1418795 - Crash in mozilla::ipc::LogicError | mozilla::net::PHttpChannelChild::SendDivertOnDataAvailable

Status: RESOLVED DUPLICATE of bug 1416879

(Core :: DOM: Service Workers, defect, P2, critical)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is
report bp-2a813e73-aa6c-4341-aca3-f33600171119.
=============================================================

Top 10 frames of crashing thread:

0 mozglue.dll MOZ_CrashOOL mfbt/Assertions.cpp:33
1 xul.dll mozilla::ipc::LogicError ipc/glue/ProtocolUtils.cpp:313
2 xul.dll mozilla::net::PHttpChannelChild::SendDivertOnDataAvailable ipc/ipdl/PHttpChannelChild.cpp:288
3 xul.dll mozilla::net::`anonymous namespace'::SyntheticDiversionListener::OnDataAvailable netwerk/protocol/http/HttpChannelChild.cpp:662
4 xul.dll mozilla::net::HttpChannelChild::DoOnDataAvailable netwerk/protocol/http/HttpChannelChild.cpp:971
5 xul.dll mozilla::net::InterceptStreamListener::OnDataAvailable netwerk/protocol/http/HttpChannelChild.cpp:134
6 xul.dll nsInputStreamPump::OnStateTransfer netwerk/base/nsInputStreamPump.cpp:591
7 xul.dll nsInputStreamPump::OnInputStreamReady netwerk/base/nsInputStreamPump.cpp:424
8 xul.dll nsOutputStreamReadyEvent::Run xpcom/io/nsStreamUtils.cpp:97
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1037

=============================================================

these cross-platform reports of crashes in the content process are newly appearing in firefox 58, always with moz crash reason "__delete__()d actor". perhaps it's also just a shift in the signature due to bug 1412048.

Comment 1

[Shih-Chiang Chien [:schien] (UTC+8) (use ni? plz)]

InterceptSteamListener::OnDataAvailable is called while the PHttpChannel IPDL is already destroyed. Maybe triggered by download canceled for service worker generated content?
@bkelly might have some insight.

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

Yea, we probably need to check mIPCOpen from SyntheticDiversionListener::OnDataAvailable somehow.  And we should write a test for cancelling during download.

Andrew, how does your workload look?  I'd kind of like to keep finishing off my clients bug, so looking for victims here.

Comment 3

[Andrew Sutherland [:asuth] (he/him)]

Sure, I'll provide a test and fix.

Comment 4

[[:philipp]]

[Tracking Requested - why for this release]:
this is a top crash in 58.0b5 accounting for 13.5% of all content crashes

Comment 5

[Julien Cristau [:jcristau]]

huge spike in the latest beta builds

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Ni to Andrew in case he didn't read at the bugmail (sorry if you do :)

Comment 7

[Gerry Chang [:gchang]]

Hi Andrew,
Any updates here? The volume of crashes in Beta58 is huge.

Comment 8

[Andrew Overholt [:overholt]]

Elsewhere, Andrew told me he's going to get to this ASAP.

Comment 9

[Marcia Knous [:marcia - needinfo? me/PTO 12/6-12/12)]]]

mozilla::ipc::LogicError | mozilla::net::PHttpChannel::Transition signature in 58b7 had over 4K crashes, and crashes are accumulating in Beta 8.

Comment 10

[Andrew Sutherland [:asuth] (he/him)]

I am actively working this and should have a fix soon.

Comment 11

[Mike Taylor [:miketaylr]]

(In reply to Andrew Sutherland [:asuth] from comment #10)
> I am actively working this and should have a fix soon.

Any updates?

Comment 12

[Andrew McCreight [:mccr8]]

This is the top non-shutdown hang crash for the 1-10 Nightly.

Comment 13

[Andrew Sutherland [:asuth] (he/him)]

The fix for this is currently on inbound as part of the patch stack for bug 1416879:

https://hg.mozilla.org/integration/mozilla-inbound/rev/f4ebb9ec34523bfd24d86b3769e5f4185db25d25
Bug 1416879 - Part 3: (Also Bug 1418795) SyntheticDiversionListener should handle !mIPCOpen. r=bkelly

Comment 14

[Astley Chen (inactive)]

(In reply to Andrew Sutherland [:asuth] from comment #13)
> The fix for this is currently on inbound as part of the patch stack for bug
> 1416879:

Can we just dupe this bug to bug 1416879?

Comment 15

[Andrew Sutherland [:asuth] (he/him)]

(In reply to Astley Chen [:astley] (UTC+8) from comment #14)
> (In reply to Andrew Sutherland [:asuth] from comment #13)
> > The fix for this is currently on inbound as part of the patch stack for bug
> > 1416879:
> 
> Can we just dupe this bug to bug 1416879?

Yes.  I'll migrate the signatures if they don't go over automatically.

Comment 16

[Julien Cristau [:jcristau]]

Updating status flags to mirror bug 1416879.  0 crashes with these signatures so far in 58.0 rc1, or in nightly after 20180112.