Closed Bug 1430039 Opened 2 years ago Closed Last year

Crash in mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame | mozilla::ipc::MessageChannel::Send | mozilla::net::PNeckoChild::SendRemoveRequestContext

Categories

(Core :: Networking, defect, P2, critical)

59 Branch
x86
Windows 8
defect

Tracking

()

RESOLVED FIXED
mozilla65
Tracking Status
firefox-esr52 --- unaffected
firefox-esr60 --- wontfix
firefox57 --- unaffected
firefox58 --- unaffected
firefox59 --- unaffected
firefox63 --- wontfix
firefox64 --- wontfix
firefox65 --- fixed

People

(Reporter: calixte, Assigned: kershaw)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, Whiteboard: [clouseau][necko-triaged])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is
report bp-a1b865ec-b501-40fc-bc99-1a24f0180112.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame ipc/glue/MessageChannel.cpp:247
1 xul.dll mozilla::ipc::MessageChannel::Send ipc/glue/MessageChannel.cpp:887
2 xul.dll mozilla::net::PNeckoChild::SendRemoveRequestContext ipc/ipdl/PNeckoChild.cpp:1205
3 xul.dll mozilla::net::RequestContextService::RemoveRequestContext netwerk/base/RequestContextService.cpp:593
4 xul.dll mozilla::net::nsLoadGroup::~nsLoadGroup netwerk/base/nsLoadGroup.cpp:130
5 xul.dll mozilla::net::nsLoadGroup::`scalar deleting destructor' 
6 xul.dll mozilla::net::nsLoadGroup::Internal::Release netwerk/base/nsLoadGroup.cpp:140
7 xul.dll nsProperties::Release xpcom/ds/nsProperties.cpp:11
8 xul.dll nsJARChannel::~nsJARChannel modules/libjar/nsJARChannel.cpp:223
9 xul.dll nsJARChannel::`scalar deleting destructor' 

=============================================================

There are 4 crashes in nightly 59 starting with buildid 20180111100722. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1373708.

[1] https://hg.mozilla.org/mozilla-central/rev/d31af7725e65
Flags: needinfo?(xeonchen)
|nsJARChannel| should be released on main thread.

Set to P2 since bug 1373708 has been backed-out.
Assignee: nobody → xeonchen
Flags: needinfo?(xeonchen)
Priority: -- → P2
Whiteboard: [clouseau] → [clouseau][necko-triaged]
Duplicate of this bug: 1430080
(In reply to Gary Chen [:xeonchen] (needinfo plz) from comment #1)
> |nsJARChannel| should be released on main thread.
> 
> Set to P2 since bug 1373708 has been backed-out.

Does this mean that work (which caused this crash) won't be in 59?
Flags: needinfo?(xeonchen)
(In reply to Andrew Overholt [:overholt] from comment #3)
> (In reply to Gary Chen [:xeonchen] (needinfo plz) from comment #1)
> > |nsJARChannel| should be released on main thread.
> > 
> > Set to P2 since bug 1373708 has been backed-out.
> 
> Does this mean that work (which caused this crash) won't be in 59?

Yes, exactly.
Flags: needinfo?(xeonchen)
Assignee: xeonchen → nobody
Assignee: nobody → kershaw
The reason of the crash is that the load group is released on non main thread. To fix the crash, simply use |NS_ReleaseOnMainThreadSystemGroup| to release the load group.
Note that this patch also proxy release other members on main thread just for safe.
Pushed by kjang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d7ba5883b259
Proxy release some member on main thread r=valentin
https://hg.mozilla.org/mozilla-central/rev/d7ba5883b259
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
You need to log in before you can comment on or make changes to this bug.