1110707 - Firefox routinely crashes while using the Janus plugin

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Damien]

Attachment: stdout from the debug build from Tinderbox

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0
Build ID: 20141127111021

Steps to reproduce:

Install the Janus plugin, and use Firefox for a while (with Janus enabled).  Crashes might be more frequent while there are many connections.


Actual results:

Firefox crashed.  A debug build showed:

Assertion failure: seekable (Request stream isn't seekable?!?), at /builds/slave/m-rel-l64-d-000000000000000000/build/netwerk/protocol/http/nsHttpTransaction.cpp:552

I've attached the standard output from Firefox, and the gdb stack trace (which doesn't look very useful).

Also see these crash reports:

bp-9ae00412-d73f-4aa3-8f79-277262141206
bp-bc0d2504-de15-4f87-9896-580572141206
bp-8884ad60-8c4a-486c-ad27-a46752141205
bp-953c7d98-b47f-449c-bff9-67ad52141211


Expected results:

No crash.

Comment 1

[Damien]

Attachment: Stack trace from gdb

Comment 2

[alreiten]

I have been experiencing similar crashes, with the same type of info in the crash report, with the Janus add-on enabled.

Example:

https://crash-stats.mozilla.com/report/index/c4cb3f2d-e3ea-4594-ac7f-c34992141213

Comment 3

[Patrick McManus [:mcmanus]]

you have a non-seekable input stream.

the crash is easily worked around in the code - but I'm not sure why using a spdy proxy would make this happen. do you have any kind of steps to reproduce that might let a dev see what is happening?

Comment 4

[Damien]

Not really.  The crash seems more likely if I'm opening a few web pages in different tabs, where those pages have a lot of images.

Comment 5

[alreiten]

Might this be similar to Issue 69 from Github? https://github.com/mozilla/node-janus/issues/69
That is an issue about OSCP.

Comment 6

[Damien]

Maybe that is the problem.  I set security.OCSP.enabled=0, and haven't had a crash in a few days.

Comment 7

[Patrick McManus [:mcmanus]]

I don't think this bug is the only issue with ocsp, but assuming seekable stream at that place in the code is not a safe xpcom assumption anyhow. So let's fix that.

Comment 8

[Patrick McManus [:mcmanus]]

Attachment: dont assume seekable stream on sending_to http events

Comment 9

[Patrick McManus [:mcmanus]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/90e632524106

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/90e632524106

Comment 11

[Damien]

I'm still getting the occasional crash in version 35.0.1 (like bp-27b380c2-0e4c-496d-a912-5a9592150206), but it looks like the fix won't come until version 37.

Comment 12

[Patrick McManus [:mcmanus]]

Comment on attachment 8544058 [details] [diff] [review]
dont assume seekable stream on sending_to http events

Approval Request Comment
[Feature/regressing bug #]: unknown - long standing
[User impact if declined]: users of janus proxy are seeing null deref crashes at lowish volumes on < ff 37
[Describe test coverage new/current, TreeHerder]: has been in tree since 37 was nightly, verified to fix problem
[Risks and why]: low - null check
[String/UUID change made/needed]: none

Comment 13

[Patrick McManus [:mcmanus]]

  https://hg.mozilla.org/releases/mozilla-beta/rev/222d4a9f7ed3