1071805 - crash in mozilla::net::HttpBaseChannel::SetupReplacementChannel(nsIURI*, nsIChannel*, bool)

Status: RESOLVED DUPLICATE of bug 1063837

(Core :: General, defect)

Description

[Alice0775 White]

[Tracking Requested - why for this release]:

This bug was filed from the Socorro interface and is 
report bp-f6674c41-d38c-49d1-b54b-2abcb2140923.
=============================================================

Regression window(m-i)
Good:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6c05e3dc15ac
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 ID:20140922040949
Bad:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4120e1cbb5b4
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 ID:20140922051650
Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6c05e3dc15ac&tochange=4120e1cbb5b4

Regressed by: Bug 1038756

Comment 1

[Alice0775 White]

Steps To Reproduce:
1. Install  Greasemonkey2.2 and restart
   https://addons.mozilla.org/ja/firefox/addon/greasemonkey/
2. Install attached user script

3. Open http://reader.livedoor.com/reader/
4. Login livedoor id : mozilla_tests
         パスワード  : BugDesuyo
   then click [ログイン] button

5. Click GM toolbar dropdown marker
6. Select "User Script Commands..."  and then Click "LDR Full Feed - reset cache"

7. Click "won't fix" link at the left side menus of contents area
8. Click yellow [G] icon of footer of a article

Actual Results:
Browser crashes

Comment 2

[Alice0775 White]

Attachment: ldrfullfeed.user.js

Comment 3

[Alice0775 White]

It seems fixed in latest m-i build.

Comment 4

[Alice0775 White]

Fixed window(m-i)
Bad:
https://hg.mozilla.org/integration/mozilla-inbound/rev/3201d7690fc5
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 ID:20140922145320
Fixed:
https://hg.mozilla.org/integration/mozilla-inbound/rev/de9ba02af7a6
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 ID:20140922153522
Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=3201d7690fc5&tochange=de9ba02af7a6
Fixed by:
84c5652507ce	Tanvi Vyas — Bug 1063837 - For xhr, don't set principal to nullprincipal in cases where we want a sandboxed document; instead, set the sandboxed flag in loadinfo. For EventSource, there is no issue iwth using system. r=sicking, smaug

Comment 5

[Robert Kaiser]

I'm actually making this a dupe in that case, so that the pointer to the actual fix is more obvious.

Comment 6

[Tanvi Vyas[:tanvi]]

Why did https://bugzilla.mozilla.org/show_bug.cgi?id=1063837 fix this issue?  Bug 1038756 added a loadInfo object to channels.  Without bug 1063837, there were cases for eventsource and xhr where the principal was set to the nullprincipal.  With bug 1063837, we no longer explicitly set the nullprincipal in loadInfo.  But since loadInfo isn't being used yet, it shouldn't make a difference.

From https://crash-stats.mozilla.com/report/index/f6674c41-d38c-49d1-b54b-2abcb2140923 it shows an issue at http://hg.mozilla.org/mozilla-central/annotate/790f41c631cc/netwerk/protocol/http/HttpBaseChannel.cpp#l2032.  Are we failing because we are trying to the get the uri of a nullprincipal?  But we aren't using loadInfo principals for mRedirects (which is where the uri comes from).

Maybe it doesn't matter; not sure whether we should invest more time in this or not.

Comment 7

[kalviskajaks]

Is this really fixed? Because i just got this crash twice in a row on newest nightly! 
https://crash-stats.mozilla.com/report/index/8002d353-bffa-4966-b921-b96c12140928
https://crash-stats.mozilla.com/report/index/c594010b-c086-410c-944f-370672140928

Comment 8

[kalviskajaks]

23 crashes of these crashes so far in a few hours. The browser is simply unusable..

Comment 9

[Alice0775 White]

.

(In reply to kalviskajaks from comment #7)
> Is this really fixed? Because i just got this crash twice in a row on newest
> nightly! 
> https://crash-stats.mozilla.com/report/index/8002d353-bffa-4966-b921-
> b96c12140928
> https://crash-stats.mozilla.com/report/index/c594010b-c086-410c-944f-
> 370672140928

(In reply to kalviskajaks from comment #8)
> 23 crashes of these crashes so far in a few hours. The browser is simply
> unusable..

Please file a new Bug.

Comment 10

[Firefox Bug Husbandry Bot]

Moving from Core::Untriaged to Core::General https://bugzilla.mozilla.org/show_bug.cgi?id=1407598