1478081 - Crash in mozilla::net::HttpChannelChild::ContinueAsyncOpen

Status: VERIFIED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-9dc88f87-3c4d-42ff-80ae-845e50180724.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::net::HttpChannelChild::ContinueAsyncOpen netwerk/protocol/http/HttpChannelChild.cpp:2699
1 xul.dll mozilla::net::HttpChannelChild::AsyncOpen netwerk/protocol/http/HttpChannelChild.cpp:2589
2 xul.dll mozilla::net::HttpChannelChild::AsyncOpen2 netwerk/protocol/http/HttpChannelChild.cpp:2601
3 xul.dll mozilla::dom::FontFaceSet::UserFontSet::StartLoad layout/style/FontFaceSet.cpp:1963
4 xul.dll gfxUserFontEntry::DoLoadNextSrc gfx/thebes/gfxUserFontSet.cpp:632
5 xul.dll gfxFontGroup::GetFirstValidFont gfx/thebes/gfxTextRun.cpp:2124
6 xul.dll gfxFontGroup::MakeSpaceTextRun gfx/thebes/gfxTextRun.cpp:2222
7 xul.dll gfxFontGroup::MakeTextRun gfx/thebes/gfxTextRun.cpp:2325
8 xul.dll void BuildTextRunsScanner::FlushFrames layout/generic/nsTextFrame.cpp:1698
9 xul.dll void BuildTextRunsScanner::ScanFrame layout/generic/nsTextFrame.cpp:1976

=============================================================

There is 1 crash in nightly 63 with buildid 20180724100052. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1474280.

[1] https://hg.mozilla.org/mozilla-central/rev?node=318799faa5fe

Comment 1

[Ethan Tseng [:ethan]]

Gary, please investigate this crash.

Comment 2

[Gary Chen [:xeonchen]]

Attachment: Bug 1478081 - avoid accessing null pointer; r=valentin

Comment 3

[Phabricator Automation]

Comment on attachment 8994648 [details]
Bug 1478081 - avoid accessing null pointer; r=valentin

Valentin Gosu [:valentin] has approved the revision.

https://phabricator.services.mozilla.com/D2336

Comment 4

[Gary Chen [:xeonchen]]

try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=a63470987c99978bee2f72207c3f2a12917d082c

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0b9c0b211eb3
avoid accessing null pointer; r=valentin

Comment 6

[Tyson Smith [:tsmith]]

Attachment: testcase.html

This needs to be served via http to repro.

Comment 7

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/0b9c0b211eb3

Comment 8

[Marcia Knous [:marcia]]

I see a similar Win 7 signature in crash stats starting with the same build, [@ mozilla::net::PHttpChannelChild::OnMessageReceived ]. The report is here: https://crash-stats.mozilla.com/report/index/53a15ed8-d63d-4430-8ab7-4aee80180725

Comment 9

[Gary Chen [:xeonchen]]

(In reply to Tyson Smith [:tsmith] from comment #6)
> Created attachment 8994726 [details]
> testcase.html
> 
> This needs to be served via http to repro.

Do you mean accessing this via http will repro this?
I'll check this, thank you.

Comment 10

[Tyson Smith [:tsmith]]

(In reply to Gary Chen [:xeonchen] use needinfo? please from comment #9)
> Do you mean accessing this via http will repro this?

The testcase must be requested from an http server. It doesn't work if file:// is used. Which makes sense since this is a bug in http code.

Comment 11

[Ciprian Georgiu, Desktop QA]

I have reproduced this crash using the testcase from comment 9, via python -m SimpleHTTPServer on an affected Nightly build.

The testcase is not crashing anymore with latest Beta 63.0b11 under Windows 10 x64, macOS 10.13 and Ubuntu 16.04 x64.