139817 - M1RC1 topcrash [@ nsHttpChannel::OnStartRequest]

Status: VERIFIED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Jan Carpenter]

This stack signature is a topcrasher for M1RC1

Source File :
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp
line : 2764
 
====================================================================================================
     Count   Offset    Real Signature
[ 9   nsHttpChannel::OnStartRequest 816aebcf - nsHttpChannel::OnStartRequest ]
[ 1   nsHttpChannel::OnStartRequest 52d896b0 - nsHttpChannel::OnStartRequest ]
[ 1   nsHttpChannel::OnStartRequest 3376e484 - nsHttpChannel::OnStartRequest ]
 
     Crash date range: 2002-04-19 to 2002-04-21
     Min/Max Seconds since last crash: 75 - 121387
     Min/Max Runtime: 1097 - 156249
     Keyword List :  
     Count   Platform List 
     7   Windows 98 4.10 build 67766446
     3   Windows NT 5.0 build 2195
     1   Windows NT 4.0 build 1381
 
     Count   Build Id List 
     11   2002041717
 
     No of Unique Users         7
 
 Stack trace(Frame) 

	 nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line
2764] 
	 nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 162] 
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 597] 
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1078] 
	 0x778b0c24   
 
     (5449930)	URL: www.time.com
     (5449162)	URL: www.time.com
     (5420368)	URL: www.time.com
     (5418069)	URL: www.time.com
 
====================================================================================================
     Count   Offset    Real Signature
[ 9   nsHttpChannel::OnStartRequest 6cf7bbab - nsHttpChannel::OnStartRequest ]
[ 2   nsHttpChannel::OnStartRequest 05541557 - nsHttpChannel::OnStartRequest ]
[ 1   nsHttpChannel::OnStartRequest f4ffefa1 - nsHttpChannel::OnStartRequest ]
[ 1   nsHttpChannel::OnStartRequest f2f15efc - nsHttpChannel::OnStartRequest ]
[ 1   nsHttpChannel::OnStartRequest 823d727f - nsHttpChannel::OnStartRequest ]
[ 1   nsHttpChannel::OnStartRequest 60ead911 - nsHttpChannel::OnStartRequest ]
 
     Crash date range: 2002-04-19 to 2002-04-22
     Min/Max Seconds since last crash: 1034 - 86567
     Min/Max Runtime: 1034 - 87901
     Keyword List :  
     Count   Platform List 
     10   Windows NT 5.0 build 2195
     5   Windows NT 5.1 build 2600
 
     Count   Build Id List 
     15   2002041717
 
     No of Unique Users        14
 
 Stack trace(Frame) 

	 nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp  line
2764] 
	 nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp  line 162] 
	 PL_HandleEvent
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 597] 
	 _md_EventReceiverProc
[d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c  line 1078] 
	 SETUPAPI.DLL + 0x30c24 (0x778b0c24)   
 
     (5431066)	Comments: opening a ton of tabs on Google's image search. about 10.
     (5392676)	URL: http://scroner.com/tony/num/
     (5392676)	Comments: Trying to view source on a very very large webpage.
     (5378065)	Comments: I've tryed to enable the Real Player plugin
     (5375024)	URL: cco.cisco.com
     (5375024)	Comments: just surfin'

Comment 1

[Darin Fisher]

not much info in those stack traces... does this crash show up on the trunk at all?

Comment 2

[Jay Patel [:jay]]

This crash has been happening on the Trunk for a while...but in smaller numbers.
 Here are a few crashes from the Trunk with comments that might help us
understand the problem:

Incident ID 4779474
Stack Signature nsHttpChannel::OnStartRequest f098ec74
Email Address
Product ID MozillaTrunk
Build ID 2002040210
Trigger Time 2002-04-03 08:56:22
Platform Win32
Operating System Windows NT 5.0 build 2195
Module necko.dll
URL visited http://www.omnigroup.com/applications/omniweb/releasenotes/
User Comments Loaded the above URL, scrolled around a bit, then switched to
another application (Diskeeper).
Trigger Reason Access violation
Source File Name
d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp
Trigger Line No. 2747 

Incident ID 5134795
Stack Signature nsHttpChannel::OnStartRequest 0416ccaa
Email Address
Product ID MozillaTrunk
Build ID 2002040306
Trigger Time 2002-04-12 13:31:12
Platform Win32
Operating System Windows NT 5.0 build 2195
Module necko.dll
URL visited (unknown exact url) somewhere in Quest Hang Gliding site
User Comments Just installed Apple QT 5, clicked on the "click here after
installing the plugin", then BOOM!
Trigger Reason Access violation
Source File Name
d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp
Trigger Line No. 2747

Incident ID 4989672
Stack Signature nsHttpChannel::OnStartRequest 6bd779b6
Email Address
Product ID MozillaTrunk
Build ID 2002040711
Trigger Time 2002-04-09 03:18:06
Platform Win32
Operating System Windows 98 4.10 build 67766446
Module NECKO.DLL
URL visited http://www.ofa.nl
User Comments Trying to load page at URL above. Moz crashed instantly and
without notice.
Trigger Reason Access violation
Source File Name
d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp
Trigger Line No. 2747

