1286906 - Crash in nsTArray_Impl<T>::DestructRange | nsTArray_Impl<T>::ReplaceElementsAt<T> | mozilla::net::nsHttpRequestHead::SetHeaders

Status: RESOLVED DUPLICATE of bug 1145613

(Core :: Networking: HTTP, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-45f2e12d-19ef-4888-b25a-fae382160714.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	std::_Atomic_fetch_add_4(unsigned long volatile*, unsigned long, std::memory_order) 	C:/Program Files (x86)/Microsoft Visual Studio 12.0/VC/include/xatomic.h:1674
1 	xul.dll 	nsTArray_Impl<mozilla::net::nsHttpHeaderArray::nsEntry, nsTArrayInfallibleAllocator>::DestructRange(unsigned int, unsigned int) 	obj-firefox/dist/include/nsTArray.h:2014
2 	xul.dll 	nsTArray_Impl<mozilla::net::nsHttpHeaderArray::nsEntry, nsTArrayInfallibleAllocator>::ReplaceElementsAt<mozilla::net::nsHttpHeaderArray::nsEntry, nsTArrayInfallibleAllocator>(unsigned int, unsigned int, mozilla::net::nsHttpHeaderArray::nsEntry const*, unsigned int) 	obj-firefox/dist/include/nsTArray.h:1270
3 	xul.dll 	mozilla::net::nsHttpRequestHead::SetHeaders(mozilla::net::nsHttpHeaderArray const&) 	netwerk/protocol/http/nsHttpRequestHead.cpp:49
4 	xul.dll 	mozilla::net::HttpChannelChild::OnStartRequest(nsresult const&, mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, bool const&, bool const&, unsigned int const&, nsCString const&, nsCString const&, mozilla::net::NetAddr const&, mozilla::net::NetAddr const&, unsigned int const&) 	netwerk/protocol/http/HttpChannelChild.cpp:454
5 	xul.dll 	mozilla::net::StartRequestEvent::Run() 	netwerk/protocol/http/HttpChannelChild.cpp:340
6 	xul.dll 	mozilla::net::ChannelEventQueue::RunOrEnqueue(mozilla::net::ChannelEvent*, bool) 	obj-firefox/dist/include/mozilla/net/ChannelEventQueue.h:133
7 	xul.dll 	mozilla::net::HttpChannelChild::RecvOnStartRequest(nsresult const&, mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, bool const&, bool const&, unsigned int const&, nsCString const&, nsCString const&, mozilla::net::NetAddr const&, mozilla::net::NetAddr const&, short const&, unsigned int const&) 	netwerk/protocol/http/HttpChannelChild.cpp:390
8 	xul.dll 	mozilla::net::PHttpChannelChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PHttpChannelChild.cpp:548
9 	xul.dll 	mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PContentChild.cpp:6302
10 	xul.dll 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp:1654
11 	xul.dll 	mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) 	ipc/glue/MessageChannel.cpp:1592
12 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp:1559
13 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc:444
14 	ntdll.dll 	RtlWakeAllConditionVariable

this is a low-volume crash signature in the content process that was introduced in 48.0b3.

out of the changelog from beta2 to beta3 at https://hg.mozilla.org/releases/mozilla-beta/pushloghtml?fromchange=FIREFOX_48_0b2_RELEASE&tochange=FIREFOX_48_0b3_RELEASE bug 1269738 looks like it may be related.

Comment 1

[Dragana Damjanovic [:dragana]]

Bug 1269738 added a lock for nsHttpRequestHead. This should actually eliminate this kind of crashes :)

All crashes are in mozilla::net::HttpChannelChild::OnStartRequest. This is probably related to bug 1273043

I am wondering if HttpChannelChild has been already destroyed before OnStartRequest is called?

Comment 2

[Dragana Damjanovic [:dragana]]

I will wait if change in bug 1273043 will give some clue what is going on.