Closed Bug 1571283 Opened 3 months ago Closed 2 months ago

Crash in [@ mozilla::dom::FetchDriver::OnStartRequest]

Categories

(Core :: DOM: Networking, defect, P2, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla70
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- fixed
firefox68 --- wontfix
firefox69 --- fixed
firefox70 --- fixed

People

(Reporter: worcester12345, Assigned: kershaw)

Details

(Keywords: crash, regression, Whiteboard: [necko-triaged])

Crash Data

Attachments

(1 file)

This bug is for crash report bp-78b472ee-e41e-4d36-826b-cfe960190804.

Top 10 frames of crashing thread:

0 xul.dll nsresult mozilla::dom::FetchDriver::OnStartRequest dom/fetch/FetchDriver.cpp:830
1 xul.dll void mozilla::net::HttpChannelChild::DoOnStartRequest netwerk/protocol/http/HttpChannelChild.cpp:683
2 xul.dll mozilla::net::HttpChannelChild::OnStartRequest netwerk/protocol/http/HttpChannelChild.cpp:608
3 xul.dll mozilla::net::StartRequestEvent::Run netwerk/protocol/http/HttpChannelChild.cpp:427
4 xul.dll mozilla::net::ChannelEventQueue::RunOrEnqueue netwerk/ipc/ChannelEventQueue.h:210
5 xul.dll class mozilla::ipc::IPCResult mozilla::net::HttpChannelChild::RecvOnStartRequest netwerk/protocol/http/HttpChannelChild.cpp:489
6 xul.dll mozilla::net::PHttpChannelChild::OnMessageReceived ipc/ipdl/PHttpChannelChild.cpp:859
7 xul.dll mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:7197
8 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2082
9 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1970

Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0 ID:20190801185445

Moving to hopefully a better component based on the stack. Crashes affect all platforms and go back to at least 68.

Status: UNCONFIRMED → NEW
Component: General → DOM: Core & HTML
Ever confirmed: true
Keywords: crash, regression
OS: Windows 7 → All
Product: Firefox → Core
Hardware: x86_64 → All
Version: 69 Branch → Trunk
Component: DOM: Core & HTML → DOM: Networking

Adding a ni to the triage owner to prioritize. This isn't very high volume on release.

Flags: needinfo?(nhnguyen)

will be triaged per usual Necko process

Flags: needinfo?(nhnguyen)
Assignee: nobody → kershaw
Priority: -- → P2
Whiteboard: [necko-triaged]

According to the crash report, it looks like that mObserver is null.
I think it is likely that FetchDriver::Abort is called off main thread.
We should add a null check and make sure we set mObserver to null and cancel the channel on main thread.

Pushed by kjang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a8e1c8f886fb
Add null check for mObserver r=baku
Status: NEW → RESOLVED
Closed: 2 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70

Please nominate this for Beta & ESR68 approval when you get a chance.

Flags: needinfo?(kershaw)

Comment on attachment 9085708 [details]
Bug 1571283 - Add null check for mObserver

Beta/Release Uplift Approval Request

  • User impact if declined: Firefox could crash.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: n/a
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This patch simply adds a null check.
  • String changes made/needed: n/a

ESR Uplift Approval Request

  • If this is not a sec:{high,crit} bug, please state case for ESR consideration: Reduce the crash rate.
  • User impact if declined: Firefox could crash.
  • Fix Landed on Version: 70
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This patch simply adds a null check.
  • String or UUID changes made by this patch: n/a
Flags: needinfo?(kershaw)
Attachment #9085708 - Flags: approval-mozilla-esr68?
Attachment #9085708 - Flags: approval-mozilla-beta?

Comment on attachment 9085708 [details]
Bug 1571283 - Add null check for mObserver

Simple crash fix, approved for 69.0b16 and 68.1esr.

Attachment #9085708 - Flags: approval-mozilla-esr68?
Attachment #9085708 - Flags: approval-mozilla-esr68+
Attachment #9085708 - Flags: approval-mozilla-beta?
Attachment #9085708 - Flags: approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.