Incident ID 5080078
Stack Signature nsHttpChannel::OnStartRequest 6cf7bbab
Email Address
Product ID MozillaTrunk
Build ID 2002040910
Trigger Time 2002-04-11 06:46:42
Platform Win32
Operating System Windows NT 5.0 build 2195
Module necko.dll
URL visited
User Comments Quickly jumping Back and Forward between a frame-based page and a
non-framed page
Trigger Reason Access violation
Source File Name
d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp
Trigger Line No. 2764
Stack Trace
nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2764]
nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 162]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 597]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1078]
SETUPAPI.DLL + 0x30c24 (0x778b0c24) 

Incident ID 5540668
Stack Signature nsHttpChannel::OnStartRequest 6a07a716
Email Address
Product ID MozillaTrunk
Build ID 2002041814
Trigger Time 2002-04-23 19:30:15
Platform Win32
Operating System Windows 98 4.10 build 67766446
Module NECKO.DLL
URL visited http://www.plastic.com
User Comments Tabbed browsing
Trigger Reason Access violation
Source File Name
d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp
Trigger Line No. 2764
Stack Trace
nsHttpChannel::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpChannel.cpp, line 2764]
nsOnStartRequestEvent::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsRequestObserverProxy.cpp, line 162]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 597]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 530]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1078]
KERNEL32.DLL + 0x24407 (0xbff94407)
0x00648bfa 

Comment 3

[Jay Patel [:jay]]

Adding qawanted keyword to see if we can get this reproduced in-house and
nominating for nsbeta1.

Comment 4

[Darin Fisher]

unless stack trace... 

-> untargeted for now

Comment 5

[Jay Patel [:jay]]

A lot of people are crashing with Mozilla1.0 RC1.  Here are more comments and
urls to help us reproduce:

(5804396)
URL: www.miniusa.com
     (5797251)	URL: www.koukia.com
     (5797251)	Comments: I was visiting the above site: it required Flash player. I had
already installed shockwave  but went back and installed Flash 6 for Netscaper
browsers. I re-opened the browser to the Koukia page & this time it crashed. I
am running W2k SP2 with IE 5.5
     (5797251)	Comments:  installed. I have just set up Mozilla RC1
     (5740116)	URL: www.time.com
     (5737035)	URL: www.exactis.com
     (5737035)	Comments: clicked the back button
     (5716035)	URL: http://www.gotham-city.net/lambda.html
     (5716035)	Comments: Just surfing.
     (5686542)	Comments: Just segfaulted
     (5674421)	URL: mauglis.com
     (5674421)	Comments: reading e-mail
     (5653787)	URL: www.believeministry.com
     (5653787)	Comments: opening root page after reboot.  contains flash movies but I do
not have the mozilla plugin yet.
     (5651538)	Comments: JavaScript movie viewer
     (5627780)	URL: www.dc101.com
     (5627780)	Comments: opening the webpage
     (5609952)	URL: http://www.tivo.com
     (5609952)	Comments: The moment I "rolled" my mouse over the Tivo page  Mozilla RC1
crashed.
     (5609750)	URL:
http://www.rap.ucar.edu/weather/satellite/displaySat.php3?region=BWI&isingle=multiple&itype=vis
     (5609750)	Comments: after downloading images for animated satellite got the error
     (5597650)	URL:
http://www.cdbaby.com/found?s_artist=&s_soundlike=radiohead&s_album=&s_style=
     (5550595)	Comments: Just clicked on a URL which points to MS Word geenrated page.
     (5548581)	URL: http://www.sina.com.cn
     (5449930)	URL: www.time.com
     (5449162)	URL: www.time.com

I have not been able to reproduce this yet.

Comment 6

[Darin Fisher]

ok, so line 2764 of the nsHttpChannel.cpp from RC1 looks like this:

  nsresult rv = mListener->OnStartRequest(this, mListenerContext);

i suspect mListener must be null somehow, which would only happen if
nsHttpChannel::OnStartRequest was being reached after nsHttpChannel::OnStopRequest.

i'll have to carfully go over the code to figure out how this might be possible.

-> moz 1.0

Comment 7

[Darin Fisher]

Attachment: v1 patch - paper over crash

this patch just papers over the real problem, but it's at least better than
nothing ;-)

Comment 8

[Johnny Stenback (:jst)]

Comment on attachment 82868 [details] [diff] [review]
v1 patch - paper over crash

sr=jst

Comment 9

[gordon]

Comment on attachment 82868 [details] [diff] [review]
v1 patch - paper over crash

r=gordon.

Comment 10

[Darin Fisher]

fixed-on-trunk

Comment 11

[Shiva Thirumazhusai]

->topcrash+

Comment 12

[Asa Dotzler [:asa]]

Comment on attachment 82868 [details] [diff] [review]
v1 patch - paper over crash

a=asa (on behalf of drivers) for checkin to the 1.0 branch

Comment 13

[Jaime Rodriguez, Jr.]

adt1.0.0+ (on ADT's behalf) approval for checkin to the 1.0 brnach. Pls check
this in after you receive a= from Drivers, then add the fixed1.0.0 keyword

Comment 14

[Darin Fisher]

fixed-on-branch

Comment 15

[Tom Everingham]

verified - last talkback reports on this were from builds before and up to
05/08.  (both mozilla trunk and branch)

Comment 16

[benc]

removing fixed1.0.0 keyword