Closed Bug 1570950 Opened 6 months ago Closed 6 months ago

Crash in [@ mozilla::ipc::MessageChannel::Clear | mozilla::ipc::MessageChannel::~MessageChannel | mozilla::ipc::IToplevelProtocol::~IToplevelProtocol]

Categories

(Core :: Networking, defect, P1, critical)

Unspecified
Windows 10
defect

Tracking

()

RESOLVED FIXED
mozilla70
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox68 --- unaffected
firefox69 --- unaffected
firefox70 --- fixed

People

(Reporter: gsvelto, Assigned: kershaw)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, Whiteboard: [necko-triaged])

Crash Data

Attachments

(1 file)

This bug is for crash report bp-45e02c4f-1812-44a4-803b-a07210190721.

Top 10 frames of crashing thread:

0 xul.dll mozilla::ipc::MessageChannel::Clear ipc/glue/MessageChannel.cpp:755
1 xul.dll mozilla::ipc::MessageChannel::~MessageChannel ipc/glue/MessageChannel.cpp:644
2 xul.dll mozilla::ipc::IToplevelProtocol::~IToplevelProtocol ipc/glue/ProtocolUtils.cpp:680
3 xul.dll void `anonymous namespace'::ChildImpl::~ChildImpl ipc/glue/BackgroundChildImpl.cpp:126
4 xul.dll mozilla::ipc::BackgroundChild::GetOrCreateSocketActorForCurrentThread ipc/glue/BackgroundImpl.cpp:664
5 xul.dll void mozilla::MozPromise<RefPtr<mozilla::net::SocketProcessBridgeChild>, nsTString<char>, 0>::ThenValue<`lambda at z:/task_1563486883/build/src/media/webrtc/signaling/src/peerconnection/MediaTransportHandlerIPC.cpp:26:7', `lambda at z:/task_1563486883/build/src/media/webrtc/signaling/src/peerconnection/MediaTransportHandlerIPC.cpp:38:7'>::DoResolveOrRejectInternal xpcom/threads/MozPromise.h:717
6 xul.dll mozilla::MozPromise<RefPtr<mozilla::net::SocketProcessBridgeChild>, nsTString<char>, 0>::ThenValueBase::ResolveOrRejectRunnable::Run xpcom/threads/MozPromise.h:393
7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
8 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
9 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:88

This is the first of a handful of socket process crashes. Crashes with this signature have appeared before (see bug 1372850) but they're unrelated since they all happen on Mac in the GPU process while this is Windows-specific. This looks like a potential regression.

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression

Kershaw, can you take a look. This is a socket process bug.

Flags: needinfo?(kershaw)
Priority: -- → P1
Whiteboard: [necko-triaged]
Assignee: nobody → kershaw
Flags: needinfo?(kershaw)

From the stack, it seems that ChildImpl was deleted in GetOrCreateSocketActorForCurrentThread. It could only happen if SendInitBackground failed.
I think we should close the IPC channel before releasing ChildImpl.

Pushed by kjang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/1a0970e3338e
Make sure the IPC channel is closed before destroying r=jld
Status: NEW → RESOLVED
Closed: 6 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70
You need to log in before you can comment on or make changes to this bug.