1346368 - Crash in IPCError-browser | PNecko::Msg_PHttpChannelConstructor Value error: message was deserialized, but contained an illegal

Status: RESOLVED WORKSFORME

(Core :: Networking, defect, P3)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-a9b25959-9db1-4c2a-8452-254d32170310.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	MOZ_Z_inflate_fast 	modules/zlib/src/inffast.c:187
1 	xul.dll 	MOZ_Z_inflate 	modules/zlib/src/inflate.c:1024
2 	xul.dll 	mozilla::net::nsHTTPCompressConv::OnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned __int64, unsigned int) 	netwerk/streamconv/converters/nsHTTPCompressConv.cpp:401
3 	xul.dll 	mozilla::net::HttpChannelChild::DoOnDataAvailable(nsIRequest*, nsISupports*, nsIInputStream*, unsigned __int64, unsigned int) 	netwerk/protocol/http/HttpChannelChild.cpp:800
4 	xul.dll 	mozilla::net::HttpChannelChild::OnTransportAndData(nsresult const&, nsresult const&, unsigned __int64, unsigned __int64 const&, unsigned __int64 const&, unsigned int const&, nsCString const&) 	netwerk/protocol/http/HttpChannelChild.cpp:730
5 	xul.dll 	mozilla::net::TransportAndDataEvent::Run() 	netwerk/protocol/http/HttpChannelChild.cpp:603
6 	xul.dll 	mozilla::net::ChannelEventQueue::RunOrEnqueue(mozilla::net::ChannelEvent*, bool) 	obj-firefox/dist/include/mozilla/net/ChannelEventQueue.h:133
7 	xul.dll 	mozilla::net::HttpChannelChild::RecvOnTransportAndData(nsresult const&, nsresult const&, unsigned __int64 const&, unsigned __int64 const&, unsigned __int64 const&, unsigned int const&, nsCString const&) 	netwerk/protocol/http/HttpChannelChild.cpp:630
8 	xul.dll 	mozilla::net::PHttpChannelChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PHttpChannelChild.cpp:730
9 	xul.dll 	mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PContentChild.cpp:5877
10 	xul.dll 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp:1743
11 	xul.dll 	mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message&&) 	ipc/glue/MessageChannel.cpp:1681
12 	xul.dll 	mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) 	ipc/glue/MessageChannel.cpp:1572
13 	xul.dll 	mozilla::ipc::MessageChannel::MessageTask::Run() 	ipc/glue/MessageChannel.cpp:1597
14 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1216
15 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:96
16 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:301
17 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:225
18 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:205
19 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
20 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:262
21 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:866
22 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:269
23 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:225
24 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:205
25 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp:698
26 	firefox.exe 	content_process_main(int, char** const) 	ipc/contentproc/plugin-container.cpp:197
27 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
28 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
29 	kernel32.dll 	BaseThreadInitThunk 	
30 	ntdll.dll 	__RtlUserThreadStart 	
31 	ntdll.dll 	_RtlUserThreadStart

this is a low level e10s crash signature regressing since 52 beta builds, it seems to happen seldom enough so that there aren't any reports from nightly or aurora users.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Dragana, is this something you might have cycles to help investigate?

Comment 3

[Dragana Damjanovic [:dragana]]

I have investigated bug 1347826. I believe it is covering all this crashes, but maybe not, I do not know. If we find way to fix 1347826, we can check if this one is fixed too.

Comment 4

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 5

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 6

[Chris Peterson [:cpeterson]]

This is currently the top crash in GeckoView 62 (Focus), but every stack trace looks different. I don't know why they all have the PNecko::Msg_PHttpChannelConstructor crash signature.

Comment 7

[David Bolter [:davidb] (NeedInfo me for attention)]

[Tracking Requested - why for this release]: Not sure we want to track this... we can't really block on it while low volume.

Comment 8

[Chris Peterson [:cpeterson]]

The [@ IPCError-browser | PNecko::Msg_PWebSocketConstructor Value error: message was deserialized, but contained an illegal va] crashes are probably the same Necko issue.

Comment 9

[Chris Peterson [:cpeterson]]

No-Jun says he is seeing this crash signature when testing Focus + GeckoView 64 on the Nimbledroid page load tests:

https://github.com/mozilla-mobile/focus-android/issues/3918l

Comment 10

[Chris Peterson [:cpeterson]]

Dragana, No-Jun says our Nimbledroid tests (for Firefox Focus using GeckoView) started hitting this crash consistently on every submission starting about two weeks ago. That would be when Focus updated from GeckoView 62 to 64 Beta.

The Nimbledroid tests are running on old Nexus 5 devices with Android 5 (Lollipop). The Nimbledroid rep says he was able to locally repro it on his Nexus 5 twice in a row.

Is there any information or tests we can get from Nimbledroid that might help you diagnose this crash?

Comment 11

[Dragana Damjanovic [:dragana]]

Can someone make a http log:

https://developer.mozilla.org/en-US/docs/Mozilla/Debugging/HTTP_logging

Comment 12

[Marcia Knous [:marcia]]

No-Jun - Are you able to help get a Log? Won't fixing 63 and ESR per triage discussion today.

Comment 13

[No-Jun Park [:njpark]]

Attachment: adb log when crash happens on Focus Geckoview

We're seeing this crash on Focus Geckoview, so I don't think I can get http log, but this is the full adb log when this happens.

Comment 14

[No-Jun Park [:njpark]]

When this happens, Focus is just launched, and shortly it crashes with this error.

Comment 15

[Chris Peterson [:cpeterson]]

Focus GeckoView does not currently pass environment variables (like MOZ_LOG) to GeckoView, so we can't enable HTTP logging yet. No-Jun will file a Focus bug to add environment variable support so we can enable logging.

Comment 16

[No-Jun Park [:njpark]]

Created https://github.com/mozilla-mobile/focus-android/issues/3962

(In reply to Chris Peterson [:cpeterson] from comment #15)
> Focus GeckoView does not currently pass environment variables (like MOZ_LOG)
> to GeckoView, so we can't enable HTTP logging yet. No-Jun will file a Focus
> bug to add environment variable support so we can enable logging.

Comment 17

[Dragana Damjanovic [:dragana]]

I see:

/Gecko   ( 6670): NeckoParent::AllocPHttpChannelParent: FATAL error: App does not have permission: KILLING CHILD PROCESS
I/Gecko   ( 6670): 
I/Gecko   ( 6670): ###!!! [Parent][DispatchAsyncMessage] Error: PNecko::Msg_PHttpChannelConstructor Value error: message was deserialized, but contained an illegal value


The problem may be in 
https://searchfox.org/mozilla-central/source/netwerk/ipc/NeckoParent.cpp#295

it is probably the requestingPrincipal that cannot be deserialized?

Can we add some assertions to geckoview and rebuild it?

I would add assertions before
https://searchfox.org/mozilla-central/source/netwerk/protocol/http/HttpChannelChild.cpp#3007
(try to deserialize arguments and assert if it fails)

Comment 18

[BugBot [:suhaib / :marco]]

Closing because no crashes reported for 12 weeks.