shaver+scc+jesup for the 1.0 rc3 branch.  Godspeed.

Comment 16

[Jaime Rodriguez, Jr.]

Nominating for adt +.

Comment 17

[Darin Fisher]

fixed-on-branch

Comment 18

[Tom Everingham]

verified using supplied testcase -
trunk and branch, 5/20/02 builds - winNT4, Linux rh6

Comment 19

[Jaime Rodriguez, Jr.]

posthumas adt1.0.0+. Pls make sure to get ADT approval before landing on the 1.0
branch.

Comment 20

[Tom Everingham]

verified1.0.0