Trunk M1RC2 crashes with bad connection [@ nsHttpHandler::ReclaimConnection]

VERIFIED FIXED in mozilla1.0.1

Status

()

Core
Networking: HTTP
P1
critical
VERIFIED FIXED
16 years ago
15 years ago

People

(Reporter: greer, Assigned: Darin Fisher)

Tracking

({crash, testcase, topcrash+})

Trunk
mozilla1.0.1
x86
All
crash, testcase, topcrash+
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [adt2 RTM][pipelining][fixed trunk][driver:shaver] custrtm-, crash signature, URL)

Attachments

(1 attachment)

863 bytes, patch
kaie
: review+
jag (Peter Annema)
: superreview+
shaver
: approval+
Details | Diff | Splinter Review
(Reporter)

Description

16 years ago
This signature has bubbled up to the top of the M1RC2 day one data. I've 
tried to reproduce this one from the user's comments (including sites and 
installations of BannerBlind and CaScadeS on mozdev.org) with no luck. 

Here are the stack and comments in the hope that someone can produce reliable 
steps to reproduce:

         nsHttpHandler::ReclaimConnection
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpHandler.cpp  line 
431] 
         nsHttpConnection::OnStopRequest
[d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHttpConnection.cpp  
line 623]  

M1RC2 (nsHttpHandler::ReclaimConnection):       10
(6171238)  Comments: Failed when closing the browser. It may have been stuck 
trying to make a network connection when the network was down.
(6171238) - [Windows NT  5.0 build 2195] (Build 2002051008): Failed when closing 
the browser. It may have been stuck trying to make a network connection when the 
network was down. URL: 
(6166345) - [Windows NT  5.1 build 2600] (Build 2002051008): I quit mozilla and 
this crash report appeared.... URL: http://mozdev.org
(6166381) - [Windows NT  5.1 build 2600] (Build 2002051008): I just completed 
the BannerBlind install  and Mozilla crashed apon exiting after the install 
program asked for Mozilla to be restarted. URL: http://mozdev.org
(6166159) - [Linux 2.4.18] (Build 2002051009): clicked the "X" on blackbox to 
close the browser. URL: cnn.com

Trunk (nsHttpHandler::ReclaimConnection):        8

M1BR (nsHttpHandler::ReclaimConnection):       19
(5867487) - [Windows 98  4.10 build 67766446] (Build 2002050208): Closing M 
after having gone to a secure site that did not open URL:
(5988247) - [Windows 98  4.10 build 67766446] (Build 2002050408): No more load 
of the page. Java 1.4 URL: http://www.volkstheater.ch
(6130017) - [Windows 98  4.10 build 67766222] (Build 2002050808): Mozilla was 
slow to load an encrypted website. I realised the time of day and closed the 
incompleted page whilst it was still loading. Crash seemed to occur after that 
was closed and I closed all the other pages...last page to close was the mail 
client. URL:
(6103332) - [Windows NT  5.0 build 2195] (Build 2002050808): Attempting to close 
the application. URL:
(6159792) - [Windows NT  5.0 build 2195] (Build 2002050708): Attempting to login 
to Fleet's HomeLink account management site (card # entered  selected save this 
card number  and pin entered; all fake)  browser never finishes loading
 the next page. URL: https://homelink.fleet.com/HomeLink/
(6131778) - [Windows NT  5.0 build 2195] (Build 2002050808): dglazman...after 
installing Cascades  I've been crashing... URL:
(5937508) - [Windows 98  4.10 build 67766446] (Build 2002050208): crashed after 
closing after trying to go to a site whre pipelining is not enabled. URL:
(5927884) - [Windows 98  4.10 build 67766222] (Build 2002050208): didn't wait 
for this url to complete loading  before hitting stop.Was trying to reproduce 
bug:http://bugzilla.mozilla.org/show_bug.cgi?id=142206 URL: http://www.thai.
net/navigate/
(6131778) Build: 2002050808 Plat: Windows NT  5.0 build 2195 Time: 2002-05-09 
rebron@netscape.com  dglazman...after installing Cascades  I've been crashing...
(Reporter)

