1297314 - Crash in mozilla::ipc::FatalError | mozilla::dom::PContentParent::Write from ContentParent::RecvKeywordToURI()

Status: RESOLVED FIXED

(Core :: IPC, defect, critical)

Description

[Ting-Yu Chou [:ting] (away)]

This bug was filed from the Socorro interface and is 
report bp-ba5afd84-0a3d-49b4-ba23-61b8d2160822.
=============================================================

#14 of 0821 Nightly on Windows, 8 crashes from 4 installations.

IPCFatalErrorMsg: unknown union type
IPCFatalErrorProtocol: PContentParent

The OptionalInputStreamParams has mType 0x0 (T_None).

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

I guess we need to find where OptionalInputStreamParams is being created without at least being set to void_t().

Comment 2

[Ting-Yu Chou [:ting] (away)]

Attachment: Bug 1297314 - Initialize IPC union parameters to void_t for the case when RecvKeywordToURI() returns early.

Review commit: https://reviewboard.mozilla.org/r/73758/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/73758/

Comment 3

[Tom Schuster [:evilpie]]

Comment on attachment 8784227 [details]
Bug 1297314 - Initialize IPC union parameters to void_t for the case when RecvKeywordToURI() returns early.

Sorry, I am not a peer for this. Does look good to me though. providerName doesn't need to be set explicitly?

Comment 4

[Ting-Yu Chou [:ting] (away)]

providerName is initialized to an empty string, so it doesn't need to be set explicitly.

Comment 5

[Kan-Ru Chen [:kanru] (UTC+8)]

Comment on attachment 8784227 [details]
Bug 1297314 - Initialize IPC union parameters to void_t for the case when RecvKeywordToURI() returns early.

https://reviewboard.mozilla.org/r/73758/#review71904

smaug transfered the review to me.

LGTM to me. I think we should make a true Option type in ipdl in order to prevent error like this.

Comment 6

[Ting-Yu Chou [:ting] (away)]

Try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=aac1fcde1c8e

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/88a167d7e7fd
Initialize IPC union parameters to void_t for the case when RecvKeywordToURI() returns early. r=kanru

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/88a167d7e7fd

Comment 9

[Release mgmt bot [:sylvestre / :calixte / :marco for bugbug]]

Crash volume for signature 'mozilla::ipc::FatalError | mozilla::dom::PContentParent::Write':
 - nightly (version 51): 60 crashes from 2016-08-01.
 - aurora  (version 50): 42 crashes from 2016-08-01.
 - beta    (version 49): 1 crash from 2016-08-02.
 - release (version 48): 0 crashes from 2016-07-25.
 - esr     (version 45): 0 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly      33       8       6
 - aurora       18       1       0
 - beta          1       0       0
 - release       0       0       0
 - esr           0       0       0

Affected platforms: Windows, Mac OS X

Crash rank on the last 7 days:
           Browser     Content   Plugin
 - nightly #19
 - aurora  #27
 - beta
 - release
 - esr

Comment 10

[Liz Henry (:lizzard)]

Startup crash fixed in 51, and showing up in 50. 
Can you request uplift to aurora? Thanks!

Comment 11

[Ting-Yu Chou [:ting] (away)]

Comment on attachment 8784227 [details]
Bug 1297314 - Initialize IPC union parameters to void_t for the case when RecvKeywordToURI() returns early.

Approval Request Comment
[Feature/regressing bug #]: 905761
[User impact if declined]: crash if ContentParent::RecvKeywordToURI returns early
[Describe test coverage new/current, TreeHerder]: current tests
[Risks and why]: low, simply initialize uninitialized variables
[String/UUID change made/needed]: n/a

Comment 12

[Ritu Kothari (:ritu)]

Comment on attachment 8784227 [details]
Bug 1297314 - Initialize IPC union parameters to void_t for the case when RecvKeywordToURI() returns early.

Crash fix that seems simple enough, Aurora50+

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/d73c5a331a0f

Comment 14

[Liz Henry (:lizzard)]

Wontfix for 49 as we are heading into the RC build next week.

Comment 15

[Andrei Vaida [:avaida]]

This is still reproducible on Fx50 in low volume, (~) based on crash data from the last 20 days.

  SIGNATURE   | mozilla::ipc::FatalError | mozilla::dom::PContentParent::Write
  ----------------------------------------------------------------------------
  CRASH STATS | http://tinyurl.com/ja2n9pj
  ----------------------------------------------------------------------------
  OVERVIEW    | 0 crashes on nightly 52
	      | 0 crashes on nightly 51
	      | 0 crashes on aurora 51
	      | 0 crashes on nightly 50
	      | 8 crashes on aurora 50
	      | 0 crashes on beta 50
  ----------------------------------------------------------------------------
  LAST CRASH  | 2016-09-09 (on 50.0a2)

Comment 16

[Kan-Ru Chen [:kanru] (UTC+8)]

The signature is pretty general so although the top signature is same, I believe the new crashes on 50 is different issue.

Comment 17

[alex_mayorga]

¡Hola Ting-Yu!

This signature is still top 35 crash for Nightly (53) as of today.

More crashes at https://crash-stats.mozilla.com/signature/?product=Firefox&signature=mozilla%3A%3Aipc%3A%3AFatalError%20%7C%20mozilla%3A%3Adom%3A%3APContentParent%3A%3AWrite

Shall this be reopened or a new bug filed?

¡Gracias!
Alex

Comment 18

[Ting-Yu Chou [:ting] (away)]

The crashes (reason EXCEPTION_BREAKPOINT) you see now is bug 1323220.