1528188 - Crash in [@ mozilla::net::HttpChannelParentListener::TriggerCrossProcessRedirect]

Status: RESOLVED FIXED

(Core :: Networking, defect, P1)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-0b950c1c-9e09-4706-bef5-8ff740190215.

Top 10 frames of crashing thread:

0 xul.dll mozilla::net::HttpChannelParentListener::TriggerCrossProcessRedirect netwerk/protocol/http/HttpChannelParentListener.cpp:158
1 xul.dll nsresult mozilla::net::nsHttpChannel::StartCrossProcessRedirect netwerk/protocol/http/nsHttpChannel.cpp:7140
2 xul.dll nsresult mozilla::net::nsHttpChannel::ContinueProcessResponse1 netwerk/protocol/http/nsHttpChannel.cpp:2461
3 xul.dll void mozilla::net::nsHttpChannel::AsyncContinueProcessResponse netwerk/protocol/http/nsHttpChannel.cpp:2373
4 xul.dll nsresult std::_Func_impl_no_alloc<`lambda at z:/build/build/src/netwerk/protocol/http/nsHttpChannel.cpp:2390:21', nsresult, mozilla::net::nsHttpChannel*>::_Do_call 
5 xul.dll nsresult mozilla::net::nsHttpChannel::CallOrWaitForResume netwerk/protocol/http/nsHttpChannel.cpp:8998
6 xul.dll static void mozilla::net::nsHttpChannel::ResumeInternal::<unnamed-tag>::operator netwerk/protocol/http/nsHttpChannel.cpp:9037
7 xul.dll nsresult mozilla::detail::RunnableFunction<`lambda at z:/build/build/src/netwerk/protocol/http/nsHttpChannel.cpp:9033:11'>::Run xpcom/threads/nsThreadUtils.h:559
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1162
9 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:474

There are 68 crashes (from 34 installations) in nightly 67 starting with buildid 20190215014208. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1522637.

[1] https://hg.mozilla.org/mozilla-central/rev?node=0886a317a108

Comment 1

[Martin Giger [:freaktechnik]]

I can easily reproduce this with the MAC extension. Set a page to always be opened in a specific container and then select to open it without container in the in-tab prompt.

Comment 2

[Pascal Chevrel:pascalc]

The patch in bug 1522637 was backed out, let's monitor crashes over the week end to make sure we had identified the right regressor.

Comment 3

[Valentin Gosu [:valentin] (he/him)]

Bug 1522637 is most clearly at fault here, but the bug isn't in that code, it's in HttpChannelParentListener::TriggerCrossProcessRedirect.
Several crash report comments mention HTTPS Everywhere, and from what I can see the crash URLs are moz-extension:// file:// and sometimes about:

Nika, could we land bug 1522637 preffed off, and I'll try to fix the issue here?

Comment 4

[Nika Layzell [:nika] (ni? for response)]

Thanks :valentin! I've re-landed bug 1522637 with the pref off.

Comment 5

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1528188 - Add test with blocking webRequest which overwrites notificationCallbacks

Comment 6

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1528188 - Get the HttpChannelParentListener via the parent

Depends on D20183

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2299664d9a0b
Add test with blocking webRequest which overwrites notificationCallbacks r=mayhemer
https://hg.mozilla.org/integration/autoland/rev/bc1a5ca9464b
Get the HttpChannelParentListener via the parent r=mayhemer

Comment 8

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/2299664d9a0b
https://hg.mozilla.org/mozilla-central/rev/bc1a5ca9464b