Closed Bug 1418795 Opened 2 years ago Closed 2 years ago

Crash in mozilla::ipc::LogicError | mozilla::net::PHttpChannelChild::SendDivertOnDataAvailable

Categories

(Core :: DOM: Service Workers, defect, P2, critical)

58 Branch
defect

Tracking

()

RESOLVED DUPLICATE of bug 1416879
Tracking Status
firefox-esr52 --- unaffected
firefox57 --- unaffected
firefox58 blocking fixed
firefox59 --- fixed

People

(Reporter: philipp, Assigned: asuth)

References

Details

(Keywords: crash, regression, Whiteboard: [necko-triaged])

Crash Data

This bug was filed from the Socorro interface and is
report bp-2a813e73-aa6c-4341-aca3-f33600171119.
=============================================================

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashOOL mfbt/Assertions.cpp:33
1 xul.dll mozilla::ipc::LogicError ipc/glue/ProtocolUtils.cpp:313
2 xul.dll mozilla::net::PHttpChannelChild::SendDivertOnDataAvailable ipc/ipdl/PHttpChannelChild.cpp:288
3 xul.dll mozilla::net::`anonymous namespace'::SyntheticDiversionListener::OnDataAvailable netwerk/protocol/http/HttpChannelChild.cpp:662
4 xul.dll mozilla::net::HttpChannelChild::DoOnDataAvailable netwerk/protocol/http/HttpChannelChild.cpp:971
5 xul.dll mozilla::net::InterceptStreamListener::OnDataAvailable netwerk/protocol/http/HttpChannelChild.cpp:134
6 xul.dll nsInputStreamPump::OnStateTransfer netwerk/base/nsInputStreamPump.cpp:591
7 xul.dll nsInputStreamPump::OnInputStreamReady netwerk/base/nsInputStreamPump.cpp:424
8 xul.dll nsOutputStreamReadyEvent::Run xpcom/io/nsStreamUtils.cpp:97
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1037

=============================================================

these cross-platform reports of crashes in the content process are newly appearing in firefox 58, always with moz crash reason "__delete__()d actor". perhaps it's also just a shift in the signature due to bug 1412048.
Crash Signature: [@ mozilla::ipc::LogicError | mozilla::net::PHttpChannelChild::SendDivertOnDataAvailable] → [@ mozilla::ipc::LogicError | mozilla::net::PHttpChannelChild::SendDivertOnDataAvailable] [@ mozilla::ipc::LogicError | mozilla::net::PHttpChannel::Transition]
InterceptSteamListener::OnDataAvailable is called while the PHttpChannel IPDL is already destroyed. Maybe triggered by download canceled for service worker generated content?
@bkelly might have some insight.
Flags: needinfo?(bkelly)
Yea, we probably need to check mIPCOpen from SyntheticDiversionListener::OnDataAvailable somehow.  And we should write a test for cancelling during download.

Andrew, how does your workload look?  I'd kind of like to keep finishing off my clients bug, so looking for victims here.
Flags: needinfo?(bkelly) → needinfo?(bugmail)
Sure, I'll provide a test and fix.
Assignee: nobody → bugmail
Status: NEW → ASSIGNED
Flags: needinfo?(bugmail)
Priority: -- → P2
Whiteboard: [necko-triaged]
[Tracking Requested - why for this release]:
this is a top crash in 58.0b5 accounting for 13.5% of all content crashes
huge spike in the latest beta builds
Ni to Andrew in case he didn't read at the bugmail (sorry if you do :)
Flags: needinfo?(bugmail)
See Also: → 1416879
Hi Andrew,
Any updates here? The volume of crashes in Beta58 is huge.
Elsewhere, Andrew told me he's going to get to this ASAP.
Crash Signature: [@ mozilla::ipc::LogicError | mozilla::net::PHttpChannelChild::SendDivertOnDataAvailable] [@ mozilla::ipc::LogicError | mozilla::net::PHttpChannel::Transition] → [@ mozilla::ipc::LogicError | mozilla::net::PHttpChannelChild::SendDivertOnDataAvailable] [@ mozilla::ipc::LogicError | mozilla::net::PHttpChannel::Transition] [@ mozilla::ipc::LogicError | mozilla::net::PHttpChannelParent::SendAttachStreamFilter ]
mozilla::ipc::LogicError | mozilla::net::PHttpChannel::Transition signature in 58b7 had over 4K crashes, and crashes are accumulating in Beta 8.
I am actively working this and should have a fix soon.
(In reply to Andrew Sutherland [:asuth] from comment #10)
> I am actively working this and should have a fix soon.

Any updates?
Flags: needinfo?(bugmail)
Flags: needinfo?(bugmail)
Component: Networking → DOM: Service Workers
This is the top non-shutdown hang crash for the 1-10 Nightly.
The fix for this is currently on inbound as part of the patch stack for bug 1416879:

https://hg.mozilla.org/integration/mozilla-inbound/rev/f4ebb9ec34523bfd24d86b3769e5f4185db25d25
Bug 1416879 - Part 3: (Also Bug 1418795) SyntheticDiversionListener should handle !mIPCOpen. r=bkelly
Flags: needinfo?(bugmail)
(In reply to Andrew Sutherland [:asuth] from comment #13)
> The fix for this is currently on inbound as part of the patch stack for bug
> 1416879:

Can we just dupe this bug to bug 1416879?
(In reply to Astley Chen [:astley] (UTC+8) from comment #14)
> (In reply to Andrew Sutherland [:asuth] from comment #13)
> > The fix for this is currently on inbound as part of the patch stack for bug
> > 1416879:
> 
> Can we just dupe this bug to bug 1416879?

Yes.  I'll migrate the signatures if they don't go over automatically.
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1416879
Updating status flags to mirror bug 1416879.  0 crashes with these signatures so far in 58.0 rc1, or in nightly after 20180112.
You need to log in before you can comment on or make changes to this bug.