1152087 - crash in mozalloc_abort(char const*) | NS_DebugBreak | mozilla::net::PNeckoChild::SendPHttpChannelConstructor

Status: RESOLVED DUPLICATE of bug 1277582

(Core :: Networking, defect, P4)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-cdf51182-66ba-40a2-941d-e7d6c2150403.
=============================================================
Frame 	Module 	Signature 	Source
0 	libmozglue.so 	mozalloc_abort(char const*) 	memory/mozalloc/mozalloc_abort.cpp
1 	libxul.so 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
2 	libxul.so 	mozilla::net::PNeckoChild::SendPHttpChannelConstructor(mozilla::net::PHttpChannelChild*, mozilla::dom::PBrowserOrId const&, IPC::SerializedLoadContext const&, mozilla::net::HttpChannelCreationArgs const&) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/ipc/ipdl/PNeckoChild.cpp:324
3 	libxul.so 	mozilla::net::HttpChannelChild::ContinueAsyncOpen() 	netwerk/protocol/http/HttpChannelChild.cpp
4 	libxul.so 	mozilla::net::HttpChannelChild::AsyncOpen(nsIStreamListener*, nsISupports*) 	netwerk/protocol/http/HttpChannelChild.cpp
5 	libxul.so 	imgLoader::LoadImage(nsIURI*, nsIURI*, nsIURI*, mozilla::net::ReferrerPolicy, nsIPrincipal*, nsILoadGroup*, imgINotificationObserver*, nsISupports*, unsigned int, nsISupports*, unsigned int, nsAString_internal const&, imgRequestProxy**) 	image/src/imgLoader.cpp
6 	libxul.so 	nsContentUtils::LoadImage(nsIURI*, nsIDocument*, nsIPrincipal*, nsIURI*, mozilla::net::ReferrerPolicy, imgINotificationObserver*, int, nsAString_internal const&, imgRequestProxy**, unsigned int) 	dom/base/nsContentUtils.cpp
7 	libxul.so 	nsImageLoadingContent::LoadImage(nsIURI*, bool, bool, nsImageLoadingContent::ImageLoadType, nsIDocument*, unsigned int) 	dom/base/nsImageLoadingContent.cpp
8 	libxul.so 	nsImageLoadingContent::LoadImage(nsAString_internal const&, bool, bool, nsImageLoadingContent::ImageLoadType) 	dom/base/nsImageLoadingContent.cpp
9 	libxul.so 	mozilla::dom::HTMLImageElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, bool) 	dom/html/HTMLImageElement.cpp
10 	libxul.so 	mozilla::dom::Element::SetAttr(int, nsIAtom*, nsAString_internal const&, bool) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dist/include/mozilla/dom/Element.h:451
11 	libxul.so 	nsGenericHTMLElement::SetHTMLAttr(nsIAtom*, nsAString_internal const&, mozilla::ErrorResult&) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dist/include/mozilla/dom/Element.h:1040
12 	libxul.so 	mozilla::dom::HTMLImageElementBinding::set_src 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dist/include/mozilla/dom/HTMLImageElement.h:150
13 	libxul.so 	mozilla::dom::GenericBindingSetter(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp
14 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
15 	libxul.so 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
16 	libxul.so 	js::InvokeSetter(JSContext*, JS::Value const&, JS::Value, JS::Handle<JS::Value>) 	js/src/vm/Interpreter.cpp
17 	libxul.so 	js::NativeSetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::QualifiedBool, JS::ObjectOpResult&) 	js/src/vm/NativeObject.cpp
18 	libxul.so 	Interpret 	js/src/vm/NativeObject.h
19 	libxul.so 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
20 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
21 	libxul.so 	js::fun_call(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp
22 		@0xb392d712 	

More reports:
https://crash-stats.mozilla.com/report/list?product=B2G&signature=mozalloc_abort%28char+const*%29+|+NS_DebugBreak+|+mozilla%3A%3Anet%3A%3APNeckoChild%3A%3ASendPHttpChannelConstructor%28mozilla%3A%3Anet%3A%3APHttpChannelChild*%2C+mozilla%3A%3Adom%3A%3APBrowserOrId+const%26%2C+IPC%3A%3ASerializedLoadContext+const%26%2C+mozilla%3A%3Anet%3A%3AHttpChannelCreationArgs+const%26%29

On Flame device:
last crash : 2015040601
earliest reported crash on soccorro :  2015040118

Only seen on 40.0a1 so far.

