Crash in [@ mozilla::net::HttpChannelParentListener::TriggerCrossProcessRedirect]

RESOLVED FIXED in Firefox 67

Status

()

defect
P1
critical
RESOLVED FIXED
5 months ago
5 months ago

People

(Reporter: calixte, Assigned: valentin.gosu)

Tracking

(Blocks 1 bug, {crash, regression})

Trunk
mozilla67
Unspecified
Windows 10
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox65 unaffected, firefox66 unaffected, firefox67+ fixed)

Details

(Whiteboard: [necko-triaged], crash signature)

Attachments

(2 attachments)

This bug is for crash report bp-0b950c1c-9e09-4706-bef5-8ff740190215.

Top 10 frames of crashing thread:

0 xul.dll mozilla::net::HttpChannelParentListener::TriggerCrossProcessRedirect netwerk/protocol/http/HttpChannelParentListener.cpp:158
1 xul.dll nsresult mozilla::net::nsHttpChannel::StartCrossProcessRedirect netwerk/protocol/http/nsHttpChannel.cpp:7140
2 xul.dll nsresult mozilla::net::nsHttpChannel::ContinueProcessResponse1 netwerk/protocol/http/nsHttpChannel.cpp:2461
3 xul.dll void mozilla::net::nsHttpChannel::AsyncContinueProcessResponse netwerk/protocol/http/nsHttpChannel.cpp:2373
4 xul.dll nsresult std::_Func_impl_no_alloc<`lambda at z:/build/build/src/netwerk/protocol/http/nsHttpChannel.cpp:2390:21', nsresult, mozilla::net::nsHttpChannel*>::_Do_call 
5 xul.dll nsresult mozilla::net::nsHttpChannel::CallOrWaitForResume netwerk/protocol/http/nsHttpChannel.cpp:8998
6 xul.dll static void mozilla::net::nsHttpChannel::ResumeInternal::<unnamed-tag>::operator netwerk/protocol/http/nsHttpChannel.cpp:9037
7 xul.dll nsresult mozilla::detail::RunnableFunction<`lambda at z:/build/build/src/netwerk/protocol/http/nsHttpChannel.cpp:9033:11'>::Run xpcom/threads/nsThreadUtils.h:559
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1162
9 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:474

There are 68 crashes (from 34 installations) in nightly 67 starting with buildid 20190215014208. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1522637.

[1] https://hg.mozilla.org/mozilla-central/rev?node=0886a317a108

Flags: needinfo?(nika)

I can easily reproduce this with the MAC extension. Set a page to always be opened in a specific container and then select to open it without container in the in-tab prompt.

The patch in bug 1522637 was backed out, let's monitor crashes over the week end to make sure we had identified the right regressor.

Bug 1522637 is most clearly at fault here, but the bug isn't in that code, it's in HttpChannelParentListener::TriggerCrossProcessRedirect.
Several crash report comments mention HTTPS Everywhere, and from what I can see the crash URLs are moz-extension:// file:// and sometimes about:

Nika, could we land bug 1522637 preffed off, and I'll try to fix the issue here?

Thanks :valentin! I've re-landed bug 1522637 with the pref off.

Flags: needinfo?(nika)
Assignee: nobody → valentin.gosu
Component: DOM: Content Processes → Networking
Priority: -- → P1
Whiteboard: [necko-triaged]
Attachment #9044671 - Attachment description: Bug 1528188 - Add test for blocking webRequest which overwrites notificationCallbacks → Bug 1528188 - Add test with blocking webRequest which overwrites notificationCallbacks
Pushed by valentin.gosu@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/2299664d9a0b
Add test with blocking webRequest which overwrites notificationCallbacks r=mayhemer
https://hg.mozilla.org/integration/autoland/rev/bc1a5ca9464b
Get the HttpChannelParentListener via the parent r=mayhemer
Status: NEW → RESOLVED
Closed: 5 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in before you can comment on or make changes to this bug.