Closed Bug 1553267 Opened 5 years ago Closed 5 years ago

Assertion failure: mListener, at /builds/worker/workspace/build/src/netwerk/protocol/http/HttpChannelChild.cpp:673

Categories

(Core :: Networking, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla70
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox68 --- unaffected
firefox69 --- wontfix
firefox70 --- fixed

People

(Reporter: jkratzer, Assigned: kershaw)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [necko-triaged][stockwell unknown])

Attachments

(2 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 65a693623cee. Testcase requires a build with --enable-fuzzing.

Assertion failure: mListener, at /builds/worker/workspace/build/src/netwerk/protocol/http/HttpChannelChild.cpp:673

rcx = 0x00007f34c0486b70   rbx = 0x00007f34b3417800
rsi = 0x00007f34cc4c28b0   rdi = 0x00007f34cc4c1680
rbp = 0x00007ffffd9ac980   rsp = 0x00007ffffd9ac940
r8 = 0x00007f34cc4c28b0    r9 = 0x00007f34cd644740
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007f34b36862e0   r13 = 0x00007f34b3417d64
r14 = 0x00007f34b3417878   r15 = 0x00007f34b34324d8
rip = 0x00007f34bbbf9867
OS|Linux|0.0.0 Linux 4.19.34-coreos #1 SMP Mon Apr 22 20:32:34 -00 2019 x86_64
CPU|amd64|family 6 model 79 stepping 1|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::net::HttpChannelChild::DoOnStartRequest(nsIRequest*, nsISupports*)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/HttpChannelChild.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|703|0x69
0|1|libxul.so|mozilla::net::HttpChannelChild::OnStartRequest(nsresult const&, mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, mozilla::net::ParentLoadInfoForwarderArgs const&, bool const&, bool const&, bool const&, unsigned long const&, int const&, unsigned int const&, nsTString<char> const&, nsTString<char> const&, mozilla::net::NetAddr const&, mozilla::net::NetAddr const&, unsigned int const&, nsTString<char> const&, long const&, bool const&, bool const&, bool const&, mozilla::net::ResourceTimingStruct const&)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/HttpChannelChild.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|614|0xc
0|2|libxul.so|mozilla::net::StartRequestEvent::Run()|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/HttpChannelChild.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|444|0x6
0|3|libxul.so|mozilla::net::ChannelEventQueue::RunOrEnqueue(mozilla::net::ChannelEvent*, bool)|hg:hg.mozilla.org/mozilla-central:netwerk/ipc/ChannelEventQueue.h:65a693623cee0837b4ad0d23241c84cd3ea23e3a|210|0x11
0|4|libxul.so|mozilla::net::HttpChannelChild::RecvOnStartRequest(nsresult const&, mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, mozilla::net::ParentLoadInfoForwarderArgs const&, bool const&, bool const&, bool const&, unsigned long const&, int const&, unsigned int const&, nsTString<char> const&, nsTString<char> const&, mozilla::net::NetAddr const&, mozilla::net::NetAddr const&, short const&, unsigned int const&, nsTString<char> const&, long const&, bool const&, bool const&, bool const&, mozilla::net::ResourceTimingStruct const&)|hg:hg.mozilla.org/mozilla-central:netwerk/protocol/http/HttpChannelChild.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|504|0xd
0|5|libxul.so|mozilla::net::PHttpChannelChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:98d28cdd8b84d6c7fa318986b8f942adf763a03d24a6e29011f16f9a17e0373efccd3674acfd90021db07d5aa4b3b6d4b911526befea701ded55263129f81719/ipc/ipdl/PHttpChannelChild.cpp:|793|0x6b
0|6|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|2151|0x6
0|7|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|2078|0xb
0|8|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|1937|0xb
0|9|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|1968|0xc
0|10|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|1180|0x15
0|11|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|486|0x11
0|12|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|110|0xd
0|13|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:65a693623cee0837b4ad0d23241c84cd3ea23e3a|315|0x17
0|14|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:65a693623cee0837b4ad0d23241c84cd3ea23e3a|290|0x8
0|15|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|137|0xd
0|16|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|919|0x11
0|17|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|238|0x5
0|18|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:65a693623cee0837b4ad0d23241c84cd3ea23e3a|315|0x17
0|19|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:65a693623cee0837b4ad0d23241c84cd3ea23e3a|290|0x8
0|20|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|757|0xc
0|21|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|56|0x14
0|22|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:65a693623cee0837b4ad0d23241c84cd3ea23e3a|263|0x11
0|23|libc-2.27.so||||0x21b97
0|24|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:65a693623cee0837b4ad0d23241c84cd3ea23e3a|184|0x5
Flags: in-testsuite?

(In reply to Jason Kratzer [:jkratzer] from comment #0)

Created attachment 9066505 [details]
testcase.html

Testcase found while fuzzing mozilla-central rev 65a693623cee. Testcase requires a build with --enable-fuzzing.

