1277961 - Crash in mozalloc_abort | NS_DebugBreak | mozilla::ipc::FatalError | mozilla::net::PNeckoChild::Write

Status: RESOLVED DUPLICATE of bug 1277582

(Core :: Networking: HTTP, defect, P1)

Description

[Andrew McCreight [:mccr8]]

This bug was filed from the Socorro interface and is 
report bp-3c46782a-5ef5-4d5e-a799-3635a2160603.
=============================================================

Right now, this is a #8 crash for the last 7 days, when looking at build date.

I'm not sure which fatal error this is. I think the two for this method are:
  FatalError("NULL actor value passed to non-nullable param");
  FatalError("actor has been |delete|d");

Comment 1

[Josh Matthews [:jdm]]

Oh wow, this is a beacon that is being initiated as a result of a page being hidden. Specifically, the page is being hidden as a result of TabChild::ActorDestroy, so guess which tab child we try to send along with the new HTTP request?

Comment 2

[Jim Mathies [:jimm]]

[Tracking Requested - why for this release]:
top crash in 49.

The uptime on all of these is 0 and the browser is in shutdown. Not sure how that might come about.

The two signatures here are #2 and # 7 in 49.0a1.

Here's a combined supersearch for both signatures - 

https://crash-stats.mozilla.com/search/?product=Firefox&signature=%3Dmozalloc_abort%20%7C%20NS_DebugBreak%20%7C%20mozilla%3A%3Aipc%3A%3AFatalError%20%7C%20mozilla%3A%3Anet%3A%3APNeckoChild%3A%3AWrite&signature=%3Dmozalloc_abort%20%7C%20NS_DebugBreak%20%7C%20mozilla%3A%3Aipc%3A%3AFatalError%20%7C%20mozilla%3A%3Anet%3A%3APNeckoChild%3A%3AFatalError%20%7C%20mozilla%3A%3Anet%3A%3APNeckoChild%3A%3AWrite&_facets=signature&_facets=uptime&_facets=shutdown_progress&_facets=ipc_channel_error&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-uptime

Comment 3

[Jim Mathies [:jimm]]

Correction, this signature is number #7, #2 is bug 1277582.

Comment 4

[Marcia Knous [:marcia]]

Tracking this top crash - 49+

Comment 5

[jorge alves]

This happens to me when shutting down the system without closing firefox.

Crash report: https://crash-stats.mozilla.com/report/index/1ed4ba6b-5e83-4762-a898-629062160617

Comment 6

[Cervantes Yu [:cyu] [:cervantes]]

From the crash stack in report bp-3c46782a-5ef5-4d5e-a799-3635a2160603, we see mozilla::ipc::MessageChannel::OnNotifyMaybeChannelError(), which indicates that the child process observes IPC channel breakage (due to parent process shutdown). From the raw dump, the crash reason is "actor has been |delete|d". So we need to prevent reusing the dead/dying PBrowserChild by PNeckoChild deep inside the stack of PBrowserChild::ActorDestroy().

Comment 7

[Cervantes Yu [:cyu] [:cervantes]]

Attachment: Don't use a destoryed TabChild in HttpChannelChild::ContinueAsyncOpen().

Maybe HttpChannelChild::ConnectParent() also needs this check?

Comment 8

[Liz Henry (:lizzard) (relman/hg->git project)]

Noting this is still the #2 topcrash in 49, so if we do get an effective fix into m-c please request uplift to aurora.

Comment 9

[Cervantes Yu [:cyu] [:cervantes]]

Hi Valentin, are you currently working on this bug? If not I'd like to proceed with the current patch. Thanks.

Comment 10

[Valentin Gosu [:valentin] (he/him)]

Hi Cervantes. Yes, I have a patch in bug 1277582.

Comment 11

[Cervantes Yu [:cyu] [:cervantes]]

Comment on attachment 8765853 [details] [diff] [review]
Don't use a destoryed TabChild in HttpChannelChild::ContinueAsyncOpen().

Obsolete this patch since bug 1277582 now has covered this bug with a new revision.

Comment 13

[Liz Henry (:lizzard) (relman/hg->git project)]

Tracking this in bug 1277582.