Comment 1

16 years ago
-> darin for first look.
Assignee: new-network-bugs → darin
Keywords: crash, qawanted, topcrash
(Reporter)

Comment 2

16 years ago
6166159 (above) is on Linux. OS -> All
OS: Windows 2000 → All
(Assignee)

Comment 3

16 years ago
it looks like were crashing here:

  PR_Lock(mConnectionLock);

so mConnectionLock is probably null or pointing to free'd memory, which means
that the nsHttpHandler singleton has been destroyed.  this conclusion seems
consistent with the comments that mention "closing the browser."

at least one comment says that pipelining was disabled, so maybe this has
nothing to do with pipelining.  hard to say for certain, though.
Status: NEW → ASSIGNED
Priority: -- → P1
Target Milestone: --- → mozilla1.0.1

Comment 4

16 years ago
I can reproduce this bug all the time on Linux.

Go to www.bouldernews.com - wait a moment until most has loaded. Press stop.
Click on the subscribe link upper right. Wait until some parts have loaded.
Press stop. Choose File/Exit. Crash.

#0  nsHttpHandler::ReclaimConnection (this=0x0, conn=0x89186d8) at
/home/kaie/100/mozilla/netwerk/protocol/http/src/nsHttpHandler.cpp:431
	this = (nsHttpHandler *) 0x0
	reusable = 0
#1  0x409d7051 in nsHttpConnection::OnStopRequest (this=0x89186d8,
request=0x8945950, ctxt=0x0, status=2152398850) at
/home/kaie/100/mozilla/netwerk/protocol/http/src/nsHttpConnection.cpp:622
	info = {<nsCOMPtr_base> = {mRawPtr = 0x891e900}, <No data fields>}
	secCtrl = {mRawPtr = 0x891e904}
#2  0x40995d5d in nsSocketRequest::OnStop (this=0x8945950) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransport.cpp:2668
No locals.
#3  0x4099621c in nsSocketReadRequest::OnStop (this=0x8945950) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransport.cpp:2804
	this = (nsSocketReadRequest *) 0x8945950
#4  0x40990357 in nsSocketTransport::CompleteAsyncRead (this=0x891e398) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransport.cpp:659
	this = (nsSocketTransport *) 0x891e398
	readRequest = (nsSocketReadRequest *) 0x8945950
#5  0x4098fdd1 in nsSocketTransport::Process (this=0x891e398, aSelectFlags=0) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransport.cpp:498
	this = (nsSocketTransport *) 0x891e398
	aSelectFlags = 0
	done = 0
#6  0x40997524 in nsSocketTransportService::ProcessWorkQ (this=0x8128898) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransportService.cpp:297
	transport = (nsSocketTransport *) 0x891e398
	this = (nsSocketTransportService *) 0x8128898
	rv = 0
	qp = (PRCList *) 0x891e3cc
#7  0x40997c94 in nsSocketTransportService::Run (this=0x8128898) at
/home/kaie/100/mozilla/netwerk/base/src/nsSocketTransportService.cpp:543
	pfd = (PRPollDesc *) 0x8116030
	out_flags = 1
	rv = 0
	count = 1
	intervalNow = 3428632165
	transport = (nsSocketTransport *) 0x0
	i = 0
	this = (nsSocketTransportService *) 0x8128898
	pollTimeout = 35000
(Reporter)

Comment 5

16 years ago
Tried this one on Win2000 with Kai's steps in comment #4. No crash. Can anyone
else reproduce with these steps Win/Linux? Plussing for now 
Whiteboard: [grr]

Comment 6

16 years ago
Getting on rtm radar.  If it turns out this only occurs with pipelining on then
it won't be needed for rtm.
Keywords: nsbeta1+
Whiteboard: [grr] → [grr][adt1 rtm]

Comment 7

16 years ago
It indeed seems to be a pipelining bug. I still can reproduce with pipelining
enabled, but can't with having it disabled.