I think we can rewrite it as a simple mochitest. We have SpecialPowers.forceCC(); and SpecialPowers.gc();

Kershaw, can you take a look?

Flags: needinfo?(kershaw)
Priority: -- → P2
Whiteboard: [necko-triaged]

I'll try to find time to take a look next week.

Assignee: nobody → kershaw
Flags: needinfo?(kershaw)

There are 27 total failures in the last 7 days on windows10-64 debug and windows7-32 debug.

Recent failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=258541796&repo=autoland&lineNumber=3811

There are 27 total failures in the last 7 days on windows10-64 debug and windows7-32 debug.

Recent failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=258541796&repo=autoland&lineNumber=3811

[task 2019-07-26T18:52:01.208Z] 18:52:01 INFO - TEST-START | browser/base/content/test/contextMenu/browser_utilityOverlayPrincipal.js
[task 2019-07-26T18:52:01.227Z] 18:52:01 INFO - GECKO(5388) | ++DOCSHELL 000001FAA7C3C000 == 6 [pid = 2876] [id = {73c33b3e-64e2-40bd-80b8-bed73654b8cf}]
[task 2019-07-26T18:52:01.227Z] 18:52:01 INFO - GECKO(5388) | ++DOMWINDOW == 32 (000001FAA8512980) [pid = 2876] [serial = 45] [outer = 0000000000000000]
[task 2019-07-26T18:52:01.245Z] 18:52:01 INFO - GECKO(5388) | [Child 2876, Main Thread] WARNING: No active window: file z:/build/build/src/js/xpconnect/src/XPCJSContext.cpp, line 664

[task 2019-07-26T18:52:40.882Z] 18:52:40 INFO - GECKO(2144) | [Child 8448, Main Thread] WARNING: No active window: file z:/build/build/src/js/xpconnect/src/XPCJSContext.cpp, line 664
[task 2019-07-26T18:52:40.882Z] 18:52:40 INFO - GECKO(2144) | ++DOCSHELL 000001501254C000 == 6 [pid = 2000] [id = {7d678b62-be13-4635-af95-ddefd153e04f}]
[task 2019-07-26T18:52:40.882Z] 18:52:40 INFO - GECKO(2144) | ++DOMWINDOW == 16 (0000015012575020) [pid = 2000] [serial = 16] [outer = 0000000000000000]
[task 2019-07-26T18:52:40.883Z] 18:52:40 INFO - GECKO(2144) | [Child 2000, Main Thread] WARNING: No active window: file z:/build/build/src/js/xpconnect/src/XPCJSContext.cpp, line 664
[task 2019-07-26T18:52:40.883Z] 18:52:40 INFO - GECKO(2144) | ++DOMWINDOW == 17 (000001500FAEFC00) [pid = 2000] [serial = 17] [outer = 0000015012575020]
[task 2019-07-26T18:52:40.884Z] 18:52:40 INFO - GECKO(2144) | [Child 7672, Main Thread] WARNING: 'self->mIsBeingDestroyed', file z:/build/build/src/docshell/base/nsDocShell.cpp, line 13349
[task 2019-07-26T18:52:40.884Z] 18:52:40 INFO - GECKO(2144) | ++DOMWINDOW == 18 (00000150125CF800) [pid = 2000] [serial = 18] [outer = 0000015012575020]
[task 2019-07-26T18:52:40.885Z] 18:52:40 INFO - GECKO(2144) | [Child 2000, Main Thread] WARNING: NS_ENSURE_SUCCESS(mStatus, *this) failed with result 0x80004005: file z:/build/build/src/obj-firefox/dist/include\nsIURIMutator.h, line 489
[task 2019-07-26T18:52:40.885Z] 18:52:40 INFO - GECKO(2144) | Assertion failure: mListener, at z:/build/build/src/netwerk/protocol/http/HttpChannelChild.cpp:669
[task 2019-07-26T18:52:40.885Z] 18:52:40 INFO - GECKO(2144) | #01: mozilla::net::StartRequestEvent::Run() [netwerk/protocol/http/HttpChannelChild.cpp:434]
[task 2019-07-26T18:52:40.885Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.886Z] 18:52:40 INFO - GECKO(2144) | #02: mozilla::net::ChannelEventQueue::RunOrEnqueue(mozilla::net::ChannelEvent *,bool) [netwerk/ipc/ChannelEventQueue.h:211]
[task 2019-07-26T18:52:40.886Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.887Z] 18:52:40 INFO - GECKO(2144) | #03: mozilla::net::HttpChannelChild::RecvOnStartRequest(nsresult const &,mozilla::net::nsHttpResponseHead const &,bool const &,mozilla::net::nsHttpHeaderArray const &,mozilla::net::ParentLoadInfoForwarderArgs const &,bool const &,bool const &,bool const &,unsigned __int64 const &,int const &,unsigned int const &,nsTString<char> const &,nsTString<char> const &,mozilla::net::NetAddr const &,mozilla::net::NetAddr const &,short const &,unsigned int const &,nsTString<char> const &,__int64 const &,bool const &,bool const &,bool const &,mozilla::net::ResourceTimingStruct const &,bool const &) [netwerk/protocol/http/HttpChannelChild.cpp:503]
[task 2019-07-26T18:52:40.887Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.887Z] 18:52:40 INFO - GECKO(2144) | #04: mozilla::net::PHttpChannelChild::OnMessageReceived(IPC::Message const &) [s3:gecko-generated-sources:de6e62b5b8b2d215fd040fa8c3a0059a181586162b79414902eebddb82a627c39fec7830029ac6bfad0e20f16bedb00c9c57e08cdb89e06055b5a075914ff5ce/ipc/ipdl/PHttpChannelChild.cpp::859]
[task 2019-07-26T18:52:40.887Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.888Z] 18:52:40 INFO - GECKO(2144) | #05: mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const &) [s3:gecko-generated-sources:fe9c412b09ea5d02bf978c9968f2a3c5534468eac86b8ad819a04998026fc5df4807f2c7c1e13488cab00cbc59643a6981e768237ed314bd268333efbc487d39/ipc/ipdl/PContentChild.cpp::7211]
[task 2019-07-26T18:52:40.888Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.888Z] 18:52:40 INFO - GECKO(2144) | #06: mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy *,IPC::Message const &) [ipc/glue/MessageChannel.cpp:2185]
[task 2019-07-26T18:52:40.889Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.889Z] 18:52:40 INFO - GECKO(2144) | #07: mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message &&) [ipc/glue/MessageChannel.cpp:2108]
[task 2019-07-26T18:52:40.889Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.890Z] 18:52:40 INFO - GECKO(2144) | #08: mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask &) [ipc/glue/MessageChannel.cpp:1956]
[task 2019-07-26T18:52:40.890Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.890Z] 18:52:40 INFO - GECKO(2144) | #09: mozilla::ipc::MessageChannel::MessageTask::Run() [ipc/glue/MessageChannel.cpp:1988]
[task 2019-07-26T18:52:40.890Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.891Z] 18:52:40 INFO - GECKO(2144) | #10: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1213]
[task 2019-07-26T18:52:40.891Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.891Z] 18:52:40 INFO - GECKO(2144) | #11: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:486]
[task 2019-07-26T18:52:40.892Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.892Z] 18:52:40 INFO - GECKO(2144) | #12: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:88]
[task 2019-07-26T18:52:40.892Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.892Z] 18:52:40 INFO - GECKO(2144) | #13: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:309]
[task 2019-07-26T18:52:40.893Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.893Z] 18:52:40 INFO - GECKO(2144) | #14: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:291]
[task 2019-07-26T18:52:40.893Z] 18:52:40 INFO -
[task 2019-07-26T18:52:40.894Z] 18:52:40 INFO - GECKO(2144) | #15: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:139]