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I saw this today when shutting down the browser.

 	xul.dll!NS_DebugBreak(unsigned int aSeverity, const char * aStr, const char * aExpr, const char * aFile, int aLine) Line 423	C++
 	xul.dll!mozilla::net::PNeckoChild::SendPHttpChannelConstructor(mozilla::net::PHttpChannelChild * actor, const mozilla::dom::PBrowserOrId & browser, const IPC::SerializedLoadContext & loadContext, const mozilla::net::HttpChannelCreationArgs & args) Line 321	C++
>	xul.dll!mozilla::net::HttpChannelChild::ContinueAsyncOpen() Line 1692	C++
 	xul.dll!mozilla::net::HttpChannelChild::AsyncOpen(nsIStreamListener * listener, nsISupports * aContext) Line 1555	C++
 	xul.dll!nsPluginHost::NewPluginURLStream(const nsString & aURL, nsNPAPIPluginInstance * aInstance, nsNPAPIPluginStreamListener * aListener, nsIInputStream * aPostStream, const char * aHeadersData, unsigned int aHeadersDataLen) Line 3208	C++
 	xul.dll!nsPluginHost::GetURLWithHeaders(nsNPAPIPluginInstance * pluginInst, const char * url, const char * target, nsNPAPIPluginStreamListener * streamListener, const char * altHost, const char * referrer, bool forceJSEnabled, unsigned int getHeadersLength, const char * getHeaders) Line 501	C++
 	xul.dll!nsPluginHost::GetURL(nsISupports * pluginInst, const char * url, const char * target, nsNPAPIPluginStreamListener * streamListener, const char * altHost, const char * referrer, bool forceJSEnabled) Line 464	C++
 	xul.dll!MakeNewNPAPIStreamInternal(_NPP * npp, const char * relativeURL, const char * target, eNPPStreamTypeInternal type, bool bDoNotify, void * notifyData, unsigned int len, const char * buf, unsigned char file) Line 580	C++
 	xul.dll!mozilla::plugins::parent::_geturlnotify(_NPP * npp, const char * relativeURL, const char * target, void * notifyData) Line 916	C++
 	xul.dll!mozilla::plugins::PluginInstanceParent::AnswerPStreamNotifyConstructor(mozilla::plugins::PStreamNotifyParent * actor, const nsCString & url, const nsCString & target, const bool & post, const nsCString & buffer, const bool & file, short * result) Line 508	C++
 	xul.dll!mozilla::plugins::PPluginInstanceParent::OnCallReceived(const IPC::Message & msg__, IPC::Message * & reply__) Line 2102	C++
 	xul.dll!mozilla::plugins::PPluginModuleParent::OnCallReceived(const IPC::Message & msg__, IPC::Message * & reply__) Line 1377	C++
 	xul.dll!mozilla::ipc::MessageChannel::DispatchInterruptMessage(const IPC::Message & aMsg, unsigned int stackDepth) Line 1347	C++
 	xul.dll!mozilla::ipc::MessageChannel::Call(IPC::Message * aMsg, IPC::Message * aReply) Line 1041	C++
 	xul.dll!mozilla::plugins::PPluginInstanceParent::CallNPP_Destroy(short * rv) Line 735	C++
 	xul.dll!mozilla::plugins::PluginInstanceParent::Destroy() Line 221	C++
 	xul.dll!mozilla::plugins::PluginModuleParent::NPP_Destroy(_NPP * instance, _NPSavedData * * saved) Line 1703	C++
 	xul.dll!nsNPAPIPluginInstance::Stop() Line 351	C++
 	xul.dll!nsPluginHost::StopPluginInstance(nsNPAPIPluginInstance * aInstance) Line 3325	C++
 	xul.dll!nsObjectLoadingContent::DoStopPlugin(nsPluginInstanceOwner * aInstanceOwner, bool aDelayedStop, bool aForcedReentry) Line 3008	C++
 	xul.dll!nsObjectLoadingContent::StopPluginInstance() Line 3074	C++
 	xul.dll!CheckPluginStopEvent::Run() Line 212	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 848	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 265	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 95	C++
 	xul.dll!mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate * aDelegate) Line 290	C++
 	xul.dll!MessageLoop::RunInternal() Line 235	C++
 	xul.dll!MessageLoop::RunHandler() Line 228	C++
 	xul.dll!MessageLoop::Run() Line 202	C++
 	xul.dll!nsBaseAppShell::Run() Line 167	C++
 	xul.dll!nsAppShell::Run() Line 178	C++
 	xul.dll!XRE_RunAppShell() Line 778	C++
 	xul.dll!mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate * aDelegate) Line 259	C++
 	xul.dll!MessageLoop::RunInternal() Line 235	C++
 	xul.dll!MessageLoop::RunHandler() Line 228	C++
 	xul.dll!MessageLoop::Run() Line 202	C++
 	xul.dll!XRE_InitChildProcess(int aArgc, char * * aArgv, mozilla::gmp::GMPLoader * aGMPLoader) Line 618	C++
 	plugin-container.exe!content_process_main(int argc, char * * argv) Line 236	C++
 	plugin-container.exe!NS_internal_main(int argc, char * * argv) Line 11	C++
 	plugin-container.exe!wmain(int argc, wchar_t * * argv) Line 131	C++
 	plugin-container.exe!__tmainCRTStartup() Line 255	C

Comment 2

[Ciprian Muresan [:cmuresan], Ecosystem QA]

From the crash signature [@ mozalloc_abort | NS_DebugBreak | mozilla::net::PNeckoChild::SendPHttpChannelConstructor ], the affected versions are:
- Nightly: 47.0a1, 45.0a1
- Firefox: 44.0