1274886 - Abort in IPCError-content | (msgtype=0x800017,name=???) Route error: message sent to unknown actor ID

Status: RESOLVED FIXED

(Core :: Networking, defect)

Description

[Nicholas Nethercote [inactive]]

This bug was filed from the Socorro interface and is 
report bp-503cfc76-7a5d-4d6f-acf4-344ba2160521.
=============================================================

We have 16 of these, going back to March:

https://crash-stats.mozilla.com/signature/?product=Firefox&date=%3E%3D2016-01-20&signature=IPCError-content+%7C+(msgtype%3D0x800017%2Cname%3D%3F%3F%3F)+Route+error%3A+message+sent+to+unknown+actor+ID&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&page=1

billm, any ideas?

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Well, the message seems to be PHttpChannel::Redirect1Begin. It seems like this message is being sent by the parent. By the time it's received in the child, the HTTP channel actor has been destroyed. This could happen because the child side already did Send__delete__. Or the channel could be getting destroyed because the process is shutting down. I don't see any evidence that this is happening during shutdown, though.

I'll send this to Necko.

Comment 2

[Valentin Gosu [:valentin] (he/him)]

(In reply to Bill McCloskey (:billm) from comment #1)
> Well, the message seems to be PHttpChannel::Redirect1Begin. It seems like
> this message is being sent by the parent. By the time it's received in the
> child, the HTTP channel actor has been destroyed. This could happen because
> the child side already did Send__delete__. Or the channel could be getting
> destroyed because the process is shutting down. I don't see any evidence
> that this is happening during shutdown, though.
> 
> I'll send this to Necko.

So, right now HttpChannelParent calls SendDeleteSelf() [step 1], which the child receives, and processes then calls Send__delete__(this) [step 2], which will trigger HttpChannelParent::ActorDestroy() being called - which sets mIPCClosed = true [step 3].

Should the parent avoid to sending messages after [step 1]?

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Correct, the parent needs to avoid sending any messages after SendDeleteSelf.

Comment 4

[Jim Mathies [:jimm]]

Valentin, the e10s team felt this could cause problems down the road if popular sites manage to trigger it. Hence we're thinking it should block e10s rollout. It also sounds like it should be pretty easy to fix. Does the necko team concur and if so, can you all pick this up and get it fixed and uplifted to 48?

Comment 5

[Valentin Gosu [:valentin] (he/him)]

Definitely. I'll upload a patch and nominate 48 after review. Thanks.

Comment 6

[Valentin Gosu [:valentin] (he/him)]

Attachment: Don't send any more IPC messages after calling PHttpChannelParent::SendDeleteSelf()

MozReview-Commit-ID: 4EE91hvErM7

Comment 7

[Valentin Gosu [:valentin] (he/him)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=caaae904a452

Comment 8

[Jason Duell]

Comment on attachment 8761691 [details] [diff] [review]
Don't send any more IPC messages after calling PHttpChannelParent::SendDeleteSelf()

Review of attachment 8761691 [details] [diff] [review]:
-----------------------------------------------------------------

Nominating for uplift.  Simple patch that prevents an e10s-only crash.

Comment 9

[Valentin Gosu [:valentin] (he/him)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c109d0b45e8aa440b588c1a862b0ca5b83ee050e
Bug 1274886 - Don't send any more IPC messages after calling PHttpChannelParent::SendDeleteSelf() r=jduell

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c109d0b45e8a

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Jason, could you fill the uplift form? I cannot evaluate the impact without it.
Thanks

Comment 12

[Jason Duell]

Comment on attachment 8761691 [details] [diff] [review]
Don't send any more IPC messages after calling PHttpChannelParent::SendDeleteSelf()

Approval Request Comment
[Feature/regressing bug #]: old
[User impact if declined]:  e10s crashes
[Describe test coverage new/current, TreeHerder]: lots of existing tests
[Risks and why]:  extremely low
[String/UUID change made/needed]: none

Comment 13

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8761691 [details] [diff] [review]
Don't send any more IPC messages after calling PHttpChannelParent::SendDeleteSelf()

Fix a crash, taking it
Should be in 48 beta 3

Comment 14

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e627ab32ecfb

Comment 15

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-beta/rev/dc94a369bf09