199492 - crash while submitting form on www.sony.com [@ nsHttpConnection::CloseTransaction] [@ nsHttpConnection::Close] [@ nsHttpConnectionMgr::nsConnectionHandle::~nsConnectionHandle] [@ nsHttpTransaction::HandleContent] [@ 0x3d888889] [@ nsHttpConnection::Re...

Status: VERIFIED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Darin Fisher]

there's a bug in the cancelation logic in the HTTP code that is triggered more
easily over a slow connection.  on www.sony.com, if you enter a search term and
press enter before the page fully loads, chances are good that the browser will
crash.  i've been able to repro this easily under linux w/ a trunk build from
yesterday just by adding some PR_Sleep's after each call to PR_Read/PR_Write on
the socket thread.

Comment 1

[Darin Fisher]

this is a regression from the NTLM SSPI patch... the fix is very trivial.  can't
believe i overlooked this! :-(

Comment 2

[Darin Fisher]

Attachment: v1 patch

Comment 3

[Darin Fisher]

Comment on attachment 118669 [details] [diff] [review]
v1 patch

alec:

turns out i should not try to clear the "old" transaction's reference to the
connection because it could still be in the middle of accessing it on a
background thread.  instead, we should let the transaction release the
connection as it normally would when the transaction gets destroyed.

Comment 4

[Alec Flett]

Comment on attachment 118669 [details] [diff] [review]
v1 patch

sr=alecf

Comment 5

[Darin Fisher]

Comment on attachment 118669 [details] [diff] [review]
v1 patch

seeking drivers approval for this simple topcrash fix.	we don't want to ship
1.4a with this bug!!

this bug was a f**kup on my part, a regression from the NTLM patch that landed
two days ago. the code being removed was added for NTLM support, but i realize
now that it isn't even needed for that.  things will be cleaned up
automatically, and in the right order, with proper thread synchronization (just
as before my NTLM patch) if i just let the transaction object release its
reference to the connection on its own.

alecf knows this code because we sat down and went over it during the NTLM
review, so it's really good to have his review on this.  dougt also knows this
code well, but he is on vacation.  i'm not sure who to get an r= from... i
think it would just be token at best.

please approve this patch.  thx!

Comment 6

[chris hofmann]

I'll + this for blocking 1.4.  I've hit the crash several times in the last day
or so...

Comment 7

[Darin Fisher]

fixed-on-trunk =)

Comment 8

[Darin Fisher]

*** Bug 199500 has been marked as a duplicate of this bug. ***

Comment 9

[Darin Fisher]

*** Bug 199458 has been marked as a duplicate of this bug. ***

Comment 10

[Darin Fisher]

*** Bug 199436 has been marked as a duplicate of this bug. ***

Comment 11

[Jay Patel [:jay]]

Adding topcrash keyword for tracking.

Comment 12

[Matthias Versen [:Matti]]

*** Bug 199572 has been marked as a duplicate of this bug. ***

Comment 13

[kguru]

Is this related to Talkback not launching after the crash on MachO build
2003032609?  Each time that build of the browser crashed, talkback did not launch.

Comment 14

[Darin Fisher]

kguru: i doubt it.

Comment 15

[Cathleen]

*** Bug 199605 has been marked as a duplicate of this bug. ***

Comment 16

[Darin Fisher]

*** Bug 199549 has been marked as a duplicate of this bug. ***

Comment 17

[Jay Patel [:jay]]

Adding stack signatures from duped bugs into summary for tracking.

Comment 18

[Jay Patel [:jay]]

*** Bug 199533 has been marked as a duplicate of this bug. ***

Comment 19

[Jay Patel [:jay]]

Adding [@ nsHttpTransaction::HandleContent] [@ 0x3d888889] [@
nsHttpConnection::Release] to summary since those were also stack signatures
showing up in 3/25 - 3/27 MozillaTrunk builds. 

No crashes since 3/17.  Verifying fixed.

Comment 20

[timeless]

*** Bug 199466 has been marked as a duplicate of this bug. ***

Comment 21

[Darin Fisher]

The original summary for this bug was longer than 255 characters, and so it was truncated when Bugzilla was upgraded. The original summary was:

crash while submitting form on www.sony.com [@ nsHttpConnection::CloseTransaction]  [@ nsHttpConnection::Close] [@ nsHttpConnectionMgr::nsConnectionHandle::~nsConnectionHandle] [@ nsHttpTransaction::HandleContent] [@ 0x3d888889] [@ nsHttpConnection::Release]