1570950 - Crash in [@ mozilla::ipc::MessageChannel::Clear | mozilla::ipc::MessageChannel::~MessageChannel | mozilla::ipc::IToplevelProtocol::~IToplevelProtocol]

Status: RESOLVED FIXED

(Core :: Networking, defect, P1)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-45e02c4f-1812-44a4-803b-a07210190721.

Top 10 frames of crashing thread:

0 xul.dll mozilla::ipc::MessageChannel::Clear ipc/glue/MessageChannel.cpp:755
1 xul.dll mozilla::ipc::MessageChannel::~MessageChannel ipc/glue/MessageChannel.cpp:644
2 xul.dll mozilla::ipc::IToplevelProtocol::~IToplevelProtocol ipc/glue/ProtocolUtils.cpp:680
3 xul.dll void `anonymous namespace'::ChildImpl::~ChildImpl ipc/glue/BackgroundChildImpl.cpp:126
4 xul.dll mozilla::ipc::BackgroundChild::GetOrCreateSocketActorForCurrentThread ipc/glue/BackgroundImpl.cpp:664
5 xul.dll void mozilla::MozPromise<RefPtr<mozilla::net::SocketProcessBridgeChild>, nsTString<char>, 0>::ThenValue<`lambda at z:/task_1563486883/build/src/media/webrtc/signaling/src/peerconnection/MediaTransportHandlerIPC.cpp:26:7', `lambda at z:/task_1563486883/build/src/media/webrtc/signaling/src/peerconnection/MediaTransportHandlerIPC.cpp:38:7'>::DoResolveOrRejectInternal xpcom/threads/MozPromise.h:717
6 xul.dll mozilla::MozPromise<RefPtr<mozilla::net::SocketProcessBridgeChild>, nsTString<char>, 0>::ThenValueBase::ResolveOrRejectRunnable::Run xpcom/threads/MozPromise.h:393
7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
8 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
9 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:88

This is the first of a handful of socket process crashes. Crashes with this signature have appeared before (see bug 1372850) but they're unrelated since they all happen on Mac in the GPU process while this is Windows-specific. This looks like a potential regression.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 2

[Dragana Damjanovic [:dragana]]

Kershaw, can you take a look. This is a socket process bug.

Comment 3

[Kershaw Chang [:kershaw]]

From the stack, it seems that ChildImpl was deleted in GetOrCreateSocketActorForCurrentThread. It could only happen if SendInitBackground failed.
I think we should close the IPC channel before releasing ChildImpl.

Comment 4

[Kershaw Chang [:kershaw]]

Attachment: Bug 1570950 - Make sure the IPC channel is closed before destroying

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1a0970e3338e
Make sure the IPC channel is closed before destroying r=jld

Comment 6

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/1a0970e3338e