1246362 - [FF46.0a2 Nightly e10s enabled] Crashes when delay calling nsIChannelEventSink.asyncOnChannelRedirect

Status: RESOLVED WONTFIX

(Core :: Networking: HTTP, defect)

Description

[Mike Cheung]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0
Build ID: 20160125004010

Steps to reproduce:

// 1. Paste/run following code in browser console's js bar.
// 2. In browser, navigate http://127.0.0.1/redirectTest/

(function redirectTest() {
var Cr = Components.results;
var Cc = Components.classes;
var Ci = Components.interfaces;
var Cu = Components.utils;
var CC = Components.Constructor;
var systemPrincipal = Cc["@mozilla.org/systemprincipal;1"].createInstance(Ci.nsIPrincipal);
var xpcomUtils = Cu.import("resource://gre/modules/XPCOMUtils.jsm").XPCOMUtils;
var ios = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
var os = Cc["@mozilla.org/observer-service;1"].getService(Ci.nsIObserverService);
var Timer = CC("@mozilla.org/timer;1", "nsITimer");

function createChannel(url) {
	var uri = ios.newURI(url, null, null);
	return ios.newChannelFromURI2(uri, null, systemPrincipal, systemPrincipal,
		Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL |
		Ci.nsILoadInfo.SEC_SANDBOXED |
		Ci.nsILoadInfo.SEC_ALLOW_CHROME |
		0,
		Ci.nsIContentPolicy.TYPE_OTHER);
}	

var chOld;
var chNew;
var chSink;
var slOld;
os.addObserver( {
	observe: function(subject, topic, data) {
		var ch;
		try {
			if(subject.QueryInterface(Ci.nsIHttpChannel) && subject.QueryInterface(Ci.nsITraceableChannel)) {
				ch = subject;
				chSink = ch.notificationCallbacks && ch.notificationCallbacks.getInterface(Ci.nsIChannelEventSink);
			}
		} catch(e) {}
		if(!chSink || ch.URI.spec != "http://127.0.0.1/redirectTest/" || !ch.isPending()) 
			return;
		slOld = ch.setNewListener(this);
		chOld = ch;
		ch.cancel(Cr.NS_BINDING_REDIRECTED);
	},
	onStartRequest: function(request, context) {
		if(!chNew) {
			chNew = createChannel("http://www.hkix.net/");
			var tmr = new Timer();
			tmr.initWithCallback({
				notify: function() {
					tmr = null;
					chSink.asyncOnChannelRedirect(chOld, chNew, Ci.nsIChannelEventSink.REDIRECT_INTERNAL, {
						onRedirectVerifyCallback: function(result) {},
						QueryInterface: xpcomUtils.generateQI([Ci.nsIAsyncVerifyRedirectCallback])		
					});
					chNew.asyncOpen(slOld, context);
					chNew = null;			
				}
			}, 2000, Ci.nsITimer.TYPE_ONE_SHOT);	
		}
	},
	onDataAvailable: function(request, context, stream, offset, count) {
	},
	onStopRequest: function(request, context, status) {
	},
	QueryInterface: xpcomUtils.generateQI([Ci.nsIStreamListener, Ci.nsIRequestObserver])	
}, "http-on-modify-request", false);
})();


Actual results:

FF46.0a2 Nightly CRASHES!!!


Expected results:

Should redirect to http://www.hkix.net/ successfully, like FF45.0a2 and previous versions.

Comment 1

[YF (Yang)]

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c8b3cb42bfc89d33fea0dece9e85e95eb702aebe&tochange=0e1c61bab50217a583ab7ddadd3ac4095a463897

Comment 2

[Honza Bambas (:mayhemer)]

Can you provide a stack trace?  (Either a crash report link from about:crashes or copy-paste from a debugger.)  Thanks.

Comment 3

[Honza Bambas (:mayhemer)]

(comment 2)

Comment 4

[Honza Bambas (:mayhemer)]

Ah!  There is a crash signature assigned to this bug.  Looking at it now.

Comment 5

[Honza Bambas (:mayhemer)]

You are not doing the right thing.  You cannot call asyncOnChannelRedirect this way.  You actually don't need to.  If you want to alter the URL (which is all I can see here being done, right?) you can do one of the following:

- you don't need to redirect.  Just open a new channel and give it the listener.  Not very legal according that you bypass redirect veto listeners, but possible

- use redirectTo() API on nsIHttpChannel interface (preferred) ; you can suspend the "old" channel for your two seconds if needed


BTW, I'm failing MOZ_ASSERT(parentListener) at HttpChannelParent::ConnectChannel with your test case.