1267000 - HTTPS proxy results Firefox crash in mozilla::net::SpdyStream31::ChannelPipeFull

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[JustOff]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
Build ID: 20160204200225

Steps to reproduce:

Enable HTTPS proxy via PAC or nsIProtocolProxyService filter API. 

For example, open Advanced->Network->Settings and enter to Automated proxy configuration URL following:

data:text/plain,%20function%20FindProxyForURL(url,%20host)%20{return%20'HTTPS%20de11.zenguard.org:443';}

Try to load any page.


Actual results:

Crash: https://crash-stats.mozilla.com/report/index/1bd6472d-ae4c-4d05-8d54-d96992160423



Expected results:

Should not crash. 

Last good build is 47.0a1 from 20160205030204. Starting 47.0a1 from 20160206030207 and up to current trunc crush is observed.

Comment 1

[Valentin Gosu [:valentin] (he/him)]

The changelog and regression range points to bug 1241906 and
https://hg.mozilla.org/mozilla-central/rev/e56a38a1a4ff

Comment 2

[Patrick McManus [:mcmanus]]

[Tracking Requested - why for this release]:

Comment 3

[Patrick McManus [:mcmanus]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3357752eeafd

Comment 4

[Patrick McManus [:mcmanus]]

Attachment: null deref with spdy proxy

Comment 5

[Patrick McManus [:mcmanus]]

This turns out to be a simple case of the stack turning the member null.. we already have a local copy of the pointer for this reason and should have used it in the first place.

The regressing bug 1241906 was spdy only, so this doesn't impact h2.

Comment 6

[Patrick McManus [:mcmanus]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/96fcd451837947758b704a85993a655831f50a5c
Bug 1267000 - null deref with spdy proxy r=hurley

Comment 7

[Patrick McManus [:mcmanus]]

Comment on attachment 8746179 [details] [diff] [review]
null deref with spdy proxy

Approval Request Comment
[Feature/regressing bug #]: 1241906
[User impact if declined]: null crashes when using spdy based https proxies
[Describe test coverage new/current, TreeHerder]: mix of manual and treeherder
[Risks and why]: extremely low small targeted fix
[String/UUID change made/needed]: none

this fixes a crash regression in 47

Comment 8

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Tracked on 47+. This was mentioned as a top crasher on 47.0b1 at the channel meeting.

Comment 9

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8746179 [details] [diff] [review]
null deref with spdy proxy

Crash fix, Aurora48+, Beta47+

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/96fcd4518379

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/a48ee51d7631

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-beta/rev/5eabfc6b184e