1294449 - Crash in [@ nsIChannel::GetLoadInfo]

Status: RESOLVED DUPLICATE of bug 1294159

(Core :: Networking: HTTP, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-fe50aee2-0a91-4206-a4aa-7e6e12160811.
=============================================================

Seen while looking at Nightly - new crash that started with 20160811030201: http://bit.ly/2b1pNUU

Possible regression from Bug 1268962? ni on Samael.

Comment 1

[Alice0775 White]

This bug was filed from the Socorro interface and is 
report bp-6e7b5543-f013-4312-88fd-1031d2160811.
=============================================================

Reproducible almost 100% probability

Steps To Reproduce:
1. Force enable e10s (My Windows10 seems to be enabled accessibility)
2. Open about:home in a tab
3. Load a url in the tab
   e.g. http://dic.nicovideo.jp/a/%E3%81%A1%E3%81%A3%E3%81%B1%E3%81%84
4. Click Back Button while the page is loading
5. Click Forward Button
6. Repeat Step4-5

Actual Results:
Tag crashes

Comment 2

[Alice0775 White]

Regression window:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6af03871248e7c9841d02d8af38ad9a1b2b7f5a2&tochange=626f8cc8b7bc7d983cfa378ffd4ad5753c142225

Suspect: Bug 1268962

Comment 3

[Alice0775 White]

Browser crashes without e10s as well.
bp-038f40f1-c6c1-4973-bb67-80b3c2160811

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2] (away July 24th - August 16th)]

It seems the stack looks a bit different between platforms. On Linux I can see it as bug 1293891.

0 	libxul.so 	nsPrefetchNode::OnStartRequest 	obj-firefox/dist/include/nsIChannel.h:121
1 	libxul.so 	mozilla::net::nsHttpChannel::CallOnStartRequest 	netwerk/protocol/http/nsHttpChannel.cpp:1138
2 	libxul.so 	mozilla::net::nsHttpChannel::ContinueOnStartRequest2 	netwerk/protocol/http/nsHttpChannel.cpp:6329

It causes crashes each time I restart the browser. So most likely session restore related as well.

Rail disabled updates for Nightly.

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+2] (away July 24th - August 16th)]

This crash actually jumped right up to the #1 top crash for mozilla-central as far as I can see. Maybe we should backout the offending changeset, or at least wait a little while longer for a reply from sawang?

Comment 8

[Tobias B. Besemer [:BesTo] (QA)]

Crashes on Win7 when try to open a report on CMC. E.G.:
https://crash-stats.mozilla.com/report/index/4eb1c414-c66c-4e1e-ae37-483182160811

Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsIChannel::GetLoadInfo() 	obj-firefox/dist/include/nsIChannel.h:121
1 	xul.dll 	nsPrefetchNode::OnStartRequest(nsIRequest*, nsISupports*) 	uriloader/prefetch/nsPrefetchService.cpp:198
2 	xul.dll 	mozilla::net::HttpChannelChild::DoOnStartRequest(nsIRequest*, nsISupports*) 	netwerk/protocol/http/HttpChannelChild.cpp:537
3 	xul.dll 	mozilla::net::HttpChannelChild::OnStartRequest(nsresult const&, mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, bool const&, bool const&, unsigned int const&, nsCString const&, nsCString const&, mozilla::net::NetAddr const&, mozilla::net::NetAddr const&, unsigned int const&) 	netwerk/protocol/http/HttpChannelChild.cpp:468
4 	xul.dll 	mozilla::net::StartRequestEvent::Run() 	netwerk/protocol/http/HttpChannelChild.cpp:336
5 	xul.dll 	mozilla::net::ChannelEventQueue::RunOrEnqueue(mozilla::net::ChannelEvent*, bool) 	obj-firefox/dist/include/mozilla/net/ChannelEventQueue.h:133
6 	xul.dll 	mozilla::net::HttpChannelChild::RecvOnStartRequest(nsresult const&, mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, bool const&, bool const&, unsigned int const&, nsCString const&, nsCString const&, mozilla::net::NetAddr const&, mozilla::net::NetAddr const&, short const&, unsigned int const&, bool const&) 	netwerk/protocol/http/HttpChannelChild.cpp:389
7 	xul.dll 	mozilla::net::PHttpChannelChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PHttpChannelChild.cpp:659
8 	xul.dll 	mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PContentChild.cpp:7438
9 	xul.dll 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp:1662
10 	xul.dll 	mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message&&) 	ipc/glue/MessageChannel.cpp:1600
11 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp:1567
12 	xul.dll 	mozilla::detail::RunnableMethodImpl<void ( mozilla::ipc::MessageChannel::*)(void), 0, 1>::Run() 	obj-firefox/dist/include/nsThreadUtils.h:764
13 	xul.dll 	mozilla::ipc::MessageChannel::DequeueTask::Run() 	obj-firefox/dist/include/mozilla/ipc/MessageChannel.h:565
14 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1058
15 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp:290
16 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:96
17 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:301
18 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:225
19 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:205
20 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
21 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:262
22 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:846
23 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:269
24 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:225
25 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:205
26 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp:676
27 	firefox.exe 	content_process_main(int, char** const) 	ipc/contentproc/plugin-container.cpp:197
28 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
29 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:255
30 	kernel32.dll 	BaseThreadInitThunk 	
31 	ntdll.dll 	RtlUserThreadStart

Comment 9

[Tobias B. Besemer [:BesTo] (QA)]

Sig [@ nsIChannel::GetLoadInfo ] is Win-only but with both architectures:
https://crash-stats.mozilla.com/signature/?product=Firefox&signature=nsIChannel%3A%3AGetLoadInfo

Don't know it for [@ nsPrefetchNode::OnStartRequest ]...
Not sure if sig [@ nsPrefetchNode::OnStartRequest ] is really a dup...

For [@ nsIChannel::GetLoadInfo ]:
Product 	Version 	Count 	Percentage 	Installations
Firefox 	51.0a1 		1880 	100.0% 		684

Comment 10

[Henrik Skupin [:whimboo][⌚️UTC+2] (away July 24th - August 16th)]

Boris, could you tell us which of those two bugs are more likely to have caused this crash?

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=6af03871248e7c9841d02d8af38ad9a1b2b7f5a2&tochange=626f8cc8b7bc7d983cfa378ffd4ad5753c142225

We might want to backout the offending changeset(s). Thanks.

Comment 11

[Henrik Skupin [:whimboo][⌚️UTC+2] (away July 24th - August 16th)]

As Wes mentioned on IRC bug 1268962 added the call to GetLoadInfo() so it should be the affecting changeset.

Comment 12

[Boris Zbarsky [:bzbarsky]]

> could you tell us which of those two bugs are more likely to have caused this crash?

The one this one is marked as blocking; see comment 2 and the "Blocks" field of this bug.  No need to ask me!  ;)

> We might want to backout the offending changeset(s).

Or just land this reviewed fix?  Might be a better idea; less work all around.

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

I ended up backing out 1268962 for this.

Comment 14

[Boris Zbarsky [:bzbarsky]]

Marking duplicate of the bug that has the fix for this....