Crash in [@ mozilla::net::HttpChannelParentListener::TriggerCrossProcessRedirect]

RESOLVED FIXED in Firefox 67

Status

()

defect
P1
critical
RESOLVED FIXED
3 months ago
3 months ago

People

(Reporter: calixte, Assigned: valentin)

Tracking

(Blocks 1 bug, {crash, regression})

Trunk
mozilla67
Unspecified
Windows 10
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox65 unaffected, firefox66 unaffected, firefox67+ fixed)

Details

(Whiteboard: [necko-triaged], crash signature)

Attachments

(2 attachments)

(Reporter)

Description

3 months ago

This bug is for crash report bp-0b950c1c-9e09-4706-bef5-8ff740190215.

Top 10 frames of crashing thread:

0 xul.dll mozilla::net::HttpChannelParentListener::TriggerCrossProcessRedirect netwerk/protocol/http/HttpChannelParentListener.cpp:158
1 xul.dll nsresult mozilla::net::nsHttpChannel::StartCrossProcessRedirect netwerk/protocol/http/nsHttpChannel.cpp:7140
2 xul.dll nsresult mozilla::net::nsHttpChannel::ContinueProcessResponse1 netwerk/protocol/http/nsHttpChannel.cpp:2461
3 xul.dll void mozilla::net::nsHttpChannel::AsyncContinueProcessResponse netwerk/protocol/http/nsHttpChannel.cpp:2373
4 xul.dll nsresult std::_Func_impl_no_alloc<`lambda at z:/build/build/src/netwerk/protocol/http/nsHttpChannel.cpp:2390:21', nsresult, mozilla::net::nsHttpChannel*>::_Do_call 
5 xul.dll nsresult mozilla::net::nsHttpChannel::CallOrWaitForResume netwerk/protocol/http/nsHttpChannel.cpp:8998
6 xul.dll static void mozilla::net::nsHttpChannel::ResumeInternal::<unnamed-tag>::operator netwerk/protocol/http/nsHttpChannel.cpp:9037
7 xul.dll nsresult mozilla::detail::RunnableFunction<`lambda at z:/build/build/src/netwerk/protocol/http/nsHttpChannel.cpp:9033:11'>::Run xpcom/threads/nsThreadUtils.h:559
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1162
9 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:474

There are 68 crashes (from 34 installations) in nightly 67 starting with buildid 20190215014208. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1522637.

[1] https://hg.mozilla.org/mozilla-central/rev?node=0886a317a108

Flags: needinfo?(nika)

I can easily reproduce this with the MAC extension. Set a page to always be opened in a specific container and then select to open it without container in the in-tab prompt.

The patch in bug 1522637 was backed out, let's monitor crashes over the week end to make sure we had identified the right regressor.

(Assignee)

Comment 3

3 months ago

Bug 1522637 is most clearly at fault here, but the bug isn't in that code, it's in HttpChannelParentListener::TriggerCrossProcessRedirect.
Several crash report comments mention HTTPS Everywhere, and from what I can see the crash URLs are moz-extension:// file:// and sometimes about:

Nika, could we land bug 1522637 preffed off, and I'll try to fix the issue here?

Thanks :valentin! I've re-landed bug 1522637 with the pref off.

Flags: needinfo?(nika)
(Assignee)

Updated

3 months ago
Assignee: nobody → valentin.gosu
Component: DOM: Content Processes → Networking
Priority: -- → P1
Whiteboard: [necko-triaged]
Attachment #9044671 - Attachment description: Bug 1528188 - Add test for blocking webRequest which overwrites notificationCallbacks → Bug 1528188 - Add test with blocking webRequest which overwrites notificationCallbacks

Comment 7

3 months ago
Pushed by valentin.gosu@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/2299664d9a0b
Add test with blocking webRequest which overwrites notificationCallbacks r=mayhemer
https://hg.mozilla.org/integration/autoland/rev/bc1a5ca9464b
Get the HttpChannelParentListener via the parent r=mayhemer

Comment 8

3 months ago
bugherder
Status: NEW → RESOLVED
Last Resolved: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in before you can comment on or make changes to this bug.