Kershaw are there any updates here?

Flags: needinfo?(kershaw)

There are 36 total failures in the last 7 days on windows10-64 debug, windows7-32 debug and linux64 debug.

Recent failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=259706855&repo=mozilla-central&lineNumber=2980

Kershaw are there any updates here?
Thank you!

Sorry for the delay.
I'll work on this this week.

Flags: needinfo?(kershaw)

I think I've figured out the problem.

[task 2019-07-26T18:52:40.884Z] 18:52:40 INFO - GECKO(2144) | [Child 7672, Main Thread] WARNING: 'self->mIsBeingDestroyed', file z:/build/build/src/docshell/base/nsDocShell.cpp, line 13349

This line shows that the docshell is destroyed, so HttpChannelChild::CompleteRedirectSetup will be never called and HttpChannelChild::mListener is always null.
Since OnChannelReady still returns NS_OK in this case, I think we should cancel the channel here.

Pushed by malexandru@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/40bbbbdef914
Cancel the redirect load if docshell is being destroyed r=mayhemer
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70

(In reply to PTO until September 9th from comment #1)

I think we can rewrite it as a simple mochitest. We have SpecialPowers.forceCC(); and SpecialPowers.gc();

Can we land the testcase for this bug as a mochitest or crashtest? Also, is this something we should consider for uplift?

Flags: needinfo?(kershaw)

I locally ran the test case, but I can't trigger the assertion. I think it's not easy to trigger the assertion reliably every time with the test case, so I didn't include the test case in my patch.

I think we don't need to uplift this, since this is an assertion failure which only hits on debug build. What do you think?

Flags: needinfo?(kershaw)

Looks like this isn't really hitting on Beta, so that's fine, thanks.

Flags: in-testsuite? → in-testsuite-
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: