1090238 - SPDY crashes on Facebook

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This happens constantly while accessing Facebook.  We're accessing deleted memory (0x5a5a5a5a).
 	xul.dll!nsTHashtable<nsBaseHashtableET<nsCStringHashKey,nsAutoPtr<nsXBLPrototypeBinding> > >::RemoveEntry(const nsACString_internal & aKey) Line 175	C++
>	xul.dll!mozilla::net::SpdySession31::CleanupStream(mozilla::net::SpdyStream31 * aStream, tag_nsresult aResult, mozilla::net::SpdySession31::rstReason aResetCode) Line 908	C++
 	xul.dll!mozilla::net::SpdySession31::CloseTransaction(mozilla::net::nsAHttpTransaction * aTransaction, tag_nsresult aResult) Line 2424	C++
 	xul.dll!mozilla::net::nsHttpConnectionMgr::OnMsgCancelTransaction(int reason, void * param) Line 2424	C++
 	xul.dll!mozilla::net::nsHttpConnectionMgr::nsConnEvent::Run() Line 626	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 830	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 265	C++
 	xul.dll!nsSocketTransportService::Run() Line 742	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 830	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 265	C++
 	xul.dll!mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate * aDelegate) Line 368	C++
 	xul.dll!MessageLoop::RunHandler() Line 227	C++
 	xul.dll!MessageLoop::Run() Line 201	C++
 	xul.dll!nsThread::ThreadFunc(void * aArg) Line 359	C++

Comment 1

[Patrick McManus [:mcmanus]]

kyle I expect this is a dup of 1089749

can you confirm you don't have the backout that in your build that is expected to fix it? https://bugzilla.mozilla.org/show_bug.cgi?id=865314#c30

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I'm on https://hg.mozilla.org/mozilla-central/rev/8230834302c9

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Making a comment because I don't seem to be getting bugmail for this bug ...

Comment 4

[Patrick McManus [:mcmanus]]

(In reply to Kyle Huey [:khuey] ([e-mail]) from comment #2)
> I'm on https://hg.mozilla.org/mozilla-central/rev/8230834302c9

that build does not contain the backout. So its a likely dup. Probly ok to open this up soon as it was just a one iteration nightly bug. nonetheless I'll mark it fixed rather than contaminating across security/non-security bugs with a dup. feel free to adjust if the spirit moves you.

Comment 5

[Al Billings [:abillings - ex-MoCo]]

Can we get this confirmed that it is fixed by the backout? Otherwise, this is still an unfixed sec-critical.

QA, can you take a look at this?

Comment 6

[Daniel Veditz [:dveditz]]

On the assumption that this was a dupe of bug 1089749 then it was caused by bug 865314 and fixed by a backout and only affected a few days worth of Fx36 nightlies. It should be easy to confirm that with Kyle.

I'm confused by the Version being set to "32 Branch" when the bug was created. Wasn't the current release at the time and doesn't match comment 2. Bad template I guess?

Comment 7

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

The 32 branch is some weird bugzilla thing, it's happened to me elsewhere too.  I flipped the pref to disable this stuff so I haven't seen this since.