1363653 - Repeated Crashes [@ IPCError-content | PAltDataOutputStream::Msg_Error Route error: message sent to unknown actor ID ]

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect)

Description

[Ekanan Ketunuti]

+++ This bug was initially created as a clone of Bug #1359106 +++

bp-4082ff52-d373-4cdd-b589-cad140170510
bp-de4633af-d74e-49e9-a9c5-836ae0170510
bp-0b7641c0-3417-4f0a-b23a-68dd60170510
bp-b1fb5275-8fab-4b30-9013-cb8480170510
bp-7c55daf8-19e8-4d6e-98ef-b5a080170510
bp-4c66054e-3079-4007-ac2b-57a510170510
bp-e62326f5-431b-4366-b04b-700980170510
bp-1f9deab7-3b91-4694-816e-2f55c0170510
bp-f715ecb0-2a5f-48d8-8bf3-7eae30170510
bp-5618056f-62e0-4388-be41-ce2060170510
bp-05c28558-dc0b-4c67-bc0e-2d5f90170510
bp-993ff6fa-11e4-44ba-b9f2-bccfc0170510
bp-e57c8492-90ba-405d-99df-8c6290170510
bp-cf882ee3-099f-4625-813d-e59100170510
bp-be5c216d-1a82-4814-88a4-fdfa90170510
bp-e5ff2d54-cc5b-430b-bd8f-b2e650170510
bp-25bb6a67-288c-4ba7-8f90-b37b80170510

The matter's not resolved. The culprit is still at large.

Comment 1

[Valentin Gosu [:valentin]]

This occurs because of a race in destroying the AltDataOutputStreamChild

AltDataOutputStreamChild::Close -> SendClose()
AltDataOutputStreamChild::Release -> Send__delete__()
AltDataOutputStreamParent::RecvClose() -> SendError()
AltDataOutputStreamParent::ActorDestroy -> mIPCOpen = false
AltDataOutputStreamChild::RecvError -> === The object has already been destroyed ===

We need to add releasing mechanism similar to the one in HttpChannelChild/Parent.

Comment 2

[Valentin Gosu [:valentin]]

Attachment: Bug 1363653 - Make AltDataOutputStreamParent not send any messages after object destruction

This patch prevents the following error:
AltDataOutputStreamChild::Close -> SendClose()
AltDataOutputStreamChild::Release -> Send__delete__()
AltDataOutputStreamParent::RecvClose() -> SendError()
AltDataOutputStreamParent::ActorDestroy -> mIPCOpen = false
AltDataOutputStreamChild::RecvError -> === Crash - object was deleted ===

We introduce the DeleteSelf message.
AltDataOutputStreamChild::Release -> SendDeleteSelf()
AltDataOutputStreamParent::RecvDeleteSelf -> mIPCOpen = false; SendDeleteSelf()
AltDataOutputStreamChild::RecvDeleteSelf -> Send__delete__()

The parent will not send any more messages after receiving the DeleteSelf message.

Review commit: https://reviewboard.mozilla.org/r/137958/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/137958/

Comment 3

[Honza Bambas (:mayhemer)]

Comment on attachment 8866326 [details]
Bug 1363653 - Make AltDataOutputStreamParent not send any messages after object destruction

https://reviewboard.mozilla.org/r/137958/#review141642

::: netwerk/protocol/http/AltDataOutputStreamChild.cpp:18
(Diff revision 1)
>    MOZ_ASSERT(NS_IsMainThread(), "Main thread only");
>    --mRefCnt;
>    NS_LOG_RELEASE(this, mRefCnt, "AltDataOutputStreamChild");
>  
>    if (mRefCnt == 1 && mIPCOpen) {
> -    // Send_delete calls NeckoChild::PAltDataOutputStreamChild, which will release
> +    // Only the reference is in the IPDL one. After the parent replies back with

maybe check spelling of the comment

Comment 4

[Valentin Gosu [:valentin]]

Comment on attachment 8866326 [details]
Bug 1363653 - Make AltDataOutputStreamParent not send any messages after object destruction

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/137958/diff/1-2/

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/266e09e18a8e
Make AltDataOutputStreamParent not send any messages after object destruction r=mayhemer

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/266e09e18a8e