1502428 - Crash in mozilla::net::LoadInfo::GetPerformanceStorage

Status: RESOLVED WORKSFORME

(Core :: Networking, defect, P2)

Description

[Randell Jesup [:jesup] (needinfo me)]

Wildptr crashes, some may be nullptr

Goes back to at least 60.  Still happening as of 63b14.  Low frequency.

Apparently a (freed? trashed?) pointer to an innerwindow PerformanceStorage object.

This bug was filed from the Socorro interface and is
report bp-d80540cb-02bc-4957-ba4d-d19d60181015.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll mozilla::net::HttpBaseChannel::GetPerformanceStorage netwerk/protocol/http/HttpBaseChannel.cpp:4394
1 xul.dll void mozilla::net::HttpChannelChild::DoPreOnStopRequest netwerk/protocol/http/HttpChannelChild.cpp:1296
2 xul.dll void mozilla::net::HttpChannelChild::OnStopRequest netwerk/protocol/http/HttpChannelChild.cpp:1236
3 xul.dll mozilla::net::StopRequestEvent::Run netwerk/protocol/http/HttpChannelChild.cpp:1114
4 xul.dll mozilla::net::ChannelEventQueue::FlushQueue netwerk/ipc/ChannelEventQueue.cpp:93
5 xul.dll nsresult mozilla::net::ChannelEventQueue::ResumeInternal::CompleteResumeRunnable::Run netwerk/ipc/ChannelEventQueue.cpp:161
6 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:337
7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1161
8 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:519
9 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:125

=============================================================

Comment 1

[Dragana Damjanovic [:dragana]]

Attachment: Use RefPtr for PerformanceStorage.

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

dragana - is there a reason we're not landing this patch? (was just going through bugs I'd filed) thanks

Comment 3

[Dragana Damjanovic [:dragana]]

(In reply to Randell Jesup [:jesup] (needinfo me) from comment #2)

dragana - is there a reason we're not landing this patch? (was just going through bugs I'd filed) thanks

The fix was just a guess. the patch is not reviewed. This may need more investigation. Currently I do not have time for it (the crash volume is low).

Comment 4

[Dragana Damjanovic [:dragana]]

baku, can you take a look at this?

Comment 5

[Liz Henry (:lizzard)]

Even though this crash isn't seen often in the wild our current aim is to make investigating and fixing sec-high/critical issues a higher priority.
Nhi, or maybe Randell, I know we might have more high priority features the team is working on. Can you think of anyone else who could dig more into this crash?

Comment 6

[Nhi Nguyen (:nhi)]

Honza, could you take a look at this? Thanks!

Comment 7

[Honza Bambas (:mayhemer)]

This could be related to bug 1544127.

Comment 8

[Liz Henry (:lizzard)]

No crashes so far past early beta, so we can probably close this if the crashes stay at 0 after 70 hits release.

Comment 9

[Liz Henry (:lizzard)]

There are a few crashes on 70.0.1 - example, https://crash-stats.mozilla.org/report/index/0dd83030-25eb-4dcf-90ca-169530191105

Comment 10

[Honza Bambas (:mayhemer)]

Could be in the ~LoadInfo crash group - similar to bug 1544127. Honestly, can't think of anything else than for bug that bug.

Comment 11

[David Lawrence [:dkl]]

Removing employee no longer with company from CC list of private bugs.

Comment 12

[Jens Stutte [:jstutte]]

This is still alive, we just moved GetPerformanceStorage over to LoadInfo in bug 1556489.

Comment 13

[Kershaw Chang [:kershaw]]

This could be fixed by bug 1544127. Let's wait a bit more and see if there is a crash in 94.

Comment 14

[Kershaw Chang [:kershaw]]

There is no new crash reports for a while.
I think this is because of one of my patches in bug 1544127 changes the crash signature.
Let's close this one and track the other crash signature in bug 1544127.

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

Since the bug is closed, the stalled keyword is now meaningless.
For more information, please visit auto_nag documentation.