1079367 - [e10s] crash in mozilla::net::HttpChannelParent::FailDiversion(tag_nsresult, bool)

Status: VERIFIED FIXED

Description

[juan becerra [:juanb]]

This bug was filed from the Socorro interface and is 
report bp-c639d509-f0e6-4893-beaf-159082141007.
=============================================================

Currently #21 in the list of top crashers on Firefox 35.0a1, mostly happening on Windows 7 and Windows 8.1 and "Windows Unknown." It's been on 35.0a1 since early September, but it first appeared on 5/18. There are no add-on correlations showing. Many reports show that people are using a lot of add-ons or none at all. I noticed several reports had Adblock Plus or DownloadHelper. There are no comments in the reports.

This seems to be related to enabling e10s.

More reports at: https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Anet%3A%3AHttpChannelParent%3A%3AFailDiversion%28tag_nsresult%2C+bool%29

0 	xul.dll 	mozilla::net::HttpChannelParent::FailDiversion(tag_nsresult, bool) 	netwerk/protocol/http/HttpChannelParent.cpp
1 	xul.dll 	mozilla::net::HttpChannelParent::ResumeForDiversion() 	netwerk/protocol/http/HttpChannelParent.cpp
2 	xul.dll 	mozilla::net::HttpChannelParent::RecvDivertComplete() 	netwerk/protocol/http/HttpChannelParent.cpp
3 	xul.dll 	mozilla::net::PHttpChannelParent::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PHttpChannelParent.cpp
4 	xul.dll 	mozilla::dom::PContentParent::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PContentParent.cpp
5 	xul.dll 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
6 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
7 	xul.dll 	RunnableMethod<mozilla::gmp::SyncRunnable, void ( mozilla::gmp::SyncRunnable::*)(void), Tuple0>::Run() 	ipc/chromium/src/base/task.h
8 	xul.dll 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
9 	xul.dll 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
10 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
11 	xul.dll 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
12 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
13 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
14 	xul.dll 	nsXULWindow::ShowModal() 	xpfe/appshell/nsXULWindow.cpp
15 	xul.dll 	nsWindowWatcher::OpenWindowInternal(nsIDOMWindow*, char const*, char const*, char const*, bool, bool, bool, nsITabParent*, nsIArray*, nsIDOMWindow**) 	embedding/components/windowwatcher/nsWindowWatcher.cpp
16 	xul.dll 	nsWindowWatcher::OpenWindow(nsIDOMWindow*, char const*, char const*, char const*, nsISupports*, nsIDOMWindow**) 	embedding/components/windowwatcher/nsWindowWatcher.cpp
17 	xul.dll 	XPTC__InvokebyIndex 	xpcom/reflect/xptcall/md/win32/xptcinvoke_asm_x86_64.asm
18 		@0x35caef 	
19 	xul.dll 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp
20 	xul.dll 	XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
21 	mozjs.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
22 	mozjs.dll 	Interpret 	js/src/vm/Interpreter.cpp
23 	mozjs.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
24 	mozjs.dll 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
25 	mozjs.dll 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
26 	mozjs.dll 	JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
27 	xul.dll 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	js/xpconnect/src/XPCWrappedJSClass.cpp
28 	xul.dll 	nsXPCWrappedJS::CallMethod(unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	js/xpconnect/src/XPCWrappedJS.cpp
29 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/md/win32/xptcstubs_x86_64.cpp
30 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/md/win32/xptcstubs_asm_x86_64.asm
31 	xul.dll 	nsExternalAppHandler::SendStatusChange(nsExternalAppHandler::ErrorType, tag_nsresult, nsIRequest*, nsString const&) 	uriloader/exthandler/nsExternalHelperAppService.cpp
32 	xul.dll 	nsExternalAppHandler::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) 	uriloader/exthandler/nsExternalHelperAppService.cpp
33 	xul.dll 	mozilla::dom::ExternalHelperAppParent::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) 	uriloader/exthandler/ExternalHelperAppParent.cpp
34 	xul.dll 	mozilla::net::HttpChannelParentListener::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) 	netwerk/protocol/http/HttpChannelParentListener.cpp
35 	xul.dll 	mozilla::net::nsHttpChannel::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) 	netwerk/protocol/http/nsHttpChannel.cpp
36 	xul.dll 	nsInputStreamPump::OnStateStop() 	netwerk/base/src/nsInputStreamPump.cpp
37 	xul.dll 	nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) 	netwerk/base/src/nsInputStreamPump.cpp
38 	xul.dll 	nsOutputStreamReadyEvent::Run() 	xpcom/io/nsStreamUtils.cpp
39 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
40 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
41 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
42 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
43 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
44 	xul.dll 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
45 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
46 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
47 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
48 	xul.dll 	XREMain::XRE_main(int, char** const, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
49 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp
50 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
51 	firefox.exe 	NS_internal_main(int, char**) 	browser/app/nsBrowserApp.cpp
52 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
53 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt_bld/self_64_amd64/crt/src/crt0.c:278
54 	kernel32.dll 	BaseThreadInitThunk 	
55 	ntdll.dll 	RtlUserThreadStart 	
56 	kernel32.dll 	BasepReportFault 	
57 	kernel32.dll 	BasepReportFault

Comment 2

[Dragana Damjanovic [:dragana]]

RecvDivertComplete() set mParentListener to nullptr,
further it calls ResumeForDiversion(), which calls FailDiversion (only in case of an error, therefore this is not happening that often)
and in FailDiversion we have:
 MOZ_RELEASE_ASSERT(mParentListener); 

http://hg.mozilla.org/mozilla-central/annotate/e4cfacb76830/netwerk/protocol/http/HttpChannelParent.cpp#l1027 


patch is coming...

Comment 3

[Dragana Damjanovic [:dragana]]

Created attachment 8509432 [details] [diff] [review]
fix v1

I am giving it to you since Steve is not in our group any more.

It is just one line fix.

mParentListener is set to nullptr too early, because it is needed in FailDiversion()

Comment 4

[Dragana Damjanovic [:dragana]]

https://tbpl.mozilla.org/?tree=Try&rev=e15b53c4e764

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Needs rebasing.

Comment 6

[Dragana Damjanovic [:dragana]]

Created attachment 8513553 [details] [diff] [review]
fix

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/33dca6b21a81

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/33dca6b21a81

Comment 9

[Florin Mezei, QA (:FlorinMezei)]

Socorro [1] shows now zero crashes with this signature.

[1] - https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=mozilla%3A%3Anet%3A%3AHttpChannelParent%3A%3AFailDiversion%28tag_nsresult%2C+bool%29