Darin, besides the crash bug, I also see another problem with that site and
pipelining enabled.

When you go to www.bouldernews.com and click the subscribe link, that page loads
having pipelining disabled, but does not seem to load if it is enabled.
(Assignee)

Updated

16 years ago
Whiteboard: [grr][adt1 rtm] → [grr][adt1 rtm][pipelining]

Comment 8

16 years ago
According to kai's comment this crash is reproducible with pipeline enabled and
it is appearing in the talkback topcrash reports. marking it as topcrash+ with
testcase keyword.
Keywords: qawanted, topcrash → testcase, topcrash+

Updated

16 years ago
Blocks: 144480
(Assignee)

Updated

16 years ago
Target Milestone: mozilla1.0.1 → ---

Comment 9

16 years ago
-> http
Status: ASSIGNED → NEW
Component: Networking → Networking: HTTP
QA Contact: benc → tever
(Assignee)

Updated

16 years ago
Whiteboard: [grr][adt1 rtm][pipelining] → [grr][adt2 RTM][pipelining]
Target Milestone: --- → mozilla1.0.1
(Assignee)

Comment 10

16 years ago
Created attachment 83649 [details] [diff] [review]
v1 patch

trivial bug, trivial patch...

we've always had this bug, but it requires "perfect time slicing" to exercise
it when pipelining is disabled.

Comment 11

16 years ago
Comment on attachment 83649 [details] [diff] [review]
v1 patch

r=kaie

I tried the patch and it causes the crash to go away.
Attachment #83649 - Flags: review+

Comment 12

16 years ago
Comment on attachment 83649 [details] [diff] [review]
v1 patch

sr=jag
Attachment #83649 - Flags: superreview+
(Assignee)

Comment 13

16 years ago
fixed-on-trunk
Status: NEW → ASSIGNED
Whiteboard: [grr][adt2 RTM][pipelining] → [grr][adt2 RTM][pipelining][fixed trunk]

Comment 14

16 years ago
Comment on attachment 83649 [details] [diff] [review]
v1 patch

looks good to me.
(r/sr=rpotts)
(Assignee)

Updated

16 years ago
Whiteboard: [grr][adt2 RTM][pipelining][fixed trunk] → [grr][adt2 RTM][pipelining][fixed trunk][driver:shaver]
Comment on attachment 83649 [details] [diff] [review]
v1 patch

a=shaver+scc+jesup for the 1.0 rc3 branch.  Godspeed.
Attachment #83649 - Flags: approval+

Comment 16

16 years ago
Nominating for adt +.
Keywords: adt1.0.0
(Assignee)

Comment 17

16 years ago
fixed-on-branch
Status: ASSIGNED → RESOLVED
Last Resolved: 16 years ago
Keywords: adt1.0.0 → fixed1.0.0
Resolution: --- → FIXED
(Assignee)

Updated

16 years ago
Keywords: adt1.0.0

Comment 18

16 years ago
verified using supplied testcase -
trunk and branch, 5/20/02 builds - winNT4, Linux rh6
Status: RESOLVED → VERIFIED

Comment 19

16 years ago
posthumas adt1.0.0+. Pls make sure to get ADT approval before landing on the 1.0
branch.
Keywords: adt1.0.0 → adt1.0.0+
(Reporter)

Updated

16 years ago
Whiteboard: [grr][adt2 RTM][pipelining][fixed trunk][driver:shaver] → [adt2 RTM][pipelining][fixed trunk][driver:shaver]

Updated

16 years ago
Whiteboard: [adt2 RTM][pipelining][fixed trunk][driver:shaver] → [adt2 RTM][pipelining][fixed trunk][driver:shaver] custrtm-

Comment 20

15 years ago
verified1.0.0
Keywords: fixed1.0.0 → verified1.0.0
Crash Signature: [@ nsHttpHandler::ReclaimConnection]
You need to log in before you can comment on or make changes to this bug.