1368561 - Crash in IPC::ParamTraits<mozilla::net::NetAddr>::Write

Status: RESOLVED DUPLICATE of bug 1334907

(Core :: Networking, defect)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-7b5e7e6a-9ba2-4ca5-8e6b-848e90170529.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	IPC::ParamTraits<mozilla::net::NetAddr>::Write(IPC::Message*, mozilla::net::NetAddr const&) 	obj-firefox/dist/include/mozilla/net/NeckoMessageUtils.h:111
1 	xul.dll 	mozilla::net::PHttpChannelParent::SendOnStartRequest(nsresult const&, mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, bool const&, bool const&, unsigned int const&, nsCString const&, nsCString const&, mozilla::net::NetAddr const&, mozilla::net::NetAddr const&, short const&, unsigned int const&, nsCString const&) 	obj-firefox/ipc/ipdl/PHttpChannelParent.cpp:94
2 	xul.dll 	mozilla::net::HttpChannelParent::OnStartRequest(nsIRequest*, nsISupports*) 	netwerk/protocol/http/HttpChannelParent.cpp:1190
3 	xul.dll 	mozilla::net::HttpChannelParentListener::OnStartRequest(nsIRequest*, nsISupports*) 	netwerk/protocol/http/HttpChannelParentListener.cpp:72
4 	xul.dll 	mozilla::net::nsHttpChannel::CallOnStartRequest() 	netwerk/protocol/http/nsHttpChannel.cpp:1322
5 	xul.dll 	mozilla::net::nsHttpChannel::ContinueProcessNormal(nsresult) 	netwerk/protocol/http/nsHttpChannel.cpp:2403
6 	xul.dll 	mozilla::net::nsHttpChannel::ProcessNormal() 	netwerk/protocol/http/nsHttpChannel.cpp:2338
7 	xul.dll 	mozilla::net::nsHttpChannel::ContinueProcessResponse2(nsresult) 	netwerk/protocol/http/nsHttpChannel.cpp:2233
8 	xul.dll 	mozilla::net::nsHttpChannel::ContinueProcessResponse1() 	netwerk/protocol/http/nsHttpChannel.cpp:2090
9 	xul.dll 	mozilla::net::nsHttpChannel::ProcessResponse() 	netwerk/protocol/http/nsHttpChannel.cpp:2010
10 	xul.dll 	mozilla::net::nsHttpChannel::OnStartRequest(nsIRequest*, nsISupports*) 	netwerk/protocol/http/nsHttpChannel.cpp:6509
11 	xul.dll 	nsInputStreamPump::OnStateStart() 	netwerk/base/nsInputStreamPump.cpp:524
12 	xul.dll 	nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) 	netwerk/base/nsInputStreamPump.cpp:426
13 	xul.dll 	nsInputStreamReadyEvent::Run() 	xpcom/io/nsStreamUtils.cpp:95
14 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1240
15 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp:390
16 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:124
17 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc:231
18 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:211
19 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:156
20 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:262
21 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp:283
22 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp:4477
23 	xul.dll 	XREMain::XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4654
24 	xul.dll 	XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/nsAppRunner.cpp:4745
25 	xul.dll 	mozilla::BootstrapImpl::XRE_main(int, char** const, mozilla::BootstrapConfig const&) 	toolkit/xre/Bootstrap.cpp:45
26 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
27 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
28 	kernel32.dll 	BaseThreadInitThunk 	
29 	ntdll.dll 	__RtlUserThreadStart 	
30 	ntdll.dll 	_RtlUserThreadStart

reports with this signature are regressing in volume starting with firefox 53 and later builds on windows. those reports have MOZ_CRASH(Unknown socket family) which was added in bug 1270247.

Comment 1

[u408661]

So if I could see the annotation which is supposed to be present in this case, there might be something doable here. However, I can't figure out how to see the annotation (assuming it actually got made). :mccr8, you wrote the patch that added the annotation here, can you figure out how to view it on Socorro?

Comment 2

[Andrew McCreight [:mccr8]]

(In reply to Nicholas Hurley [:nwgh][:hurley] (also [e-mail]) from comment #1)
> So if I could see the annotation which is supposed to be present in this
> case, there might be something doable here. However, I can't figure out how
> to see the annotation (assuming it actually got made). :mccr8, you wrote the
> patch that added the annotation here, can you figure out how to view it on
> Socorro?

You probably need crash dump access to see them, as annotations are private by default. I went through and looked at 20 different reports from various versions, and in every single one the annotation was 58853. I guess this annotation isn't indexed or whatever so I couldn't search or facet on it. Hopefully that's enough information to go on. You could file a bug about making it public if that would be useful.

Comment 3

[Valentin Gosu [:valentin] (he/him) {{ FYI: OOO 14 June - 4 August }}]

The hex for 58853 is E5E5... maybe the memory was already freed?

Comment 4

[u408661]

That's how it appears. This also appears to be a dupe of 1334907.

Comment 5

[Gerry Chang [:gchang]]

Mark 54 won't fix as the volume of crashes is low.